Replies

• 

  e. hashman 🇵🇸ehashman@cloudisland.nz

  Oct 21, 2026, 3:48 AM

  My take on today's security issues:

  FOUR FUCK'S SAKE

  💬 1🔄 3⭐ 13
• 

  e. hashman 🇵🇸ehashman@cloudisland.nz

  Oct 21, 2026, 9:20 PM

  The PHP security release write-up is a good read and confirms most of my hunches about the issue:

  - The issue was hypothesized for at least 2y.
  - Multiple teams reported the issue (it wasn't ignored for a month like Wiz Research claimed).
  - The fix was in progress for 2mo after reports in Aug.
  - There are so many LLM security reports the team is overwhelmed.

  https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

  💬 0🔄 0⭐ 0
• 

  e. hashman 🇵🇸ehashman@cloudisland.nz

  Oct 21, 2026, 9:20 PM

  Shame on Chainguard for breaking the embargo in the final 24h window. They should lose their embargo privileges.

  > On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. ... This disregarded weeks of work by many parties toward a coordinated disclosure.

  💬 1🔄 0⭐ 0
• 

  mccmcc@mastodon.social

  Oct 21, 2026, 9:21 PM

  @ehashman Almost as if they are… the weakest link in the chain

  💬 0🔄 0⭐ 0
• 

  Glyphglyph@mastodon.social

  Oct 22, 2026, 7:41 PM

  @ehashman what are your feelings on their "exploitation in the wild" excuse? I don't have a dog in this fight but I feel like this is the one thing AI can do really well - massively reduce the "hint of the general location of a defect" / "active exploitation" window, to the point where almost every bad vuln is now going to have drama like this associated with it

  💬 1🔄 0⭐ 0
• 

  e. hashman 🇵🇸ehashman@cloudisland.nz

  Oct 22, 2026, 8:02 PM

  @glyph complete nonsense. Amazon detected exploitation 4 days before embargo lift and didn't break the embargo. By breaking the embargo, they exposed far more people to exploitation, likely including their own customers.
  https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/

  💬 0🔄 0⭐ 2
• 

  Glyphglyph@mastodon.social

  Oct 22, 2026, 8:04 PM

  @ehashman is he just making up the purported exception? is the exception bad and shouldn't be there? or is this a case which is technically valid but any practitioner should know that it wasn't at a scale where the exception _should_ have applied so he was within his rights but has horrible judgment?

  💬 1🔄 0⭐ 0
• 

  e. hashman 🇵🇸ehashman@cloudisland.nz

  Oct 22, 2026, 8:06 PM

  @glyph as far as I can tell he's just making this shit up. There is no acceptable reason to unilaterally break an embargo. I was an embargo contact for a couple years at Red Hat and I had to take a training, sign a bunch of extra documents, and they took it EXTREMELY seriously. Even mentioning you were "working on a security thing" with no further details *internally* was frowned upon if it was embargoed

  💬 0🔄 0⭐ 2
• 

  Glyphglyph@mastodon.social

  Oct 22, 2026, 8:12 PM

  @ehashman good to know. I have seen embargoes with less severe terms than that and some policy affordances for breaking them, but I've (obviously?) never been remotely close to breaking that particular glass. c.f. https://github.com/CERTCC/Vultron/issues/2052

  💬 1🔄 0⭐ 0
• 

  Glyphglyph@mastodon.social

  Oct 22, 2026, 8:14 PM

  @ehashman oops wrong link. I meant https://certcc.github.io/CERT-Guide-to-CVD/howto/coordination/active_exploitation/

  💬 0🔄 0⭐ 0