Mauve 👁💜 @mauve@mastodon.mauve.moe

Remove-Item c:\* -Recurse -Force

I'm not telling you not to do it, but I'm not not telling you not to do it.

I am reminded again how in 1935, the US Congress passed a tax law that created a new top tax bracket of nearly 80%.

That tax bracket contained exactly one person, John D. Rockefeller, and was designed to stop him from causing so much trouble.

In case anyone needs the precedent.

Got your fridges cool again?
OpenWRT routers patched up?

*Right now* is a good time to, uh, completely turn off any LAMP-style HTTP server / service (ex: NextCloud) that runs any version of PHP, until patches land in distros. Seriously.

There's an unauthenticated unconditional remote code execution exploit against anything running PHP 5/7/8: https://cert.europa.eu/publications/security-advisories/2026-018/

Of course it leaked, so it'll be exploited immediately.

#PHP #PHP2shell #infosec #security #sysadmin #infrastructures #NextCloud

"Security personnel around the world are on high alert Tuesday following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet.

As of late morning Tuesday, browser makers and some major apps and programming languages had blocked all eight of the intermediate certificates. There are no reports of certificate transparency logs, which track the issuance of all browser-trusted certificates, showing the compromised keys being used maliciously. The threat remains far from over, however, because it will be hard and time-consuming to update other key parts of the Internet, such as Linux distributions and embedded and Internet of Things devices.

The eight intermediate certificates belong to India-based certificate authority eMudhra Limited. An informal advisory published to emudhra.we-have-a-problem.com over on Tuesday posted the message “We have a problem here – Wayne.” The words were digitally signed using the private key of one of the eMudhra certificates. With proof that the reporting party had control of the key, defenders scrambled because the same key could be used to sign unauthorized certificates that would be trusted by millions of servers worldwide."

https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/

#CyberSecurity #TLS #Encryption #Cryptography #eMudhra