Mathieu Flaig

Nostalgique du Futur. Je parle d’Humain et de Technologie.

[Mathieu Flaig @MathieuFlex]

Un poème sur une grande disparue : la nuance

[Mathieu Flaig @MathieuFlex]

IT people be like 😴

[Traceix @usetraceix]

We’re shutting down too.

We don’t use php I just don’t wanna work tomorrow.

[Mathieu Flaig @MathieuFlex]

@albn https://t.co/lUwsD8zR51

[FUITES INFOS @fuitesinfos]

🚨 FUITES INFOS | Mistral AI - Piratage

🇫🇷 Revendication de piratage visant @MistralAI, le géant français de l'intelligence artificielle.

Ce 22 octobre, un individu affirme avoir compromis les ordinateurs de plusieurs employés ainsi qu'une grande partie des infrastructures de calcul de Mistral AI.

Le cybercriminel propose de vendre, au plus offrant, des ressources internes de l'entreprise pour un prix de départ d'un million de dollars.

📂 Éléments revendiqués :

· L'intégralité du code source de Mistral
· Plus de 10 000 environnements d'entraînement par renforcement (RL)
· Les méthodes et configurations d'entraînement de Mistral Large 4
· Des accès potentiellement toujours actifs aux clusters de calcul

Pour étayer ses affirmations, l'auteur publie des extraits de code Git et des listings de serveurs liés à l'infrastructure CoreWeave, partenaire de Mistral AI.

⚠️ Revendication non confirmée.

[Mathieu Flaig @MathieuFlex]

@lukOlejnik @olesovhcom ?

[Mathieu Flaig @MathieuFlex]

@Alex_Car12 Cette erreur a été patchée hier, c’était un reliquat malheureux, tout est sur Authenticator maintenant ;)

[Mathieu Flaig @MathieuFlex]

Vouloir Maj le PHP de son site -> l’hébergeur t’envoie un SMS de 2FA -> Orange est down et donc pas de SMS

[The Hacker News @TheHackersNews]

‼️ ALERT - Someone tried to exploit #PHP2Shell 4 days before the vulnerabilities were publicly disclosed.

Amazon caught the October 17 attempt. More exploit attempts followed the patch release.

Who had the exploit details early, and how?

Full story ↓ https://t.co/1C4q1ObBnr

[Mathieu Flaig @MathieuFlex]

@0xMaxTx @o2switch Alors c’est un autre sujet 😬 - bon courage

[Mathieu Flaig @MathieuFlex]

@Boutaynab22 Internet est un membre de la famille, protect him at all costs!

[Mathieu Flaig @MathieuFlex]

Courage à tous les IT et les personnes en charge de la cybersécurité, les nuits vont être courtes 🫂 #Hacktober

[Derek Devicemanager @IT_unhinged]

Security called me at 6:12 AM today.

"Patch every PHP server immediately."

I asked what happened.

"Two critical vulnerabilities. Remote code execution. No authentication required."

Cool.

How many PHP servers do we have?

According to inventory: 12

According to reality:

Nobody knows.

We found one running WordPress.

Three running old internal tools.

One under someone's desk.

Two inside vendor appliances.

A forgotten employee directory from 2016.

And a server named:

PHP-OLD-DO-NOT-TOUCH

Naturally, that one runs payroll exports.

Then we found a PHP 5.6 box.

I asked who owned it.

The documentation said:

BRIAN.

Brian left in 2019.

We called Brian.

He said:

"Oh wow, that's still running?"

Excellent.

By 8 AM, leadership joined the incident call.

CEO:

"Can hackers actually get in?"

Security:

"Potentially yes."

CEO:

"Without a password?"

Security:

"Yes."

CEO:

"Then why do WE need passwords?"

Not the lesson.

Finance asked if we could wait until the weekend to patch because downtime affects revenue.

Security explained that the alternative was letting strangers execute code on our servers.

Finance asked for a cost comparison.

At 9:17, someone suggested temporarily taking the vulnerable websites offline.

Marketing refused.

"Our campaign is live."

So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.

We finally patched everything we could find.

Then our scanner discovered another PHP server.

Hostname:

TEMP-PHP-2014

Uptime:

4,512 days.

Nobody knows what it does.

Nobody owns it.

Nobody can shut it down.

But every time we block network access, the warehouse stops printing shipping labels.

Security has classified it as critical infrastructure.

It is running PHP 5.4.

The vulnerability has existed longer than half our employees.

The emergency patch took four hours.

Finding out what PHP actually runs took eleven.

The internet isn't held together with code.

It's held together with servers everyone is afraid to turn off.

[sui @birdabo]

they’re calling it the black October lmao.

> node.js: security vulnerability.
> PHP: critical RCE vulnerabilities.
> tensorlake: npm package infected.
> liteLLM: malicious PyPI + Docker releases
> Railway: customer secrets exposed
> zeabur - infrastructure breached.
> OpenCode: AI API keys exposed.
> OVHcloud CLI: official binaries backdoored.
> RankMath PRO: malware inside official plugin.
> TeamUpdraft: customer data compromised.
> ConnectWise: cloud backup identities compromised.
> SubQuery: backdoored npm package.
> GhostAction: GitHub repos with malicious workflows (related to the broader Shai-Hulud/ChainDrop activity).
> eMudhra: certificate authority keys compromised (with downstream impact on Tailscale).

this some complete madness bro. 1/3 of the internet is fucked.

[pilvar (Philippe Dourassov) @pilvar222]

My colleague made a website to check if your website is vulnerable to PHP2Shell: https://t.co/w63eWZNmQJ

We're also releasing PHP images with backported patches for free: https://t.co/wXXXnr6vKK

Stay safe!

[Mathieu Flaig @MathieuFlex]

Le site Orange France en 404 (potentiellement pour le risque PHP ?)

https://t.co/7VZJe6SwzA

[Gabin85 @gabin85_]

@MathieuFlex Mais le site est en grève mdr

[Mathieu Flaig @MathieuFlex]

@gabin85_ Ils doivent patcher le PHP 🥹

[Felipe Daragon @FelipeDaragon]

🚨 UPDATE: PHP 8.5.12 may still be vulnerable to php2shell!

Researchers are reporting a successful double-free trigger on the newly patched release.

⚠️ The official fixes may be incomplete. A crash alone doesn't confirm RCE, but this deserves urgent investigation.

Don't assume you're safe just because you've patched.

#php4shell #php #cybersecurity

https://t.co/L5UcCtwFn3

[Mathieu Flaig @MathieuFlex]

@Expl0itSHADOW @PingouinAnonyme Oui le bug du jour m’a montré que c’était une erreur, corrigée tout à l’heure pour intégration dans Authenticator 😅

[Mathieu Flaig @MathieuFlex]

@pbeyssac C’était un trou dans ma raquette Authenticator, j’ai modifié quand j’ai récupéré le réseau Orange ;)