@lopp
Account based inUnited States!
About this account
- Account based in
- United States
- Connected via
- Web
X says this location may be affected by a proxy or VPN.
Account-level information from X, not a live location or the device used for a specific post.
Just a few of the biggest security incidents in the past week... we're still accelerating:
* PHP2Shell: Two critical RCE bugs in PHP core
* eMudhra: Eight intermediate certificates had extremely weak private keys due to a key-generation script error that created keys with tiny values.
* GitLab: integer overflow RCE
* Plex Media Server: flaws compromised internet-facing servers used for cryptominers and proxy tools.
* Arista VeloCloud Orchestrator zero-day: Actively exploited authenticated SQL injection enabling privilege escalation.
* Node.js Brotli decoder RCE
* NGINX critical heap/use-after-free issues
* Railway breach: Attacker accessed systems storing customer environment variables and, for some, obtained decrypted contents (API keys, database credentials, private registry logins, etc.)
* Zeabur breach: ~321,810 accounts and over 3.2 million environment-variable records exposed. Company announced it is shutting down.
* LiteLLM supply-chain compromise: Malicious version 1.107.0 pushed to PyPI and Docker Hub containing a credential stealer and remote-access/backdoor capability.
* California public school data theft: 5.7M+ student records leaked, including names, dates of birth, addresses, demographics, and disability status.
* Capcom breach: Unauthorized access to ~11.77 million CAPCOM ID records
* Quest Diagnostics: Unauthorized access to Quanum Lab Services Manager system used by some clients; potential access to certain patient records.
* State Bank of India breach: customer records appearing on dark web
Vibe coding software wasn't dangerous enough, so @DEFCAD trained a model called GatGPT 😎
gatgpt.defcad.com/
Seeing reports of another round of snail mail social engineering letters from "Ledger" that try to trick you into scanning a QR code that takes you to software that steals your seed phrase.
Anyone who has been maintaining internet-facing infrastructure for the past 3 months:
xitter.cf/ThePHPF/status/2112828…
If you rely on the volunteer maintained rpms.remirepo.net we urge you to move to distro packages or building from source now, so you can immediately apply updates. The repo will not have updates today.
🚨DEFCON 1🚨
In a few hours, a critical vulnerability that affects ~70% of web sites will be disclosed. It allows an attacker to upload and execute arbitrary code.
It's probably best if you stop browsing the internet for the rest of the week.
xitter.cf/ThePHPF/status/2112633…
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
Readers added context they thought people might want to know
These are server-side PHP RCE vulnerabilities for which web hosts/admins should prepare to patch per official notice; general users face no direct need to stop browsing. PHP detected on ~69% of sites with known server-side language.
php.net/archive/2026.p…
w3techs.com/technologies/d…
cert.europa.eu/publications/s…
sansec.io/research/php2s…
arstechnica.com/security/2026/…
October is Cybersecurity Awareness Month.
Remember: the less data you share with online services, the smaller your attack surface and safer you are!
Pretty amazing how it's possible to cram more courage than the entire Uvalde police department into a single man.
xitter.cf/CollinRugg/status/2111…
JUST IN: The man who stopped the school shooting in Bend, Oregon, has been identified as 36-year-old Kalub Giamanco.
Giamanco, a carpenter, was reportedly driving home for lunch when he heard gunshots.
After hearing the gunshots, Giamanco, who has a concealed carry permit, followed the suspect into the school.
He then shot and killed 16-year-old John J Griffin moments after the teen opened fire into a special education classroom.
Giamanco, who has two children of his own who attend the school, is family friends with one of the victims, a 7-year-old who uses a wheelchair and was shot in the face.
The 7-year-old survived and is in the hospital.
Three children at Silver Rail Elementary School were killed. Their ages are 5, 8, and 11.
According to Giamanco's brother, Giamanco doesn't feel like a hero because he feels guilty for not being able to save more children.
You are a hero, Kalub.
Good news: the Bitcoin Wrench Attack archive just got a lot more accurate.
Bad news: we just doubled the total number of known attacks to over 700.
Kudos to @pizza_bitcoiner for finding hundreds of new attack reports via agentic searches.
jlopp.github.io/physical-bit…
More evidence you can't trust anyone with your personal data. 9 million people had their records leaked because some fool set an admin password to "123456"
en.cryptonomist.ch/2026/10/1…
A cryptocurrency owner was kidnapped in Toronto in July by a gang of 7 men that included 3 members of the Canadian military.
winnipeg.citynews.ca/2026/10…
Turkish media is reporting that notorious scammer James Schueler, AKA @RichardHeartWin, has been arrested. 🥳
en.haberler.com/mit-caught-w…
Let's see how @RichardHeartWin's various crypto scams are reacting to the news of his arrest... 😅
No, I'm not worried that the future of self custody is in peril simply because a bunch of edge case attacks and vulnerabilities I've been warning people about finally started happening in a short time span.
This is vindication for a decade of grinding @CasaHODL