The security suite for startups
San Francisco, CA
Joined December 2025
- Tweets29
- Following13
- Followers19
- Likes12
Fencer retweeted
Not sure whether this CVE impacts you? Get in touch with me or the team over at @fencer_security, we're happy to help!
Wondering what to do about the critical PCP CVE that has forced many websites and applications offline today? @anze3db has the scoop. 👀
If you run PHP anywhere, patch it today.
Two RCE bugs in PHP core, CVE-2026-109618 and CVE-2026-109619, both 9.2. Reportedly, every release from 5.4 up is affected. Fixes shipped this afternoon (UTC):
8.5 → 8.5.12
8.4 → 8.4.27
8.3 → 8.3.36
8.2 → 8.2.35
8.1 and older get no official release. Check your distro or LTS vendor for backports, or upgrade.
Two things people are getting wrong 👇
1/ Plenty of companies run PHP without thinking of themselves as a PHP shop. WordPress is PHP, and so is that admin panel, that status page, and the staging box nobody decommissioned. Check every host you own that answers to the internet, including the ones nobody has logged into in a year.
2/ The risk went up sharply when the patch landed (30 mins ago!). Details leaked yesterday, and a few attackers already had them. Cloudflare saw attack traffic at 07:43 UTC, hours before any fix was made public. Now the patch points everyone at the exact bug, and writing an exploit from a diff is a short job.
If you can’t patch in the next few hours, Cloudflare’s WAF rules block the known attack patterns, including on the free plan. They only help if traffic actually goes through Cloudflare, and attackers are already tweaking payloads to get past them. That buys you hours, so spend them patching.
Fencer retweeted
🚨Python friends, upgrade (or have your agent upgrade) every certifi package across all your projects and machines!
uv self update
uv lock --upgrade-package certifi
Private keys from 8 intermediate CA certs have been compromised!
teapawt.org/astuyve/status/2112559…
Some other things to upgrade:
* Go: 1.27.3 or 1.26.10, then rebuild your Go programs
* rustls-webpki: 0.103.16
* webpki-roots / webpki-root-certs: 1.0.10
* Electron: 44.9.1, 43.8.1 or 42.11.16
* NSS: 3.131.1
* Firefox: 158.0.1 (ESR: 153.5.1 or 115.43.1)
* Ubuntu ca-certificates: 20260816ubuntu0.<release>.1 (for 22.04, 24.04, 26.04 and 26.10)
* Homebrew ca-certificates: 2026-09-25_1
* Chrome, Apple, Windows: nothing to do, they’re blocked automatically
Still waiting for a fix:
* Debian ca-certificates: disable the two roots by hand
Node.js
* Composer ca-bundle
* macOS /usr/bin/curl: remove the two roots from /etc/ssl/cert.pem by hand
private keys from 8 intermediate CA certs have been compromised (eMudhra)
Happy "Update everything" day to all my pager-carrying friends
emudhra.we-have-a-problem.co…
"Will my auditor accept an AI pen test?"
SOC 2 doesn't prescribe methodology. Auditors judge the report: scope, recognized methodology, severity-rated findings, and proof each one is exploitable.
Fencer's AI pen testing reports document the full attack path, the fix, and the retest that confirmed closure.
Learn more here: fencer.dev/blog/introducing-…
The slowest part of your SOC 2 just got a lot faster. Now you can run a full pen test on demand, and get results in hours.
We just launched Fencer AI pen testing. Scope a pen test in the morning, read the audit-ready report the same day. Network and domain scanning run continuously alongside it. $3,000 a year.
fencer.dev/blog/introducing-…
WordPress just went from bad to worse.
wp2shell now has two CVEs and a public working PoC.
One breaks REST batch routing. The other injects SQL. Chained together, they allow unauthenticated RCE on affected WordPress sites.
Update to 6.9.5 or 7.0.2 now.
Can’t update yet? Cloudflare WAF can mitigate the attack while you patch.
Check your site: wp2shell.com
Official release:
wordpress.org/news/2026/07/w…
SOC 2 gets you in the door. It doesn't get you through procurement’s security questionnaires.
