Abhi Nav

Building @wyck_sol | | AI |
Agentic War Survivor | Crypto 2018 batch |
3x Founder- GameTerminal, Clansaga

[Abhi Nav @abhitcoin]

This is me.
don’t be like me

- failed JEE twice
- private college, CSE
- quit a safe MNC job
- started crypto at 18
- first project, 2019 → $2M raised
- second project, 2023 → $2.7M raised
- third project, 2025 → revenue in 6 months
- fourth project → shipping now
- heavy setbacks
- harder lessons
- stronger mindset

still building.
still learning.
still standing.

[Abhi Nav @abhitcoin]

@shazcodes Hey that’s a great idea

[Abhi Nav @abhitcoin]

@fullstacklover wth bro 😂😂

[Abhi Nav @abhitcoin]

My WiFi password is more secure than this.

eMudhra is one of India's biggest certificate authorities. Their entire job is telling your browser "relax, this website is legit."

One of their 384-bit private keys was the number 4.

Not 4 billion. Not 4 with some fancy math on top. Just 4.

A key like this is supposed to be 96 characters of pure random chaos. Theirs was 95 zeros and a 4. Basically a lock where the combination is "open."

And these aren't small clients. #eMudhra has issued HTTPS certificates for major government websites. UIDAI included. Yes, the Aadhaar people.

Browsers had to step in and block the affected certificates themselves.

Your bank OTP has 6 digits. eMudhra's key had 1.

Shorter version:

India's banks: your OTP must be 6 digits.

eMudhra, a certificate authority that issues HTTPS certs for government sites like UIDAI: our private key is 4.

Not a typo. A 384-bit key that was literally 4. Browsers had to block the certificates.

Cybersecurity, but make it jugaad.

[Abhi Nav @abhitcoin]

A bug went into PHP in 2012.
It sat there for 14 years. Nobody noticed.
This week, everyone did.

Quick basics.

When you open a website, your phone asks a computer somewhere for the page. That computer is a server. It builds the page using a programming language. Often, that language is PHP.

You've never typed PHP, but you use it daily. WordPress runs on it. So do WooCommerce, Magento and Shopware stores. So do a lot of clinic, school and coaching centre sites in India.

The problem.

Researchers found two bugs inside PHP. They're calling it PHP2Shell. Both rated 9.2 out of 10.

A stranger sends the server one crafted request. The server starts taking orders from them. No password. No account.

Think of your society gate. The guard checks everyone. But knock in one odd pattern and he just opens up. That trick has worked since 2012. Now it's public.

Once inside, attackers can steal customer data, put up fake payment pages, lock files for ransom, or use the server to hit other sites.

Affected: every PHP version from 5.4 to 8.5.11.

The timeline.

Aug 1: Calif finds a way to exploit it.
Aug 11: Reports it to PHP.
Aug 24: Wiz reports it separately.
Oct 20: Details leak. No fix yet.
Oct 21, 7:43 am UTC: Cloudflare spots attacks.
Oct 21, 2 pm UTC: Fix released.

Attackers got a head start. It's already been shown working on Magento and ten other apps.
The part that stuck with me: Wiz said frontier AI models helped make the attack practical. A chain of steps that would've been really hard for humans alone.

Old holes will now surface faster. Good if researchers find them first. Bad if they don't.
FBI's advice: update now. Can't? Take it offline. Watch for attacks. If hit, save the records and report it.
On PHP 8.1 or older? No fix coming. Those versions are dead. Upgrade.

If you just browse:
Nothing to update on your phone. For a few weeks, skip random pop-ups on small sites. If a payment page looks off, stop. Use UPI or cards with good fraud protection. If a site reports a data issue, change that password.

If you own a site:
Text your developer today. One question: "Is our PHP updated to the fixed version?"

Plenty of Indian businesses built a website once and never touched it again. Those are the easiest targets.

A website isn't a one time purchase anymore. Someone has to look after it.

[Abhi Nav @abhitcoin]

@Kesinzuko gm gm

[Abhi Nav @abhitcoin]

@neerajjj6785 Useless 😂😂

[Abhi Nav @abhitcoin]

@Samaytwt true

[Abhi Nav @abhitcoin]

@100AuraPoint Same

[Abhi Nav @abhitcoin]

What’s one tool you pay for every month but barely use?

[Abhi Nav @abhitcoin]

@_karanGhosh Great

[Abhi Nav @abhitcoin]

@VaibhavLab Hehe that was the exact question

[Abhi Nav @abhitcoin]

@DemandorSupply 😂😂

[Abhi Nav @abhitcoin]

@100AuraPoint Haha so true

[Abhi Nav @abhitcoin]

@TheCaptainEli factory and launch pad in the same place.
Build, fly, break, fix, repeat, without shipping anything across the country.
That’s how you iterate a rocket like software.

[Abhi Nav @abhitcoin]

@SahilPanhotra is it really that good?

[Abhi Nav @abhitcoin]

@coolcoder56 very unfair bro

[Abhi Nav @abhitcoin]

@VaibhavLab great list. on point

[Abhi Nav @abhitcoin]

@mscode07 All good bro?
Let me know.

[Abhi Nav @abhitcoin]

@ShazXcode totally agreed

[Abhi Nav @abhitcoin]

@NeelKukreti Not the first time. Getting used to it.
At least we are aping somewhere