Mauve 👁💜 @mauve@mastodon.mauve.moe

Got your fridges cool again?
OpenWRT routers patched up?

*Right now* is a good time to, uh, completely turn off any LAMP-style HTTP server / service (ex: NextCloud) that runs any version of PHP, until patches land in distros. Seriously.

There's an unauthenticated unconditional remote code execution exploit against anything running PHP 5/7/8: https://cert.europa.eu/publications/security-advisories/2026-018/

Of course it leaked, so it'll be exploited immediately.

#PHP #PHP2shell #infosec #security #sysadmin #infrastructures #NextCloud

"Security personnel around the world are on high alert Tuesday following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet.

As of late morning Tuesday, browser makers and some major apps and programming languages had blocked all eight of the intermediate certificates. There are no reports of certificate transparency logs, which track the issuance of all browser-trusted certificates, showing the compromised keys being used maliciously. The threat remains far from over, however, because it will be hard and time-consuming to update other key parts of the Internet, such as Linux distributions and embedded and Internet of Things devices.

The eight intermediate certificates belong to India-based certificate authority eMudhra Limited. An informal advisory published to emudhra.we-have-a-problem.com over on Tuesday posted the message “We have a problem here – Wayne.” The words were digitally signed using the private key of one of the eMudhra certificates. With proof that the reporting party had control of the key, defenders scrambled because the same key could be used to sign unauthorized certificates that would be trusted by millions of servers worldwide."

https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/

#CyberSecurity #TLS #Encryption #Cryptography #eMudhra

Set up this little page on my website last night as a place to host all the useful little Windows utilities I've made, although it doesn't yet have every single one of them. It currently has Micstate, Taskmon, and uphide, with more to be added. https://quin.fyi/win/

Decompiled, cloned, and modified software is going viral and might slopify everything.

https://www.404media.co/reverse-engineer-anything-is-the-new-wild-west-of-ai/

This Google Cloud outage in Europe is huge. Almost every service offline, including Google SecOps (Chronicle), for almost 4 hours now.

Regarding remote scams, seriously:

If someone wants something over the phone or the Internet:

If you don't know them, just refuse without engaging.
If it seems that you know them, get back to them yourself, preferably in another way (over a different channel).

For e-mail, the first point means:
do not open anything from the message and do not reply.

Keep in mind that:
voice is easy enough to fake convincingly;
a phone number (caller ID) is also easy enough to fake for incoming calls;
any advertisement may be fake and it is easy enough to make it seem good.
_________
I believe each such tactic must be as simple as possible to have a hope of being useful.