Most enterprise buyers treat SOC 2 as table stakes now. Their security teams trust the evidence more than the badge, and their questionnaires dig into specifics a clean report often misses: key custody, retention, vendor risk, pen-test cadence.
We built a free check that reads your SOC 2 the way an enterprise security reviewer would, and shows where you'd fall short before the buyer does.
Upload your report, name who you're selling into, get a gap report in about 90 seconds.
fencer.dev/blog/introducing-…
Most security stacks at startups aren't designed. They accumulate. 👀
fencer.dev/lp/duct-tape
An honest list of where startup security hours actually go:
⌛️ Exporting CSVs from four different tools and cross-referencing them in a master spreadsheet.
- Tuning alert rules to filter out the same false positives you filtered out last month.
⌛️ Retroactively producing audit evidence for processes the team is already doing.
⌛️ Filling out 300-row security questionnaires from enterprise prospects.
⌛️ Babysitting tools.
Based on his experiences as a startup CTO, our co-founder Tim wrote a field guide on what to do about all of it.
fencer.dev/startup-security-…
There's a name for the stack most startups assemble to get to SOC 2.
The duct-tape stack.
A free vulnerability scanner. The GRC platform. GitHub built-ins. A CSPM tool you bought separately. Endpoint coverage from somewhere else. Alerts forwarding to Slack. The weekend audit-prep ritual.
It works. It got you here.
The trouble is what's underneath: every sprint, your team is making invisible trade-offs to keep it running.
Fencer is full-stack security for startups. One platform, built for the stage you're at, and the next.
fencer.dev/lp/duct-tape
"As CTO, you're the de facto CISO until you're big enough to hire one, whether you like it or not."
From the intro of Tim's new startup security field guide.
He's been in that seat: he was CTO of Zenput before he co-founded Fencer, and he built the security program, ran SOC 2, and figured out the operations himself.
His guide is for the CTO who's running security on top of everything else.
fencer.dev/startup-security-…
Free SAST tool.
Dependabot.
GitHub Advanced Security.
The GRC platform you bought for SOC 2.
A separate CSPM.
Endpoint coverage from a different vendor.
Alerts forwarding through Slack.
The weekend audit-prep ritual.
If this is your stack, you're not alone. And you've probably outgrown it.
fencer.dev/lp/duct-tape
When 90% of your security hours go into deciding what to fix rather than fixing it, your stack is generating work, not finishing it.
Here's four signs your startup's security stack has hit its limit.
fencer.dev/blog/how-to-tell-…
Engineering capacity at a startup is finite. Security is one of the things asking for a piece of it.
Here's Tim Olshansky on how to stop running security as a parallel program to product and start budgeting it as part of engineering capacity instead:
fencer.dev/blog/security-as-…
New: a field guide on running security at a startup, from someone who lived it.
Our co-founder @timolsh was a CTO at a startup before he built Fencer. He built and ran the security program himself. Led the company through SOC 2 with no security team to hand it to.
He wrote down what he wishes someone had handed him then.
Startup Security: A Field Guide for CTOs covers:
👉 When security stops being a "someday" problem
👉 Where your hours actually go when you're the one doing the work
👉 What to put in place first
👉 How to run security operations without burning out the team
👉 Considerations for startups in the AI era
Read it here: fencer.dev/startup-security-…
The best time to get security right at a startup is when you have 10 employees, one cloud account, and nothing complicated yet. Most teams wait until they have 50 and a mess to untangle.
Here's what to do when you have 10 employees: fencer.dev/blog/startup-secu…
88% of attacks against web applications start with stolen credentials. Not a zero-day. Not a sophisticated exploit. A login.
The five biggest security risks for B2B SaaS companies are all this preventable.
We broke down all five with the stats and what to do about each: fencer.dev/blog/top-5-securi…
Fencer retweeted
Trivy, LiteLLM, now Axios. Damn malware is hitting hard and fast now. A few small shifts that close most of the security gap:
* Add a 3–7 day delay on new package versions with package cooldowns (minimumReleaseAge)
* Disable install scripts (--ignore-scripts)
* Only install from lockfiles (--frozen-lockfile)
* Upgrade on a schedule, not on deploy
Attackers rely on speed. You don’t have to.