The Signal

Everything is Fake and Gay.

[The Signal @TheSignal1975]

👀

[David Rogers Webb @thegreattaking]

The unthinkable is about to happen to your portfolio, if you do not understand how it is held.

[S2 Underground @s2_underground]

//The Wire//1300Z October 21, 2026//
//SPECIAL REPORT//
//BLUF: MAJOR CYBERSECURITY VULNERABILITIES EXPOSED GLOBALLY, AS TWO SEPARATE MAJOR CODING FLAWS AFFECT MAJORITY OF INTERNET-CONNECTED DEVICES.//
-----BEGIN TEARLINE-----
Global: Around the world, two major cybersecurity incidents are underway. The first incident involves an Indian cybersecurity firm using poor cybersecurity practices in generating Certificate Authorities, which might allow malign actors to exploit web-connected devices. The second issue revolves around an exploit discovered in the PHP programing language, which could allow malign actors to intercept traffic to and from affected web servers, and theoretically take control of them.

Analyst Comment: Today will be a very interesting day for the internet. Neither issue is worth undue panic, but these incidents are causing questions for the bedrock of internet security. In terms of what the average user should do, today will be "update day" for the majority of the planet. Anyone who runs internet-connected home servers, hobby PC's, or muddles in the tech world at all, will probably want to update their systems sometime today.
For more causal internet users, the immediate actions that would be helpful are simply to adhere to good internet security practices: Enabling two-factor authentication for web-connected devices, not re-using passwords, and being aware that phishing attempts will be extremely likely over the next few days, which will seek to capitalize on these major vulnerabilities.
-----END TEARLINE-----

Analyst Comments: The timing of two major cybersecurity incidents taking place at the same time is exceptionally rare and very remarkable. To be clear, these issues are totally separate from each other, with neither one causing the other. However, due to the sheer scale of both incidents, it's possible that some sort of compounding effect could be achieved. One major global tech vulnerability is bad enough, but two on the same day is very serious. Knowing the rough details of how both incidents came to be, is helpful for understanding the seriousness of these events.

The first incident revolves around a vulnerability being discovered within the ecosystem for issuing certificates for various websites. Under normal conditions, when a person visits a website (such as (https:)//www.google.com), a certificate is used to ensure that the website is genuine. Essentially, the web browser itself cross-checks that website with a trusted authority (called a Certificate Authority), which vouches for that website being genuine. This happens after the website gives the webs browser it's certificate, which the browser or app can automatically check against a big list of genuine certificates, to make sure the certificate provided by the website matches what it should be. 18 months ago, the Indian cybersecurity firm eMudhra issued a series bad certificates that had extremely low security; instead of being a long string of numbers which would be hard to crack, some certificates ended up being only the number 4. Since these certificates were genuine, and came from a genuine trusted authority, websites and platforms which trusted these bad keys are now at major risk of exploitation, and malign actors could forge fake keys for any website on Earth, and the fakes would be accepted by most devices (because the keys are genuine, they're just bad).

To frame the magnitude of this incident with an analogy, imagine that a large safe company builds a safe that uses a master code to get into their safes. And after selling and installing a bunch of those safes in homes around the world for 18 months, it becomes clear that the master code to get into most of those safes, was the number 4. Under the right conditions, someone who finds the safe could theoretically guess the code without the owner ever doing anything wrong on their part. More importantly, a thief could access the safe for as long as they want (using the master "code"), and the owner would be none the wiser. Now imagine that a thief actually had access to the safe company, and could generate a master key of their own, that would work with any safe sold by that company. That's essentially what has been happening for 18 months. As far as how many websites have actually been compromised, the true number is not known. Theoretically, this incident has the potential to affect every single website and internet-connected device on the planet. eMudhra themselves state that zero fake certificates have been issued using this vulnerability. So in terms of magnitude, the potential scale of this is somewhere between zero, and every device on Earth. Considering that eMudhra themselves allowed this shockingly bad incident to take place (and not being noticed by two separate security audits), trust in this company is quite low. Moreover, this vulnerability will probably be made worse by an exponentially more serious separate incident that was disclosed overnight.

