creator of open source https://teapawt.org/t.co/6rFLiF04Vm 💀🔑📨🔥 send verifiably encrypted - destroy on receipt messages
Joined November 2012
- Tweets5.6K
- Following218
- Followers168
- Likes7.5K
TGRI 🏵️ retweeted
Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.
Here is the short version of what happened and who got hit.
1. eMudhra (Trusted CA compromise)
eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs.
One of the intermediate CA private keys was literally the number 4.
The other seven: 56, 66, 115, 155, 156, 230, 237.
Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket.
• Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs.
• Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10).
• 10-second check on any server:
curl dv-g3b-emudhra.we-have-a-pro…
(TLS error = safe. 200 OK = still vulnerable.)
2. PingCAP / TiDB Cloud (10.6 TB breach)
Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents.
Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets.
Who is affected in the leaked records:
• Live credentials exposed in support tickets:
- Pinterest: AWS keys for their pingcap-logs S3 bucket
- CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets
- DeBank: 38 presigned S3 URLs
- An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys)
• Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed:
- Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap
- E-comm & Travel: Booking.com, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook
- Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM
- Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life
- Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase
• Developer profiles leaked (from a purchased reo.dev table in PingCAP's BigQuery):
- 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash.
If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket.
3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619)
Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch.
Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c).
Because C-level multipart parsing runs before line 1 of index.php:
• App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it.
• Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1).
• Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.
TGRI 🏵️ retweeted
beautiful explanation. this is 100% happening. teapawt.org/sotak/status/211179423…
TGRI 🏵️ retweeted
BREAKING: Bell tower of Limoges' historic 143-year-old town hall collapses amid raging fires during riots in France.
TGRI 🏵️ retweeted
One of the funniest consequences of AI is exposing the fact that mathematicians consider math to be an aesthetic pursuit and a source of permanent unvetted sinecures rather than a set of problems to be solved
The scale of this is staggering.
But... Why?
Why is OpenAI trying to solve hundreds of math problems to be released all at once? I think we got the point when they found a counterexample to Navier-Stokes -- internal model = great.
I am not sure at this point what this (hostile?) takeover of the mathematical landscape is trying to achieve other than, again, a massive PR stunt.
TGRI 🏵️ retweeted
Multi billion opportunity in combining these dopamine sites with lottery - so you pay $50 and there’s a 1/1000 chance the Patek actually arrives.
TGRI 🏵️ retweeted
An anonymous user decided they had enough money and pledged 5,057 bitcoin to charity.
The Reddit user “PineappleFund” remembered watching bitcoin reach $15, $20 and $30. By December 2017, they posted:
“I have far more money than I can ever spend.”
Five months later, their farewell post reported that 5,104 bitcoin had become $55,000,000 for charities.
The final donation went to the Internet Archive.
One recipient, OpenStreetMap, independently documented receiving 18 bitcoin.
Today, if the charities had kept the donations in bitcoin, it would be worth $426,394,540.
The user has not been heard from since.
TGRI 🏵️ retweeted
‼️ BREAKING: Hackers tore down a Flock license plate camera, copied its storage and found an encryption key on the device that unlocked footage of thousands of passing vehicles.
The recovered data covered about 21 days of activity. In that time, the camera photographed roughly 50,000 vehicles and took about 1.6 million images.
Flock had previously told a security researcher that even someone who got into one of its cameras couldn't reach footage, because images stayed on the device only briefly.
Flock calls the removal illegal and said it didn't have enough detail to assess the claims.
Its software also detects people. When researchers ran the camera's own models over 27,321 clips stored on it, they flagged people in 11.
TGRI 🏵️ retweeted
Perfect European founder career:
35 - Finish master's degree in Innovation Management
36 - Join a startup accelerator funded by the EU
39 - Win €3,500 at a pitch competition, become "the German Elon Musk"
40 - Spend 14 months registering the GmbH
42 - Apply for the €40,000 EU innovation grant
43 - Spend €35,000 on the mandatory post-grant audit
45 - Close the company, spend €10,000 on a notary
48 - Get a lifetime job at Siemens (€2,100/month)
67 - Retire with €900/month pension
Life in Europe is simply paradise
TGRI 🏵️ retweeted
People killed by AI: zero
People killed by governments: millions
Let's give control of AI to the governments and call it safety
TGRI 🏵️ retweeted
holy shit kimi was faking it’s performance by serving you claude
you have been using claude all along
We're publishing our most detailed threat intelligence report to date.
It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them.
We disrupted every operation in the report, and used the lessons from them to strengthen our safeguards. Where appropriate, we also shared what we found with authorities and other AI companies.
These cases are not typical: we’re highlighting some of the most sophisticated misuse we’ve seen. But they’re especially important to discuss, because they show us where AI misuse is headed, where our safeguards work, and where they need to improve.
We’re publishing this report so others can spot the same activity on their own platforms, and so we can give the public a clearer view of how emerging threats develop.
Read the report: anthropic.com/threat-intelli…
