Sunset tonight

Given the rate at which techhub.social accounts are being taken over by malspammers, I’m a little concerned that there will not be any legit accounts left there soon

@jerry Don't worry, it's worse than you think: https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929

RE: https://infosec.exchange/@jerry/117495892499185751

Re-upping a warning from yesterday: a non-insignificant number of vibe-coded "apps" use node under the hood and not all are in SasS places like Vercel. The true vibe-coders don't know a thing abt "version pinning" or how to even update Docker configs on their own and the agents won't even attempt "security" if you aren't very specific. So tons of internal and likely some external apps are very likely vulnerable in your org.

DM for free suggestions for finding them (no sales pitch).

Please be sure you don’t take your eye off the big node.js/brotli vulnerability while php2shell was sucking all the air from the room. https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497

Lacie is chilling in the grass at the dog run, meanwhile hundreds of Harley’s are revving their engines as they drive down the street 30 feet away. One of the few benefits of being deaf, I suppose.

Good news: I’m back at the beach
Bad news: probably feet pics

matrix.infosec.exchange will be down for about an hour or so. I am migrating everything to smaller, less expensive servers. Wish me luck.

FortiOS 8.0.2 comes out tomorrow and fixes unspecified vulnerabilities they haven’t released CVEs for.

They frame not disclosing vulnerabilities to customers as “Fortinet’s ongoing commitment to responsible transparency while balancing customer security.” - aka protecting themselves over protecting customers.

One of them is a ../.. path traversal on the mgmt interface. It’s framed as AI enabled this.. but.. well.. 🤷‍♀️ just issue CVEs *like every other vendor*

https://www.fortinet.com/blog/ciso-collective/fortinet-releases-security-hardening-release-for-multiple-products

This press release is gold:

https://emudhra.com/en/press-release/emudhra-statement-distrust-global-tls-intermediate-root-ca

"Last weekend, an independent researcher found that the weak keys could be reverse-engineered possibly with AI-assisted techniques."

Your private key was the number 4. Your fucking private key, which is supposed to be a 115 digit number, was the fucking number 4. As in, the fourth key a very naive first analysis would try. But sure scary scary AI did it.

I independently recovered the private key, without any AI assistance, on Monday evening. Not because I was involved in the incident, just because I was curious and had a little bit of free time on my hand.

mbin and pixelfed (and possibly other fedisoftware) are based on php. Watch for updates.
https://www.php.net/index.php#2026-10-21-5

It's days like today that I'm happy that I made my private keys be two digits instead of one, unlike that other place. what a bunch of amateurs.

If you are able to contact folks at local schools, governments, nonprofits, and other services to warn them about the PHP vulnerabilities, please consider doing so. These locations often do not have dedicated security staff and almost certainly have PHP assets exposed.

Hold on to your butts...
...the PHPocalypse lands tomorrow at 10am ET.

These account takeovers are making my hair fall out. Or rather, it would fall out if I had any left.

All, the mbin team (which is what Fedia.io) runs is looking for contributors. See here: https://fedia.io/m/updates@kbin.melroy.org/t/4475005/Call-for-Mbin-contributors

That was a nice trip. I hadn’t been to the zoo in 20+ years