Catholic father of 8 | CEO @PandaRoseInc | Faith-driven innovation & digital strategy | #Family #Faith #Tech | Building the future, one business at a time.
Edmonton, Alberta, Canada
Joined June 2008
- Tweets2.2K
- Following2.5K
- Followers3.3K
- Likes932
IBM's fall TRs add CVE_CURRENCY, an SQL service that tells you which security PTFs you're missing. Lovely on 7.5 or 7.6. Those of us still babysitting 7.3 get PSP lists and a cup of coffee. Mid-CUME on a client box right now, reading every cover letter twice.
I just realized in a stunner Kirk @WilliamShatner outlived Picard @SirPatStew ...
I am shocked. And I believe Shatner might be immortal.
Eight kids, one Halloween. On an acreage, trick-or-treating means loading everyone into the van, driving to town and hitting a friend's neighbourhood. Then tomorrow it's the All Saints party at Holy Trinity. Turns out the saints have a sweet tooth too.
Watched an attacker walk in through an SSL VPN once and have free run of the flat network behind it. Patching the box is step one. Who's actually checking what that VPN account can reach once it's in?
🚨 CISA ADDS 2 MORE IVANTI CONNECT SECURE FLAWS TO KEV, EXPLOITED IN CHAIN (CVE-2026-111357, CVE-2026-118527)
CISA added two more Ivanti Connect Secure (ICS) VPN bugs to its Known Exploited Vulnerabilities catalog today, based on evidence of active exploitation. Both chain with CVE-2026-104935, the ICS zero-day added to KEV on Oct 13.
• CVE-2026-111357: missing authentication for a critical function, lets a local authenticated attacker escalate privileges
• CVE-2026-118527: predictable identifiers, lets an authenticated attacker upload attacker-controlled files to a known location on disk
• Federal (BOD 26-04) due dates: Nov 2 for CVE-2026-111357, Nov 13 for CVE-2026-118527
⚠️ Analyst Note:
Patching CVE-2026-104935 alone may not be the end of it. If your ICS appliance was exposed before patching, run Ivanti's Integrity Checker and hunt for unexpected files and privilege changes.
Source:
cisa.gov/news-events/alerts/…
#DDW #Ivanti #CISA #KEV #ActivelyExploited #PatchNow
Jeff Cubinski just wrote up running an MCP server directly on IBM i. It runs in PASE, every tool is a Db2 stored procedure, and the business rules live as Markdown files on the IFS.
The rules part is what gets me. In most AS400 shops, the return and credit logic lives in the head of whoever's retiring next. Writing it down for an AI means it finally gets written down.
My question is whether each tool runs under the user's own profile or a shared service account, because that's the first thing an auditor will ask.
community.ibm.com/community/…
The odds of a bug being found used to depend on who was looking. AI just changed that number for every line of code ever shipped, and nobody touched the code.
Some of it gets patched. A lot of it lives in routers and cameras whose vendors are gone.
I'm writing an essay on what that does to trust. The math isn't kind.
Tonight's tally: a laptop at Binance, a monitoring script at Polymarket, a cloned CEO voice at an Italian bank. Every one was a thing everyone trusted and nobody rechecked.
I've been writing about where this goes. My bet is the handshake comes back. More soon.
Shocked how often we find a .env committed to git and "fixed" by deleting it in the next commit. Congrats, it's still in the history, every clone and every fork. Rotate the keys first, scrub with git filter-repo second, then add a pre-commit secret scanner so it doesn't happen again. When did you last check your history?
Small biz owners asking "am I affected by PHP2Shell?": check your PHP version and the last digits, then make your host confirm the patch AND that PHP-FPM got restarted.
We wrote the email to send your host so you don't have to.
Checklist + the copy-paste email for your host: pandarose.com/php2shell-busi…
I remember the PHP 5 to 7 migrations. Changing the code was usually the easy part.
The nightmare was discovering that some bizarre workaround from 2010 was holding an entire business process together, and nobody remembered why.
AI can rewrite code. It can't restore lost institutional memory. Anyone else hit this?
