Build security @Fencer_Security
San Francisco, CA
Joined September 2009
- Tweets331
- Following182
- Followers169
- Likes114
Patch patch patch patch patch patch
If you run PHP anywhere, patch it today.
Two RCE bugs in PHP core, CVE-2026-109618 and CVE-2026-109619, both 9.2. Reportedly, every release from 5.4 up is affected. Fixes shipped this afternoon (UTC):
8.5 → 8.5.12
8.4 → 8.4.27
8.3 → 8.3.36
8.2 → 8.2.35
8.1 and older get no official release. Check your distro or LTS vendor for backports, or upgrade.
Two things people are getting wrong 👇
1/ Plenty of companies run PHP without thinking of themselves as a PHP shop. WordPress is PHP, and so is that admin panel, that status page, and the staging box nobody decommissioned. Check every host you own that answers to the internet, including the ones nobody has logged into in a year.
2/ The risk went up sharply when the patch landed (30 mins ago!). Details leaked yesterday, and a few attackers already had them. Cloudflare saw attack traffic at 07:43 UTC, hours before any fix was made public. Now the patch points everyone at the exact bug, and writing an exploit from a diff is a short job.
If you can’t patch in the next few hours, Cloudflare’s WAF rules block the known attack patterns, including on the free plan. They only help if traffic actually goes through Cloudflare, and attackers are already tweaking payloads to get past them. That buys you hours, so spend them patching.
Tim Olshansky retweeted
🚨Python friends, upgrade (or have your agent upgrade) every certifi package across all your projects and machines!
uv self update
uv lock --upgrade-package certifi
Private keys from 8 intermediate CA certs have been compromised!
teapawt.org/astuyve/status/2112559…
Some other things to upgrade:
* Go: 1.27.3 or 1.26.10, then rebuild your Go programs
* rustls-webpki: 0.103.16
* webpki-roots / webpki-root-certs: 1.0.10
* Electron: 44.9.1, 43.8.1 or 42.11.16
* NSS: 3.131.1
* Firefox: 158.0.1 (ESR: 153.5.1 or 115.43.1)
* Ubuntu ca-certificates: 20260816ubuntu0.<release>.1 (for 22.04, 24.04, 26.04 and 26.10)
* Homebrew ca-certificates: 2026-09-25_1
* Chrome, Apple, Windows: nothing to do, they’re blocked automatically
Still waiting for a fix:
* Debian ca-certificates: disable the two roots by hand
Node.js
* Composer ca-bundle
* macOS /usr/bin/curl: remove the two roots from /etc/ssl/cert.pem by hand
private keys from 8 intermediate CA certs have been compromised (eMudhra)
Happy "Update everything" day to all my pager-carrying friends
emudhra.we-have-a-problem.co…
Tim Olshansky retweeted
"Will my auditor accept an AI pen test?"
SOC 2 doesn't prescribe methodology. Auditors judge the report: scope, recognized methodology, severity-rated findings, and proof each one is exploitable.
Fencer's AI pen testing reports document the full attack path, the fix, and the retest that confirmed closure.
Learn more here: fencer.dev/blog/introducing-…
Lets go! We built this to help defenders defend
The slowest part of your SOC 2 just got a lot faster. Now you can run a full pen test on demand, and get results in hours.
We just launched Fencer AI pen testing. Scope a pen test in the morning, read the audit-ready report the same day. Network and domain scanning run continuously alongside it. $3,000 a year.
fencer.dev/blog/introducing-…
This is what we do at @fencer_security - we know finding issues isn't the problem (and hasn't been the problem for years). Fixing them always has been. We find. We fix.
AI for cyber is about to go vertical. The models increasingly becoming insanely good at finding and exploiting vulnerabilities. Frontier models are ahead, but we’re already seeing that open weights is not far behind.
Most enterprises are already inundated with cyber discoveries, so now that’s only going to multiply. Triaging and automating the fixes with more AI -along with human oversight- is essentially the only way forward.