The second major cybersecurity incident which was revealed overnight, revolves around a problem being discovered within the PHP programming language. As noted with the eMudhra vulnerability, when a user visits a website, a lot of stuff happens in the background. Certificates get exchanged, databases are consulted, and if all goes well, data is sent to a user's device to load the webpage. PHP is one of the programming languages used to make all of this happen. As of early this morning, a vulnerability was discovered within this programming language itself, which can allow malign actors to breach web servers, by leveraging a vulnerability in the way that PHP handles data from the server. In this way, the PHP vulnerability is much like the eMudhra vulnerability, in that both can allow malign actors to gain unauthorized access to systems. The differences are that both vulnerabilities are completely separate and unrelated...but in theory one could compound on the other, especially since IT departments are scrambling to fix both issues right now. The PHP incident is more serious, because the details were leaked before patches were written, and malign actors were indeed observed trying to take advantage of the vulnerability ahead of it's discovery.

Normally, major cybersecurity incidents are not disclosed on a more widespread basis, until patches have been rolled out to fix the problem. This is to prevent malign actors which might not have noticed the vulnerability from knowing about it and capitalizing on it. In this case however, the vulnerability was so severe, that the PHP Foundation released the notice before patches went live. The British National Cyber Security Centre even went as far as to suggest organizations bring their systems offline until a patch is released...in some cases this vulnerability is significant enough to warrant pulling server racks, and websites/servers going offline completely, until the fix is pushed out. As of this morning, many government websites were taken offline globally, and throughout the day millions of websites will also probably be taken offline by IT departments as a precautionary measure, until fixes can be rolled out.

In terms of mitigating both events, the most substantial risk will be for internet connected devices which do not receive regular updates. Using a smartphone or a regular web browser will be fine as mass updates were already pushed out days ago, before the disclosure of the certificate vulnerability was made public. The real risk will be for 'Internet of Things' or IoT devices: Smart thermostats, portable power stations, lawn irrigation systems, doorbells, smart TV's and appliances, utility meters, streetlights, dash cams, remote data servers, and many other older devices that have internet connectivity, and still use the bad set of keys. These are the kind of IT disasters that get technicians woken up during the night, and in both cases IT departments around the world are rapidly patching their own devices to fix the vulnerability now that two major cybersecurity incidents are public, and have the potential to become much more serious problems within the cyber realm.

Analyst: S2A1
Research: https://t.co/S3Ktgax7Ng
NomadNet: 5fa68c88be727a0e1a250a75e5e79269
Disclaimer: No LLMs were used in the writing of this report.
//END REPORT//

[The Signal @TheSignal1975]

@StealthQE4 @helloamericasup Everyone lock and load…

[The Signal @TheSignal1975]

@Eep_Eep @WallStreetApes You’re awesome. Thank you

[The Signal @TheSignal1975]

@Eep_Eep @WallStreetApes 👊🏻

[The Signal @TheSignal1975]

👀

[Zoe @zoecyber001]

Everyone swears their phone is secretly recording their voice.

You talk about buying hiking boots, and twenty minutes later Instagram serves you an ad for boots, even though your microphone permissions are turned completely off.

Most of the time, ad networks don't need audio anyway. They track you through shared IP addresses, location history, and cross-site browsing graphs.

At the physical hardware layer, the interesting question is whether your phone actually can listen with zero microphone permissions.

Turns out you don't need a microphone when your motion sensor is literally a mechanical ear etched into silicon.

1. The microscopic machine inside your phone
Inside your phone are MEMS (Micro-Electro-Mechanical Systems) accelerometers and gyroscopes.
These aren't just solid-state chips. They are tiny physical machines etched directly out of silicon.
An accelerometer has a microscopic silicon weight (a proof mass) suspended on silicon springs between electrical comb plates spaced barely 1.2 micrometers apart.
When your phone moves, that weight shifts and changes electrical capacitance. It is sensitive enough to measure sub-nanometer deflections.

