Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
eMudhra to Exit global SSL/TLS Certificate Business
eMudhra's board has decided to voluntarily withdraw from the global SSL/TLS certificate business after a recent incident involving its CAs, which it says were revoked within 14 hours, and will focus on its core enterprise and other trust services.
2 min · 526 words
Turning IPv6 tunnels into programmable delay lines for pulsing DoS
An APNIC Blog guest post summarising the USENIX Security 2026 paper on TED, a pulsing denial-of-service technique that abuses permissive tunnel decapsulation and inconsistent IPv6 Extension Header handling to focus low-rate traffic into short high-rate bursts, with measurements and mitigations.
5 min · 1,259 words
Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot
Amazon Threat Intelligence reports a PHP2Shell (CVE-2026-109618/109619) exploitation attempt against its MadPot honeypots on Oct. 17, 2026, four days before public disclosure, plus a wave of proof-of-concept exploits around the embargo lift, with recommended actions and indicators of compromise.
3 min · 722 words
Security Disclosure: Wednesday October 21st
Railway discloses that an unauthorized third party may have accessed encrypted customer environment variables, and in some cases their decrypted contents, as part of a series of attacks on platform companies; it recommends rotating secrets and explains paused builds and next steps.
1 min · 252 words
Your AI agent fixed the bug, but what else did it change?
Trail of Bits releases patching-bugs and regression-hunt, two agent plugins built through its Patch the Planet work with OpenAI that reproduce bugs, develop and test fixes, and check patches for regressions within a project's own threat model and patching guidelines.
8 min · 1,778 words
Cloudflare deploys protections against php2shell vulnerability
Cloudflare describes the default WAF Managed Ruleset protections it deployed for the newly disclosed php2shell PHP vulnerabilities ahead of public disclosure, how the rules detect exploitation attempts, and why customers should still update PHP while keeping the protection enabled.
5 min · 1,162 words
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
Wiz Research details multiple critical vulnerabilities it found in the core PHP engine with AI assistance, enabling remote code execution and Heartbleed-style memory disclosure across PHP-powered sites like WordPress, Drupal and MediaWiki, plus the coordinated patch release and what defenders should do.
10 min · 2,373 words
Your MCU Likely Escaped the eMudhra Intermediate CA Compromise
Daniel Mangum explains why most microcontroller-based devices likely escaped the eMudhra intermediate CA compromise disclosed on October 20, 2026: embedded firmware usually ships only the specific root CA certificates it needs rather than a broad trust store.
7 min · 1,579 words
Cloudflare is rewriting everything in Rust
Sylvain Kerkour traces Cloudflare's shift from C and Lua NGINX modules to Rust after CloudBleed, covering Pingora, FL2 and the NGINX termination rewrite, a critique of its open-source posture, and how avoiding .unwrap() could have prevented the November 18, 2025 outage.
5 min · 1,102 words
Expose only share links of a private service with caddy
Solène shows how to use Caddy's forward_auth directive to publish only the share links of self-hosted services like Immich and Nextcloud that otherwise sit behind a VPN, shrinking their public attack surface.
11 min · 2,629 words
Patch the Planet: global response coordination as agents uncover critical vulnerabilities
OpenAI describes leading a coalition with PHP maintainers, Calif, Wiz, Cloudflare and others to fix critical PHP vulnerabilities found with AI, commits $1B in subsidized Daybreak access for frontline defenders, and proposes a five-stage framework for coordinating responses to critical bugs in widely used software.
8 min · 1,812 words
There isn't an easy exploit for this PHP vulnerability
Elias Taylor argues that the much-hyped PHP vulnerability behind this week's emergency security releases is a real bug but hard to exploit in practice, nowhere near Log4Shell or Heartbleed, and explains why the panic outruns the risk in the LLM era.
4 min · 808 words
Node.js — Wednesday, October 21, 2026 Security Releases
The Node.js project ships security releases for the 26.x, 24.x and 22.x lines, updating c-ares, OpenSSL and the CA certificate store (removing the compromised eMudhra intermediate CA), with details of fixed issues and download links.
3 min · 646 words
What the PHP2Shell rumors got wrong, from inside the PHP security team
Alexandre Daubois, writing from inside the PHP security team, explains how the PHP2Shell leak got the severity right but most details wrong: CVE-2026-109618 is an out-of-memory error turned into RCE, and the real stopgap went unmentioned.
6 min · 1,331 words
Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor
SafeDep analyzes the compromised LiteLLM 1.107.0 release on PyPI, whose wheels planted a .pth credential stealer and a sitecustomize.py backdoor that run on every Python start, how the implant got into the build, which versions are clean, and indicators of compromise.
7 min · 1,556 words
Today's PHP Security Release, and How We're Strengthening PHP Security
The PHP Foundation explains the two critical RCE vulnerabilities fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, how they were found with researchers and AI security tools and fixed, how PHP security handling has changed over two years, and what dependent organizations need to fund.
8 min · 1,860 words
Chinese AI Writes Weaker Code for Beijing’s Adversaries. We Fixed It. A Qwen3-Coder Case Study
Hirundo tests Alibaba's Qwen3-Coder and reports that naming a US or other Beijing-adversary customer in a prompt measurably lowers the security of generated code, traces the behavior to the model weights rather than the prompt, and shows that removing the model's CCP alignment closes the gap.
17 min · 4,012 words
Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds
Scott Helme explains how eight eMudhra intermediate CA private keys were recoverable from their public certificates in under a second because the keys were trivially small, how Chrome and Mozilla responded with CRLSet/OneCRL blocks and root removal, why the compromise cannot be contained, and what site operators should do now.
7 min · 1,642 words
Protecting Firefox users following the compromise of eMudhra intermediate certificates
Mozilla's Firefox Security Team reports that private keys for eight eMudhra intermediate certificates were compromised. Mozilla blocked them via OneCRL within three hours of the October 17 report, shipped Firefox 158.0.1 and ESR updates for users who miss OneCRL, and is removing the issuing root from NSS 3.131.1.
1 min · 272 words
Do minor curl vulnerabilities in the open
curl maintainer Daniel Stenberg announces that from October 26, 2026 the project will require LOW and MEDIUM severity vulnerability reports to be filed as public GitHub issues, keeping only HIGH and CRITICAL reports private on HackerOne. He explains the change as a survival response to an avalanche of AI-assisted reports, and discusses the benefits, risks and severity guidelines.
4 min · 961 words