GrottoPress

| Launch WordPress in seconds | Billed per hour

[GrottoPress @GrottoPress]

*GrottoPress* empowers web designers and content creators with tools to launch a website without the hustle of running and managing your own servers.

Our self-service platform allows you to launch a new WordPress instance at the click of a button.

[Matthew Prince 🌥 @eastdakota]

Two classes extremely bad cyber vulnerabilities disclosed in the last 24 hours. The first potentially impacts everyone online. The second impacts nearly everyone running a server.

tl;dr: Everyone should upgrade their OS and Browser as soon as possible. If you run a server you should upgrade PHP (or ensure it’s removed if you’re not using it) as soon as possible.

The first class of vulnerabilities is a set of root TLS certificates that were discovered to have a trivial private key. Literally the number 4. These roots were controlled by #eMudhra. The problem is that with that an attacker could create a certificate and, if they could get in the traffic flow, intercept traffic to any site or service. The solution is to stop trusting certificates issued by these vulnerable roots. Upgrading your browser and OS is the fastest way for most Internet users to do this.

The second class of vulnerabilities doesn’t apply to most consumers directly, but does apply to most anyone running a server. These vulnerabilities have been dubbed #php2shell. PHP is one of the most widely used web programming languages. It’s estimated 70% of websites run on PHP. These vulnerabilities allow an attacker to send a crafted set of queries to a server running PHP and potentially take over the server. From there they could potentially read, modify, delete, or repurpose anything on the server. The solution is to upgrade PHP to the latest version ASAP. Even if you’re not using PHP for your web development, it’s often included by default. So make sure it is either upgraded or fully removed.

@Cloudflare received advanced warning of both of these classes of vulnerabilities. We’ve ensured that where we act as a proxy we are no longer trusting the vulnerable roots. We are also reviewing certificate transparency (CT) logs for any sign the vulnerability was exploited before its disclosure. We have not found any evidence but CT logs are not perfect and a sophisticated attacker who knew about the weakness could have exploited it without a new certificate being logged.

For the PHP vulnerabilities, we have deployed mitigations available for all customers for free. Because of the complexity of the vulnerabilities and number of ways it can be exploited, we also released new WAF capabilities that are unique in the industry to catch the exploit based on the response. These too are available for every Cloudflare customer for free.

Even if you are taking advantage of Cloudflare’s protection, it is important to upgrade your OS, browsers, and PHP installations as soon as possible. We can provide a strong bandaid, but the best protection is to fix the underlying problem.

If you’re interested in learning more, you can read our blogs:

Vulnerable roots: https://t.co/TR77Zd01A0
PHP vulnerabilities: https://t.co/qTUK8i3Oww

[Ministry of Health, Ghana @mohgovgh]

PRESS RELEASE ‼️
Ebola Update

[Juraj Bednar🏴💛🌘 @jurbed]

I highly recommend cloudflare's security audit skill: https://t.co/Mu6Dm0fzk8

Run it on all your software. Run it with the free models. Use it even if you used a model to audit something - it will find much more things. Works in all agent harnesses and is model independent.

[Tony Ma @t1o6n3y]

🚨 Security vulnerabilities reported in a SINGLE day:

PHP — 2 CVEs
Node.js — 10 CVEs
NGINX — 5 CVEs
Go — 1 CVE
GitLab — 12 CVEs
eMudhra — CA certificate compromise

[sagitz @sagitz_]

Today we disclose PHP2Shell - remotely exploitable memory corruptions in PHP

WordPress pre-auth RCE: ✅
Drupal pre-auth RCE: ✅
Joomla pre-auth RCE: ✅
Remote memory disclosure of any PHP application: ✅

Read more ⬇️🧵

[The Hacker News @TheHackersNews]

🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.

CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.

Read - https://t.co/frrfCwYlgp

[Alexis Ohanian 🗽 @alexisohanian]

21 years ago I named "Reddit" and everyone said it was a horrible name, but I insisted one day people would say "I read it on reddit" and used my CEO-privilege to overrule everyone + kept the name. Now the company twitter account (unbeknownst to them) is making the joke. Heh.

[Bernard Sarfo Twumasi @devsarfo]

I hope our Ghanaian government websites running on PHP are aware of the major news.