At Mass today our priest told of a student who said she didn't need confession because "Pope Francis said so." Her source was a fake document online. Decades in IT and the best exploit going is still "I saw it on the internet." Anyone else had a fake Pope quoted at them?
I've been pretty blunt that the SSPX consecrations were wrong. Still, a prefecture banning a procession over "terror risk" makes me uneasy. Disagree with the Society all you want. Religious liberty shouldn't depend on liking them.
SCANDAL: Ex-Macron deputy chief of staff banned the SSPX procession in Lourdes — citing a “terrorist threat.”
This is the second block imposed on the SSPX's planned pilgrimage to Lourdes this year.
lifesitenews.com/news/local-…
WordPress folks: Rank Math PRO reportedly got backdoored through its own update channel 🙃 File-integrity monitoring and offline backups are deeply unsexy, and they're exactly what you want running on a week like this.
Oh bless your soul...
Sure, it can all be patched. Right after someone finds the admin password for the router that's been blinking behind the filing cabinet since 2013.
This is what will prevent total chaos.
Most people have been saying that we must slow down.
I think it is the exact opposite. Pedal to metal.
If the bad guys have abliterated models, the good guys must have them too.
Akin to the 2nd amendment.
It will be expensive but it can all be patched.
Thank you @OrcaRouter for making this available!
BioWare proved world-class software gets built in Edmonton. EA closing the studio doesn't move the talent. Those programmers and artists are still here, and Alberta should be fighting hard to keep them.
BioWare has showcased Edmonton’s creativity and talent on the world stage since 1995.
While games like Mass Effect or Dragon Age were meant more for my kids, I can appreciate the incredible talent and the heart that artists, programmers, and developers poured into their work.
The closing of Alberta’s most prominent video game developer is disappointing, and our government will be there to work with partners to support home grown talent here in Edmonton and to ensure Canada has a strong digital sector.
We've taken over more stock-Ubuntu-on-AWS mod_php boxes than I can count, all handed over as "safe." The cloud doesn't secure your architecture. Per-site PHP-FPM users is boring and unglamorous, and this week it's the difference between one cleanup and forty.
This is by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far. Deep technical breakdown of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26.
github.com/0x4D31/honeypot-d…
From:
teapawt.org/0x4D31/status/21140524…
Both true. Also watch for the vendors using "exploited for weeks!" to convince owners their IT shop is behind. If your provider patched this week on a normal schedule, they did the job right. Panic is a sales tactic, not a threat model.
I'm glad to hear from threat intelligence that php2shell is not getting mass exploited. But you definitely should not believe you are safe. I have never said "panic turn it off". I am very much trying to help provide accurate (technical) information about the nature of the vulnerability. Which I hope threat intelligence takes into account.
But I have a problem with the communication, when some people claim the complexity makes it not realistic to exploit. That is just false. It must be clearly communicated, that vulnerable systems can be pwned (with a known vulnerability, not some theoretical 0day).
So as long as threat intelligence says this:
- we see no mass exploitation, you can relax a bit
- this is exploitable on real systems, you must patch when you can
we have common ground.
It's encouraging to see some of those proactive security decisions paying off. At PANDAROSE, we've long used PHP-FPM with per-site user isolation, least-privilege permissions and layered security controls. It's nice when the boring architectural decisions made years ago reduce exposure to today's vulnerabilities. Still patching, of course!
A brief update on the critical vulnerabilities in PHP:
We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.
Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious. Defenders should:
1) Patch & Restart by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restarting web services
2) Layer Temporary Safeguards at the network edge (WAF/proxy rules) and server configuration level if immediate patching requires a maintenance window
3) Protect Credentials by monitoring for abnormal session traffic and rotating keys and passwords on compromised internet-facing PHP systems exposed prior to patching
🔗 We are continually updating our Cloud Security blog post on this topic with real-world guidance and actionable defense strategies as we learn more. Please keep monitoring these posts for updates as you prioritize your patching efforts: cloud.google.com/blog/produc…
🔗 Technical details from Wiz: wiz.io/blog/php2shell-php-rc…
🔗 Details of the exposure from VirusTotal: blog.virustotal.com/2026/10/…
