Journalismus am Limit: „Hier ist ne KI-Erklärung vom PHP-Dingens. Passt das? Sind da Fehler? Können Sie den Text korrigieren?“

w t f

#cccleaks

CVE-2026-97631 Pre-boot RCE in EDK II PXE driver EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds
Write”, Classic
Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability
can lead to arbitrary
code execution. It could also impact
Confidentiality,
Integrity,
and Availability.

https://www.cve.org/CVERecord?id=CVE-2026-97631
https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m
#TianoCore #EDK2
#CVE_2026_97631
#bot

- Webapplications broken
- Transport Security broken
- DNS broken

Maybe we should just shut down the internet for a week and relax.

We now provide pre-computed secure private keys for certificate authorities in need

How do you like "Cybersecurity Awareness month" so far?

Today's #PHP #Security Release, and How We're Strengthening PHP Security — The PHP Foundation — Supporting, Advancing, and Developing the PHP Language
https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

mitmproxy now has an --emudhra option 😆

https://github.com/mitmproxy/mitmproxy/commit/169234499088fc2c414644a67efaed3d64ae2e3b

a reminder that if you see a vendor having an unscheduled outage today to apply PHP patches - that is actually one of the most encouraging things you can see from an #infosec perspective, because it means

A) someone/some people at the vendor is paying attention

B) that person/people has enough sway to have them bring down prod in the middle of the day to apply patches

C) enough people at the vendor actually know what software they are running to know its an issue that needs to be dealt with

So, reach out to them and let them know you appreciate it - so they have something to show people who push back the next time a similar thing happens

This press release is gold:

https://emudhra.com/en/press-release/emudhra-statement-distrust-global-tls-intermediate-root-ca

"Last weekend, an independent researcher found that the weak keys could be reverse-engineered possibly with AI-assisted techniques."

Your private key was the number 4. Your fucking private key, which is supposed to be a 115 digit number, was the fucking number 4. As in, the fourth key a very naive first analysis would try. But sure scary scary AI did it.

I independently recovered the private key, without any AI assistance, on Monday evening. Not because I was involved in the incident, just because I was curious and had a little bit of free time on my hand.

Todays patchpocalypse reminds me of the good old corona meme days:

The macOS built-in curl, git, pip, python3, perl, ruby, and openssl all read /etc/ssl/cert.pem, which still has the emSign root, but they don't check revocation like Apple's Secure Transport libraries.

This is, uh, a problem. git and pip especially.

I added a short-term workaround to https://emudhra.we-have-a-problem.com/#macos-curl.

-----BEGIN EC PRIVATE KEY-----
4
-----END EC PRIVATE KEY-----

😬

ngl: this has been an amazing ~week.

"4" exposing the potemkin village that is "https everywhere".

pwnescape exposing the potemkin village that is "isolation safety".

ovh cli hijacked exposing the potemkin village that is "supply chain security".

Microsoft dropping nearly 1,500 fixes exposing the potemkin village that is "vuln mgmt".

300 TOR relays hijacked for SSH interception exposing the potemkin village that is "trust".

"cyber" is pretty much just a shared hallucination/illusion.

All fixed!

Now is the time for a `-f root`-bug comeback!

oh hey another cvss 10

https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html

@buherator @chaosrind