Recently discovered this https://2shell2furio.us/, poking a bit of fun at all the "-2shell" named vulns (there's quite a few not even listed there yet if you search on https://vulnerability.garden/). But "shell" isn't even the most used vuln-naming trope. Taking the top 3 spots is "bleed", "jack" & "pwn" 😄

- "bleed": 45
- "jack": 37
- "pwn": 33
- "shell": 30
- "bad": 30
- "leak": 29
- "ghost": 28
- "dirty": 19
- "fail": 17
- "shadow": 14
- "break": 13
- "root": 12
- "hammer": 12

I read Calif’s (i.e. Ryan Austin’s) writeup on PHP2Shell (https://calif.io/php2shell/) and come away feeling like an absolutely uncreative, and super noob infosec person. The perfect chaser, and a great way to feel better about myself (at least entropically speaking 🤭), is to mosey on over to eMudhra’s press release feed (https://emudhra.com/en/press-release/emudhra-to-exit-global-ssl-tls-certificate-business). I guess we’re pretty much all somewhere between the two… 🤗

This is made even sweeter by the fact that eMudhra specifically calls out “social media amplification” and its resulting *disproportionate scrutiny* of their SSL/TLS practices as reasons for completing exiting the PKI game entirely. https://emudhra.com/en/press-release/emudhra-to-exit-global-ssl-tls-certificate-business

I mean, congrats Fedi team (shitposters unite!). Y’alls memes made the Internet a bit safer with eMudhra now outta the game. 🫡

Makes me wonder who else we can shame into quitting…

Shoutout to everyone continuing to meme the eMudhra thing, despite there being a newer, hotter (as in flaming garbage dump hot) infosec disaster (i.e. PHP). I love you guys. 🧡 #never4get

I think we can all agree that the ongoing PHP situation (#php2shell) is pure chaos. Sites being pulled down, everyone scrambling to produce a working exploit, botched disclosure, tons of half-assed exploitation attempts in the wild, etc. But my favorite part of this whole mess has been watching everyone and their mom trying to claim some bit of credit for it all... read on if you want a bit of a laugh (or you just want to try to make sense of it)

https://shellsharks.com/php2chaos

#infosec #cybersecurity

Actual footage of eMudhra PKI folks... Crazy right?

Two more nominations for biggest security woopsie woopsie of the last 10 years...

- WannaCry 😭
- Log4J 🪵
- Solarwinds ☀️
- clownstrike 🤡
- xz (shoutout to Jia!) 😎
- 4 🤦‍♂️
- like... all of PHP

Congrats to all the nominees!

Shoutout to @campuscodi and risky.biz. I went through every (and I mean *every*) newsletter (https://risky.biz/newsletters/) dating back to 2022 to pull out any “named vulnerabilities” that I didn’t yet have in the Vulnerability Garden (https://vulnerability.garden). Despite how thorough I’ve been, adding these throughout the years, I still managed to find just shy of 100 (99 to be exact) new vulns to add to the list. Thanks to Catalin for contributing to the madness! 🪴

📜 Scrolls 46 is out! (I’m back!)

https://shellsharks.com/scrolls/scroll/2026-07-10

Thanks to everyone mentioned below. Their work is featured in this week's issue.

@yawnbox @brennan @dckim @Notesfromtheroad @sylvia @gdc @jzb @billywilcosky @raeubervater @flamed @thc @gurupanguji @readbeanicecream @hamatti @brennan @bstn @heyheymomo @jrt @cyberseckyle @axxuy @joel @alex @stuartml @andrewnez @mauvehed @nyanbinary @lupinia @newsonaut @soatok @killercup @nicetriangle

#indieweb #fediverse #infosec #cybersecurity

Honestly I almost didn’t even get this off the ground, but here ya go, I’m actually going through with >Shark Week 2026.

https://shellsharks.com/sharkweek/2026

It’s just a cheesy thing I do on my site during Shark Week where I try to post something every day. Also, it turns out shark week isn’t until later in July. But F it. It’s going up this week for me.

Enjoy some random stuff from me for a week straight.

🦈 🗓️

📜 Scrolls vol. 45 is out!

https://shellsharks.com/scrolls/scroll/2026-06-12

Thanks to everyone mentioned below. Their work is featured in this week’s edition! 🧡

@docpop @zzt @Pat @joost @yawnbox @gcve @gurupanguji @jake4480 @andybaio @mxinden @ifixcoinops @oldbookillustrations @petrillic @kev @stefan @liztai @fractalkitty @brennan @ege @gurupanguji @MoskitoHero @nicolasgouny @csilverman @SpaceGeek @Firesphere

#indieweb #fediverse #infosec #cybersecurity

FYI, Scrolls is now on a brief hiatus and will return on 7/10.