In case you were wondering what jobs AI was going to create, it’s definitely going to great time to be in security.
We're making @fencer_security available for free to help secure open source! @AnthropicAI @OpenAI and a bunch of other companies signed a letter asking everyone to fix their security issues, and we're giving back by ensuring Open Source contributors have good tools too!
Tim Olshansky retweeted
@dok2001 I've noticed that SNI and host overrides are still in enterprise plan (developers.cloudflare.com/ru…) - any chance we can get that in other plans too given your very generous policy of everything in every plan (blog.cloudflare.com/enterpri…)? 🙏🙇☺️
Tim Olshansky retweeted
Make sure to always reuse your botoclients. Initializing a fresh one on each task has A LOT of overhead!
Tim Olshansky retweeted
Engineering capacity at a startup is finite. Security is one of the things asking for a piece of it.
Here's Tim Olshansky on how to stop running security as a parallel program to product and start budgeting it as part of engineering capacity instead:
fencer.dev/blog/security-as-…
Friends! I've built a cool little tool for reviewing security reports, starting with SOC 2 that I'm looking to recruit testers for. Comment in thread or DM and I'll share it with you - would love any/all feedback 🙏
Tim Olshansky retweeted
New: a field guide on running security at a startup, from someone who lived it.
Our co-founder @timolsh was a CTO at a startup before he built Fencer. He built and ran the security program himself. Led the company through SOC 2 with no security team to hand it to.
He wrote down what he wishes someone had handed him then.
Startup Security: A Field Guide for CTOs covers:
👉 When security stops being a "someday" problem
👉 Where your hours actually go when you're the one doing the work
👉 What to put in place first
👉 How to run security operations without burning out the team
👉 Considerations for startups in the AI era
Read it here: fencer.dev/startup-security-…
Tim Olshansky retweeted
Trust me chat. Forget about Glasswing spamming 0days in your software, you're already cooked with current models.
I've hacked hundreds of global orgs, including governments (legally) over the last 10 years, and the amount of times I required a 0day to do so was exactly 0 times.
Being worried about Glasswing is like living in Europe and being worried about Northrup Grumman having lethal space lasers while you're more likely to get stabbed by a crazy person walking through the streets.
Introducing Project Glasswing: an urgent initiative to help secure the world’s most critical software.
It’s powered by our newest frontier model, Claude Mythos Preview, which can find software vulnerabilities better than all but the most skilled humans.
anthropic.com/glasswing
Trivy, LiteLLM, now Axios. Damn malware is hitting hard and fast now. A few small shifts that close most of the security gap:
* Add a 3–7 day delay on new package versions with package cooldowns (minimumReleaseAge)
* Disable install scripts (--ignore-scripts)
* Only install from lockfiles (--frozen-lockfile)
* Upgrade on a schedule, not on deploy
Attackers rely on speed. You don’t have to.
Tim Olshansky retweeted
With recent Python supply chain attacks (Trivy/LiteLLM), it’s worth mentioning uv’s `exclude-newer = "x days"` config.
It forces uv to only installs packages published more than x days ago, reducing risks since problematic packages should be yanked by then.
Tim Olshansky retweeted
If you were impacted by the recent Delve issues and want to harden your security posture, we (@fencer_security ) will be happy to help you out.
For anyone that signs up in the next two weeks, we will give you 15% off an annual subscription and provide white glove onboarding ourselves. This will include our full platform of code, infrastructure, runtime protection, static code analysis (SAST), dynamic application security testing (DAST), identity management and SIEM.
We typically work with software companies between 20 and 500 employees.
While we don’t ourselves do the compliance part, we integrate with many of the large vendors in the industry (Vanta, Drata, etc.)
Feel free to DM me or comment below.
Curious what the wider dev world is doing with policy + agentic software development in teams? teapawt.org/timolsh/status/2033581…