[WordPress @WordPress]

The PHP project has released fixes for 2 critical vulnerabilities affecting servers that host PHP applications. Site owners and technical teams should confirm their hosting provider’s update plan and update PHP immediately. Versions before PHP 8.2 no longer receive security updates. These issues are not specific to WordPress, and no WordPress update is required. https://t.co/2Bgok9Vdcq

[The Hacker News @TheHackersNews]

‼️ BREAKING: Go has issued an URGENT security update blocking 8 certificate authority keys over undisclosed security concerns.

It will reject certificate chains using these keys, potentially breaking connections for rebuilt applications.

The filter cannot be disabled.

Here's what we know: https://t.co/X0uIVXrlp1

[VoidZero @voidzerodev]

Introducing tsrs: a Rust port of the TypeScript compiler 🦀

We are not forking TypeScript!

◆ In close collaborating with the TypeScript team
◆ Up to 8x faster than TS 7.0 & ~70% less memory
◆ Runs in WASM, so it works in your browser & on Workers
◆ Soon part of the Oxc toolchain

npx tsrs

https://t.co/qmmxF3YnQy

[Kobina Koomson 🏵️ @georgeranch]

I've been working on Clay, a game engine for the web.
Rust compiled to wasm and threejs for core rendering and game logic, React for UI shell. #threejs

Here's the entire Accra built in 3D for a game in Flight. You may see some places you know.
More work on going. Deploying soon!

[Matteo Collina @matteocollina]

RAM is the new bottleneck. Every Node.js process is fighting for memory: containers, serverless, cloud bills, k8s limits. And here's the maddening part: V8 can use half the memory with one flag, and almost nobody turns it on.

[ICANN @ICANN]

🌐 Just like the air we breathe, we rarely think about the Internet we rely on every day.

It helps us navigate, bank, learn, access healthcare, and connect.

ICANN helps coordinate the unique names and numbers that make it possible.

[EmDash CMS @EmDashCMS]

Nine days after 1.2, EmDash 1.3 is out!

Every saved version now shows exactly what changed, and your live site gets the admin's editing tools.

One switch also asks AI crawlers not to train on your content.

Here's what's new.

[Jarrod Watts @jarrodwatts]

HOLY SHIT.

For crypto, this is one of the most insane posts of the year, but I'm guessing most people don't understand it.

Let me explain...

Bitcoin's accounts, and subsequently Ethereum's (and therefore every other EVM chain's), are built on a specific elliptic curve called secp256k1.

secp256k1 is a different elliptic curve from the one used across nearly every modern hardware device, including iPhones.

Modern devices mostly use a different curve called secp256r1, which is usually referred to as P-256 - one of the curves investigated in the article.

This mismatch has made it sooo difficult in the past to integrate crypto accounts natively into the security systems of modern hardware.

For example, Apple's Secure Enclave natively supports P-256, not secp256k1.

This has prevented crypto accounts from being able to use the same hardware protection as things like Apple Pay.

Same goes for the web with passkeys - WebAuthn uses P-256 signatures, which means Ethereum accounts using secp256k1 can't use them natively either.

But why did Satoshi do this?

The main theory for choosing secp256k1 was distrust of the P-256 curve - i.e. he thought there was an NSA backdoor.

A "backdoor" here basically means a secret, intentional weakness in the curve that would allow the NSA to exploit it and access private keys.

This was because P-256 was created with involvement from the NSA...

And the NSA provided a mysterious "seed" used to generate one of the curve's parameters without explaining where that seed came from.

This eventually transformed into a ~25-year-old mystery with a 5-figure reward for finding where this seed came from.

Claude figured it out in less than 30 mins.

And the best part is its internal thinking was: "Hmm wait... is it suspicious that such an obvious thing wasn’t discovered in 25 years?"

The solution was stupidly simple - just the time the curve was created, put into a specific random number generator function.

This doesn't 100% prove there's no backdoor yet, but it provides strong evidence that this seed wasn't secretly engineered by the NSA.

And Claude did this with "just a simple prompt" in under 30 minutes.

[Chris Tate @ctatedev]

New from Vercel Labs: tsc-ts

TypeScript was written in TypeScript
Then rewritten in Go

We ported it back to TypeScript
Compiled it with scriptc

And it's 2-4x faster than tsgo

[OpenCode @opencode]

We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users

We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked

The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate

[Steve Weis @sweis]

CLAUDE FOUND THE SEEDS
https://t.co/m8N6OPQoCQ

[GitHub @github]

https://t.co/otZg9dIh7u has fully moved off CSS-in-JS to CSS Modules, resulting in 55% less server-side render time and 25% faster component init. https://t.co/0AV4Fr3RSo