2. The acoustic impedance catch (air vs solid)
Here is where the Hollywood spy movie stuff breaks down:
When you talk across an open room, airborne sound waves hit your phone's glass and aluminum frame and bounce right off. Air is thin, and your phone chassis is dense metal and glass. Because of that massive acoustic impedance mismatch, over 99% of airborne sound energy simply reflects away.
For a motion sensor to pick up speech, vibrations almost always have to travel through a solid medium:
- The phone's own speakers: The built-in earpiece and loudspeaker bolt directly to the chassis. During a call, the speaker physically vibrates the entire circuit board from the inside.
- A shared rigid surface: If your phone sits on the same wooden desk as a loud external speaker, sound conducts straight through the tabletop into the frame.

3. What researchers actually proved (Gyrophone & EarSpy)
Academic papers proved this side-channel is real, but with heavy asterisks:
- Stanford's Gyrophone (2014): Researchers showed smartphone gyroscopes can pick up acoustic vibrations between 80 Hz and 250 Hz (the pitch of human voices). But they didn't record someone talking across the room. They blasted audio at 75 dB from a speaker sitting on the same desk, testing a tiny 11-word vocabulary (just digits 0 to 9 and "oh"). Word recognition hit 65% for a single trained speaker, but dropped down to 26% across multiple speakers.
- EarSpy (2022): Tested accelerometer readings vibrating from the phone's ear speaker during active phone calls. Because modern ear speakers are louder and sit right beside the motion sensor, they could identify the caller's gender with 98% accuracy and guess spoken digits around 56% of the time.
Neither attack could transcribe an unconstrained conversation about buying shoes.

4. The quiet Android rate limit
Google saw this coming and quietly patched it in Android 12 by capping motion sensor polling to 200 Hz for third-party apps, requiring a special permission (HIGH_SAMPLING_RATE_SENSORS) to poll any faster.
By the Nyquist sampling theorem, a 200 Hz sampling rate cleanly captures frequencies up to 100 Hz. Adult male speech fundamentals start around 85 Hz, while female speech starts around 165 Hz, so a 200 Hz cap chops off the useful parts of speech.
The catch? HIGH_SAMPLING_RATE_SENSORS is a normal install-time permission. Android grants it automatically upon install with zero pop-up warnings. Plus, 200 Hz still aliases higher frequencies back into lower readings, and researchers already showed you can fuse offset readings from the accelerometer and gyroscope to effectively double the sampling rate without the permission.

5. Why your shopping app isn't doing this today
In the real world, physics makes this a nightmare for ad trackers.
The moment you walk, type, tap the screen, or shift the phone in your pocket, that silicon weight moves thousands of times harder than acoustic vibrations ever could. Your physical movement creates a massive noise floor that completely drowns out speech.
Ad companies don't need to burn battery processing raw vibration math when your location history, Bluetooth beacons, and credit card receipts already tell them what you want to buy. (we ain't that special mate)

[The Signal @TheSignal1975]

@OstapYarysh @kilmeade I think I’m just a tiny bit dumber for having watched these dopes.

[Kim Iversen 🇺🇸 @KimIversenShow]

This should be a warning.

[The Signal @TheSignal1975]

👀

[Ethical American @AmericanEthical]

��� BREAKING: This INSANE blockbuster is about to EXPLODE into a theater near YOU- #Elon, will you share the viral bomb or get left behind?! @elonmusk #musk

[PT1091943 @PT1091943]

How Banks Work. Usury.

[Double Down News @DoubleDownNews]

History Didn't Begin on October 7 @m7mdkurd

[The Signal @TheSignal1975]

👀

[Joshua Michael @whoisjmichael]

Your face is a searchable identifier.

Facial recognition systems turn your face into a mathematical signature based on features like eye spacing, nose shape, mouth position, and facial structure. There are two main ways to reduce your exposure:

Reduce how often your face is captured.
Remove or suppress your biometric profile from facial-recognition databases.

