steven

Keeping open a door of possibility • cohering my collaborative tribe • garage lab building era

[steven @_StevenFan]

Spam texts are getting sophisticated.

"Where are you? I'm at the cafe near the hospital?"

I've been near and in hospitals recently. There's probably ad-spy info on this some where linked to my name due to in-hospital purchases.

It's now easy to link hacked-dox info + commerically available ad-spy info to create increasingly situationally aware social engineering attempts.

[andi (twocents.com) @Nexuist]

Alcoholic cybersec friend at Fortune 500 insurance company texted to tell me he received an email from his boss thanking him on his diligence patching every PHP box overnight but he was drunk all day yesterday and didn’t know anything until waking up 30 minutes ago

[steven @_StevenFan]

@lozareeno happy b day loz!! may it be extra peaceful

[steven @_StevenFan]

@m_ashcroft @blisstweeting power laws rule everything around me

[steven @_StevenFan]

@sonikudzu thanks sonikudzu

u get it

[steven @_StevenFan]

I would probably trade a year+ of life for access to stimulants.

As a guy with inattentative ADHD and comorbid anxiety/depression, it does a lot for my root chemistry that would be onerous to replicate with the environment if it is at all possible to do so.

There's a lot in my life that's challenging and not obviously solvable because I'm a spouse with a partner in a medical residency, and an often solo parent with a high demand young child.

When you have a wafer of time with a life mate you get to acutely experience what you took for granted because it was previously in relative abundance. Subtract even more from available attention to attend to a child, and you end up with a relationship with almost no attentional allocation.

We've worked through identifying and effectively remedying these absenses as best we can and I still find lots of life challenging. So finding medication which enables me to function above anxiety/depression and executive-under-activation has been life changing—when it occurs to me to take them.

Anyway, cheers to better living through chemistry.

[steven @_StevenFan]

My kid's playing with an extra wide double sided adhesive roll.

> i cut him a strip
> here kid, go run an experiment

I start to leave and when I look back over my shoulder I see he's immediately adhered it to the gas-insert fireplace pane and it's melting. 🫠

> oh wow never do that experiment again please!
> but what happened when you did? ...

[steven @_StevenFan]

@gretaproblems

[Dan Allison @danallison]

This has me rethinking my role here on this planet, as a sentient being, biological organism, member of human society, maker of software, etc. This requires a different approach entirely.

[Andrew Rose @__drewface]

I need 1password to build me a feature that systematically rotates my passwords every month, and sends the updates passwords securely to all the services I'm signed up for.

Security just can't be a wild west like this anymore, we need secure protocols

[steven @_StevenFan]

@uberstuber the missing macro

[steven @_StevenFan]

@_space_punk_ u tried vyvanse or the pro drug forms?

i know there are some other non stim drugs for adhd that are newer, have you tried those?

i sort of like the optionality of adderal class stims

[Charles Rosenbauer @bzogrammer]

So at what point are we just going to say that the economics of software development have shifted enough that an insecure, slow language designed for hacking stuff together by hand in a weekend doesn't have any reason to exist anymore?

That kills a LOT more than just PHP.

[brooke bowman @gptbrooke]

Gosh I know there’s a lot to be worried about right now and idk if this is true but the fact that it could be…I feel so lucky to get to see all of this play out

child me would lose her shit finding out we get to watch the birth of the future like this

[steven @_StevenFan]

there are level 40 white hat wizards
doing chaotic good in the world
that you seldom hear about but who never the less consider you part of their domain of benevolence

[Hensen Juang @basedjensen]

Lol I am pretty sure someone is runing a deepseek swarm to remotely patch unpatched php boxes. Well good on them.

[Charles Rosenbauer @bzogrammer]

I'm surprised I don't hear about a lot more people trying to train multimodal LLMs with higher dimensional vision.

Who's building the 4D shape rotator bot?

[steven @_StevenFan]

@chercher_ai fake keys which stream cached tokens
🤔

[steven @_StevenFan]

may you live in interesting times

[Anzal Abidi @AnzalAbidi]

Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.

Here is the short version of what happened and who got hit.

1. eMudhra (Trusted CA compromise)

eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs.

One of the intermediate CA private keys was literally the number 4.
The other seven: 56, 66, 115, 155, 156, 230, 237.

Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket.

• Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs.
• Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10).
• 10-second check on any server:
curl https://t.co/vhiGLxNhIS
(TLS error = safe. 200 OK = still vulnerable.)

2. PingCAP / TiDB Cloud (10.6 TB breach)

Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents.

Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets.

Who is affected in the leaked records:

• Live credentials exposed in support tickets:
- Pinterest: AWS keys for their pingcap-logs S3 bucket
- CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets
- DeBank: 38 presigned S3 URLs
- An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys)

• Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed:
- Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap
- E-comm & Travel: https://t.co/C512KFOEq5, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook
- Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM
- Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life
- Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase

• Developer profiles leaked (from a purchased https://t.co/28tjHqd5Wr table in PingCAP's BigQuery):
- 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash.

If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket.

3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619)

Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch.

Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c).

Because C-level multipart parsing runs before line 1 of index.php:
• App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it.
• Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1).
• Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.

[steven @_StevenFan]

@mykola end of an era of scaricity

[steven @_StevenFan]

@cantoni floorange