Pixel 🇨🇦

Solving problems you didn't know you had.
⬢ @InfinityBotList · @TryByteSend · @TryEmberly
⬢ Married to @CallMeAByte & @code
⬢ CEO @NodeByteLTD 🇬🇧

[Pixel 🇨🇦 @CodeMeAPixel]

I may or may not have just applied to help with the GPM community 👀 let’s see how this goes

[Pixel 🇨🇦 @CodeMeAPixel]

@five_pd Joining now thanks

[Pixel 🇨🇦 @CodeMeAPixel]

@five_pd I’m in the official discord if that’s the one you’re referring to?

[Pixel 🇨🇦 @CodeMeAPixel]

@five_pd kinda wondering what the plans are here now that development has ceased in FivePD v2 🤔

[Pixel 🇨🇦 @CodeMeAPixel]

@five_pd Glad to hear it 👏 wishing for the best moving forward.

[Pixel 🇨🇦 @CodeMeAPixel]

@connor200024 Yeah, did you miss the memo?

[Felipe Daragon @FelipeDaragon]

I think we've discovered another critical vulnerability:

CVE-2026-BURNOUT: AppSec Professional Exhaustion

Severity: Critical (CVSS 10.0)

Description: A vulnerability affecting security professionals exposed to a continuous stream of critical RCEs, zero-days, emergency patches, and Friday afternoon disclosures.

Impact: Sleep deprivation, excessive caffeine consumption, and an inability to enjoy weekends.

Attack vector: Reading security advisories.

Affected versions: All AppSec professionals, regardless of experience.

Mitigation: No known patch. Air-gapping may delay the inevitable. Total system collapse remains a possibility. 🔥

[Pixel 🇨🇦 @CodeMeAPixel]

You can’t be serious, you’re the one that started this entire process and now you just sit back and act like staying in Canada was the plan all along…. Mad that you didn’t get what you wanted and the people told you to be a better government instead?

[Danielle Smith @ABDanielleSmith]

Thank you, Alberta!

I’m very pleased to see the initial results from Elections Alberta show widespread support for remaining in Canada. Albertans have voted for a stronger Alberta in a united Canada.

Thank you to all Albertans who took time to vote on these critically important referendum questions.

Tomorrow evening, October 20, I will address Albertans live at 6:45 p.m. to discuss the results of all referendum questions for which results are available, and where our province goes from here.

[Danielle Smith @ABDanielleSmith]

Thank you, Alberta!

I’m very pleased to see the initial results from Elections Alberta show widespread support for remaining in Canada. Albertans have voted for a stronger Alberta in a united Canada.

Thank you to all Albertans who took time to vote on these critically important referendum questions.

Tomorrow evening, October 20, I will address Albertans live at 6:45 p.m. to discuss the results of all referendum questions for which results are available, and where our province goes from here.

[Pixel 🇨🇦 @CodeMeAPixel]

@ImLunaHey Have you ever looked into infisical? They have a CLI that can encrypt and store secrets outside of your env and inject them back into memory when needed

They also have a extremely generous free tier (and are open source if you prefer self hosting)

👉 https://t.co/Yi74HkdhSx

[Pixel 🇨🇦 @CodeMeAPixel]

Make sure you update Node too folks, PHP isn’t the only one having a bad week 🫡

[Dark Web Informer @DarkWebInformer]

🚨 High-severity Node.js flaw could allow remote code execution; CVE-2026-111497

Node.js has patched an out-of-bounds write vulnerability in its bundled Brotli decoder.
⠀
An attacker able to supply malicious Brotli-compressed data to an application could potentially corrupt memory and execute code on the underlying server.
⠀
Affected:

• Node.js 22.x
• Node.js 24.x
• Node.js 26.x

Fixed:

• Node.js 22.23.4
• Node.js 24.22.1
• Node.js 26.12.1
⠀
End-of-life Node.js versions may also be vulnerable and will not receive upstream security updates.

Administrators should upgrade and restart affected services.

