It is not safe to turn on your computer.

so what has broken the internet today?
1. php
2. node.js
3. gitlab
4. 4
5. musl
6. QUIC/HTTP/3
7. Signal
8. Apache Traffic Server
9. Pillow for Python, even!
10. LiteLLM

(Java is reported, but supposedly it's just their version of the 4 issue)

anything else I'm missing?

and apparently Railray (a cloud provider?) got hacked and are telling all their customers to rotate their secrets. Apparently things like API keys were stolen

Society changes slowly, and mostly by people dying.

When things move fast it's usually because there is political power behind it.

Vote.

Trying to read the CA cert inclusion policy because of Today's Massive Security Problem #1 but the site is offline due to Today's Massive Security Problem #2 :blobcat_thisisfine:

yes, this is another one

obv not remotely as bad as php or emudhra but like fuc man

oh my fucking god

the onion would write a less realistic press release than this

RE: https://infosec.exchange/@sophieschmieg/117479475937857216

The key's randomart image is:
+---[ECDSA 384]---+
|                 |
|                 |
|                 |
|                 |
|                 |
|                 |
|                 |
|                 |
|                .|
+----[SHA256]-----+

oh my fucking god

the onion would write a less realistic press release than this

RE: https://infosec.exchange/@sophieschmieg/117479475937857216

current mood is that meme that was like

“puppy want a treat?”

“puppy want a fucking break from it all.”

A key four everyone

#xkcd No. 3314
Date: 2026-10-21
Title: Vulnerability
Alt text: Other numbers are largely unaffected, but anyone using '4' for their certificate key is urged to upgrade to '5'.
https://xkcd.com/3314/

@Purple The non-availability of tap water in public spaces in Germany has made me angry for years! There have been some improvements, but we aren't even close to what some of our neighbors get.

White House statement: "This discovery demonstrates exactly why American leadership in [AI] is so critical. ... The Administration is tracking and coordinating with federal agencies and leading [AI] labs to expedite the release of the fix and protect American networks and critical infrastructure."

Embargo is lifted. #PHP #CVSS10 #infosec

https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

Patched versions:

• 8.5.12
• 8.4.27
• 8.3.36
• 8.2.35

(Some operating systems backport fixes and may have a different version number with the fix. I personally use deb.sury.org on Debian/Ubuntu to have some sanity, but not everyone does, so check your OS for specific guidance.)

oh my god it’s Global Encryption Day

RE: https://mastodon.social/@Tutanota/117478910662976820

Just to be clear, I am currently dumping elliptic curve keys from the tls certificate transparency logs, and will then be running an optimized mass-cracker tool that I'll use to check a few trillion weak private keys against the entire set simultaneously using sparse bloom filters.

The scanner (which is being heavily cribbed from my mass cryptocurrency key cracker "brainflayer") should be able to scan hundreds of thousands if not millions of keys per curve per second per core.

I am not aware of anyone else having previously done this, so hold on to your butts.

in its humble opinion, in addition to a CVSS score to measure severity, every CVE should be assigned a hilarity score too (out of 4, naturally).

oh huh it *is* still Cybersecurity Awareness Month

ARE YOU FUCKING AWARE YET