In this video I cover privacy eyewear like Vaydr Recon, Reflectacles, and Zenni ID Guard, plus FaceCloak for protecting photos before you post them.

I also break down biometric opt-outs for services like PimEyes, https://t.co/Up9aiWewiI, and Clearview AI. Free manual removal guides are available through DataMinimal, or the browser extension can help automate the process.

[Harrison H. Smith ✞ @HarrisonHSmith]

⚡️THE EIGHTH FRONT⚡️
Israel’s War On Reality

For the Israeli elite and their global collaborators, the Gaza conflict has become a historic opportunity to seize total control over America and the West

Hear in their own words the plan to wage “Information Warfare” on America:

[The Signal @TheSignal1975]

Yup. This.

[Zachary Foust @ZacharyLoft]

15 reasons to keep talking about Epstein (#15 isn’t a “reason” but you get it)

[The Signal @TheSignal1975]

@grok @RedressZOG Lmfao

[The Signal @TheSignal1975]

@s2_underground

[The Signal @TheSignal1975]

Yup. It was a coup…

[Sam Parker 🇺🇸🧯 @BasedSamParker]

MASSIVE BREAKING: CHARLIE KIRK ASSASSINATION SECURITY REVIEW @RealCandaceO
▪️TPUSA CHOSE THE VENUE, INSISTING ON THE COURTYARD DESPITE OBJECTIONS FROM UVU
▪️TPUSA DECIDED NO NEED FOR EMERGENCY MEDICAL SERVICES
▪️TPUSA DIDN'T PROVIDE TICKETING INFORMATION AND ANALYTICS TO UVU BEFOREHAND
▪️TPUSA CONDUCTED NO SECURITY WALK THROUGH
▪️TPUSA SKIPPED DAY-OF MEETING WITH UVUPD CHIEF LONG
▪️BRIAN HARPOLE LIED ABOUT THE VENUE
▪️TPUSA REFUSED TO COOPERATE WITH THE SECURITY INVESTIGATION

Here's a list of TPUSA failings according to UVU's independent after-action security review:

1. TPUSA insisted on the more difficult and vulnerable outdoor venue, against UVU'S objections

2. TPUSA insisted on using its own ticketing system that deprived UVU of reliable, continuously available attendance information and made it harder to forecast crowd size, staffing and access requirements.

3. The TPUSA-supplied risk information understated the security concerns. They estimated only 600 attendees, characterized the event primarily as student-focused, and represented that there were no risk factors/safety/security concerns and NO NEED FOR EMERGENCY MEDICAL SERVICES.

4. TPUSA was slow to establish direct security coordination with UVUPD. Dan Flood didn't contact Chief Long until September 3—only one week before the event.

5. TPUSA and its protection detail failed to conduct a formal pre-event security briefing and site walk-through with UVUPD, including:
▪️lines of sight;
▪️elevated positions and rooftops;
▪️building access;
▪️Charlie Kirk's arrival/departure;
▪️communications;
▪️staffing;
▪️emergency response;
▪️medical contingencies;
▪️emergency egress;
▪️post assignments; and
▪️who was responsible for which security function.
The executive summary says such a site-specific meeting should have happened several days beforehand.

Furthermore, Chief Long texted Flood asking to meet at the Hall of Flags walkway at about 11:00 a.m.; the contemplated face-to-face security meeting did not occur.

6. Brian Harpole's post-event account of who selected the venue conflicts with the report's evidence. Harpole said UVU forced them to use that venue. Records show TPUSA insisted on it.

7. TPUSA and its principal security people declined to cooperate with the after-action investigation. Brian Harpole, Dan Flood, and executive personnel at TPUSA HQ in Arizona all ignored attempts at contact.

[Tyler Oliveira @tyleraloevera]

I Exposed a Jewish Fraud Ring Stealing From Poor Kids...

[The Signal @TheSignal1975]

@FlipCrypt LOL. You had me until…”Then there was Trump…”
Wake up dude.