Source:
https://t.co/KZjGB05A1j

[Pixel 🇨🇦 @CodeMeAPixel]

Vercel putting in that work like always 💪

[Guillermo Rauch @rauchg]

Vercel has proactively rolled out Firewall-level mitigations for today's Node.js RCE vulnerability, in advance of the official patch release.

All traffic for all deployments is automatically protected. We're actively monitoring and rolling out managed runtime upgrades.

[Pixel 🇨🇦 @CodeMeAPixel]

Did this man, really just say the forbidden words….. @connor200024 when I’m up all night tonight patching vulns I’m blaming you.

[Connor200024 @connor200024]

What else could go wrong? ;)

[Pixel 🇨🇦 @CodeMeAPixel]

I have patched the NodeJS version for @TryByteSend following the latest vulnerabilities 🫡

[Pixel 🇨🇦 @CodeMeAPixel]

@rizonftw_ @connor200024 Lmfao, valid reasons 🫡

[Socket @SocketSecurity]

The PHP Foundation says Chainguard unilaterally broke the embargo and published built images containing the critical RCE fixes more than six hours early:

“This disregarded weeks of work by many parties toward a coordinated disclosure.”

https://t.co/30TTrAH6K7

[Cloudflare Developers @CloudflareDev]

⚠️ Vulnerability alert: php2shell

Unpatched sites running PHP 5.4 or later are at risk of remote code execution, data exposure, and crashes.

If your site’s web traffic is proxied through Cloudflare, we deployed protections before official public disclosure. Check the blog post to see which mitigations are enabled by default.

Even with these mitigations in place, update PHP as soon as possible to fix the underlying vulnerabilities.

https://t.co/3xLjlkUX8u

[Pixel 🇨🇦 @CodeMeAPixel]

Lmfao, and the findings continue. Now that the wave is started it probably ain’t gonna end anytime soon prepare to keep patching

[Nicolas Krassas @Dinosn]

Leaving this here, PHP 8.5.12 security patch is incomplete. ( needs further validation )

[Internet Archive @internetarchive]

https://t.co/DlpBfnRxqP is currently offline. We are working to restore service now.

[Derek Devicemanager @IT_unhinged]

Security called me at 6:12 AM today.

"Patch every PHP server immediately."

I asked what happened.

"Two critical vulnerabilities. Remote code execution. No authentication required."

Cool.

How many PHP servers do we have?

According to inventory: 12

According to reality:

Nobody knows.

We found one running WordPress.

Three running old internal tools.

One under someone's desk.

Two inside vendor appliances.

A forgotten employee directory from 2016.

And a server named:

PHP-OLD-DO-NOT-TOUCH

Naturally, that one runs payroll exports.

Then we found a PHP 5.6 box.

I asked who owned it.

The documentation said:

BRIAN.

Brian left in 2019.

We called Brian.

He said:

"Oh wow, that's still running?"

Excellent.

By 8 AM, leadership joined the incident call.

CEO:

"Can hackers actually get in?"

Security:

"Potentially yes."

CEO:

"Without a password?"

Security:

"Yes."

CEO:

"Then why do WE need passwords?"

Not the lesson.

Finance asked if we could wait until the weekend to patch because downtime affects revenue.

Security explained that the alternative was letting strangers execute code on our servers.

Finance asked for a cost comparison.

At 9:17, someone suggested temporarily taking the vulnerable websites offline.

Marketing refused.

"Our campaign is live."

So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.

We finally patched everything we could find.

Then our scanner discovered another PHP server.

Hostname:

TEMP-PHP-2014

Uptime:

4,512 days.

Nobody knows what it does.

Nobody owns it.

Nobody can shut it down.

But every time we block network access, the warehouse stops printing shipping labels.

Security has classified it as critical infrastructure.

It is running PHP 5.4.

The vulnerability has existed longer than half our employees.

The emergency patch took four hours.

Finding out what PHP actually runs took eleven.

The internet isn't held together with code.

It's held together with servers everyone is afraid to turn off.