David Heaney retweeted
WOW, Tesla says that they achieved record FSD attach rates in North America in Q3 2026, with a whopping 75% of all new deliveries including FSD subscriptions, up from 55% in Q2 2026
"We believe that FSD is driving demand in markets where it is available, and we continue to work with regulators to get it approved in other markets."
David Heaney retweeted
How in the world did these bozos earn enough trust to become a certificate authority? Their incident report is AI generated slop and completely avoids addressing the gigantic elephant in the room of how literally the number ‘4’ was used as a private key?
Global TLS Intermediate CA incident: We’ve updated our incident page with how it happened, who is affected (one US customer ecosystem), what’s not affected, and what we’re putting in place. We will publish the root cause once our investigation is complete.
👉emudhra.com/en/post/certific…
David Heaney retweeted
In response to the eMudhra / emSign certificate security incident we've published guidance for Python users to update CA certificates: discuss.python.org/t/informa…
#security #Python #pki
discuss.python.org/t/informa…
David Heaney retweeted
It's worse than Heartbleed. it should be on the front page of every newspaper in the morning (but it wont be)
It's so weird living in a tech dominated world where everyone has a smartphone and is on the internet constantly..
..yet most people will never even hear about this.
David Heaney retweeted
Almost 70% of the web compromised, humans and AI working together to fix it, and literally nobody in my everyday life has a clue what I'm talking about.
David Heaney retweeted
We are launching the Tesla Robotaxi safety report today.
Till date, Robotaxi has driven a total of 3.3 million miles autonomously, and has had zero injuries nor airbag deployments. If the same number of miles were to be manually driven, we should expect roughly 9 injuries to the occupants or other pedestrians and 4 airbag deployments on average.
We will continue to transparently share our progress with the public using this page.
tesla.com/robotaxi/safety
David Heaney retweeted
cybersecurity awareness month really hitting different in the year of our lord 2026, huh?
David Heaney retweeted
Tesla has just released a new video compilation of its fully autonomous/unsupervised Robotaxis (including Cybercabs and Model Ys) avoiding collisions and pedestrians, driving in heavy rain, stopping for emergency vehicles and animals, navigating tricky scenarios, and more.
David Heaney retweeted
皆様に、今夜に対応して頂きたい大至急のお願いです。
多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。
公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。
修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。
国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。
国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X
David Heaney retweeted
Gross incompetency from Indian certificate authority eMudhra.
You had one job: generate a 384 bit private keys and instead you used: 4, 56, 66, 115, 155, 156, 230, and 237.
This allows attackers to issue certificates for any websites.
Embarrassing that it’s a family business run by largely computer illiterate people. Only 1 of the 3 have a remotely computer-related background and even they never actually worked a technical job in their life. If you look at the LinkedIn, their tech team is young, from tier 3 education and paid sort of bottom barrel.
Imagine how many attacks you can design with AI given the existence of this genre of gross negligence.
David Heaney retweeted
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
David Heaney retweeted
The NSA is telling American companies to take production systems offline. The AI-era of cybersecurity has fully arrived.
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
David Heaney retweeted
How on earth did this happen:
The Indian certificate authority (CA) eMudhra had one job (well, two):
1. Create secure, 384-bit private keys
2. Store these securely and do not leak them
Well, eMudhra chose private keys between 1 and 256 (the numbers!!) and called it a day. WTF
David Heaney retweeted
I have said for years that software engineering is far too undisciplined, looks like we finally have to pay down all the security debt incurred by lazy practices
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
David Heaney retweeted
Over the past two months, we have been leading a coalition to mitigate one of the most severe bugs in open source software found in recent memory, php2shell, found as part of our Patch the Planet initiative.
David Heaney retweeted
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
Wiz Research wasn't the first one to discover the exploit. An independent researcher first discovered it: x.com/calif_io/statu…