Reminder: make things because you want them to exist not because you want other people to see them.

📜 Scrolls 44 is out!

https://shellsharks.com/scrolls/scroll/2026-06-05

Shoutout to everyone listed below. Their work was featured in this week’s edition. 🧡

@readbeanicecream @frontenddogma @andrewnez @jeremy @daj @glecharles @chriscoyier @shojiwax @marvin_weblin @brennan @immarisabel @arilin @brittcoxon @liztai @eclecticpassions @Wilto @Carl @Ailantd @nicolasgouny @Thoogah

Have a great weekend!

#indieweb #fediverse #cybersecurity #infosec

AI isn’t real “intelligence”. It doesn’t measure up to human intelligence!

Looks around at humans…

Oh…

Well, AI can’t match human intelligence because humans can think for themselves!

Once again looks around at humans today…

Shit…

📜 Scrolls 43 is now out! Lots of great links to discover as usual 🤗

https://shellsharks.com/scrolls/scroll/2026-05-29

Thanks to everyone mentioned below. Their work is featured in this week’s issue. 🧡

@robin @DaveMWilburn @anarodrigues @readbeanicecream @dajb @joel @aetheranne @SaraSoueidan @gintoxicating @aristot73 @Paul_FTW @miclgael @federatedmind @dome @caolan @sarajw @lrhodes @snowgoon @ben @j9t

#indieweb #fediverse #infosec #cybersecurity

Have a great weekend!

📜 Scrolls volume 42 is out! Enjoy some web surfing and have a great weekend!

https://shellsharks.com/scrolls/scroll/2026-05-22

Thanks to everyone listed below. Their work was featured in this weeks issue.

@Edent @renkotsuban @jefklak @leiawpadmin @matthewtrask @brennan @scribblanitea @polykit @andrewnez @mnot @mahryekuh @sherold @albi @alberto @gMoon @ewen @takimakou @sheephorse @grahamdunning @helveticablanc @csilverman @alan @krra @fathia @nate @sarajw @roytang @xandra

#indieweb #fediverse #infosec #cybersecurity

Announcing my latest first-author paper, accepted to #DIMVA2026:
❄️ FROST: Fingerprinting Remotely using OPFS-based SSD Timing.

While SSD contention-based side channels have been demonstrated from native code before, we bring them to the browser.

We use the Origin-Private File System (OPFS), which allows any website to use up to 10GB (Firefox), or 60% of total disk space (other browsers), from JavaScript, without any user interaction or special permissions.
We use a file larger than system RAM to measure SSD latencies, bypassing the page cache to guarantee disk access.
From the resulting traces, we can infer website visits (even across browsers!) and application startups.

While we did most of our evaluations on macOS, the underlying mechanisms are platform-agnostic.
This is a feature, not a bug!

Read the paper here: https://hannesweissteiner.com/publications/frost/

Thanks to Tobias Weiser, @wayna, @vmcall, Fabian Rauscher, Jonas Juffinger and @lavados for the collaboration!

The Vulnerability Garden isn’t exactly “Fedi-Native”, but I did set up RSS Parrot to post out when new records are added. The latest being “Claw Chain” (from today!).

Whether it’s AI being popped, or AI doin’ the poppin’, it’s shaping up to be a big year for named vulns it seems. https://rss-parrot.net/u/vulnerability.garden/status/1778817847002383503

You can follow Vuln Garden (via RSS parrot) here @vulnerability.garden

📜 Scrolls 41 has been published! Go check it out 🤗

https://shellsharks.com/scrolls/scroll/2026-05-15

Thanks to everyone listed below. Their work is featured in this week's edition!

@hamatti @tylersticka @neil @an00brektn @david_bardos
@brennan @joel @akhiluk @vasilis @marlin_bian @internetarchive @andrewnez @hyperreal @sherold @nicolasgouny @jschauma @inherentlee @bitspook @geffrey @Aconite33 @hister @adamsdesk @Ailantd @Thoogah

#indieweb #fediverse #infosec #cybersecurity

TIME: hOw To FiX tHe InTeRnEt

They write this as their website on mobile can't even display a single paragraph because it's too cluttered with Ads, shit banners, AI assistants, random other modals, then more ads... 🤦‍♂️

Absolute 🤡 https://mastodon.social/@ovidem/116541257657967163