CL 🌱

buildin'

[CL 🌱 @c2mlouro]

@LowLevelTweets bad day to @levelsio , nvm the hourly cron job OPUS5.5 agent already deployed the fix and everything running secure and he didnt even had read the news

[CL 🌱 @c2mlouro]

Here are the steps to fix you website

Steps to reproduce:
1. Open wrh/timeseries?site=LTFM
2. The page shows "LTFM is not a valid station identifier."
3. In the network tab, the page first requests STID=LTFM, then a second request for STID=COOPLTFM.

Cause: /source/wrh/timeseries/obs, the success check in monitorOBS is incorrect

or LTFM, Synoptic returns a valid response (RESPONSE_MESSAGE "OK") with COUNTRY "TR", so this condition fails. The code then falls into the else branch, which assumes the station wasn't found and retries with a "COOP" prefix. COOPLTFM doesn't exist, so the page reports the station as invalid, even though the first response contained the data.

To fix: - Remove the COUNTRY == "US" condition, or handle non-US stations separately rather than treating them as not found. - Only fall back to the COOP prefix when the response actually indicates no station was found (e.g. "No stations found for this request"), not on rate-limit or other errors.

[CL 🌱 @c2mlouro]

Here are the steps to fix you website

Steps to reproduce:
1. Open wrh/timeseries?site=LTFM
2. The page shows "LTFM is not a valid station identifier."
3. In the network tab, the page first requests STID=LTFM, then a second request for STID=COOPLTFM.

Cause: /source/wrh/timeseries/obs, the success check in monitorOBS is incorrect

or LTFM, Synoptic returns a valid response (RESPONSE_MESSAGE "OK") with COUNTRY "TR", so this condition fails. The code then falls into the else branch, which assumes the station wasn't found and retries with a "COOP" prefix. COOPLTFM doesn't exist, so the page reports the station as invalid, even though the first response contained the data.

To fix: - Remove the COUNTRY == "US" condition, or handle non-US stations separately rather than treating them as not found. - Only fall back to the COOP prefix when the response actually indicates no station was found (e.g. "No stations found for this request"), not on rate-limit or other errors.

[CL 🌱 @c2mlouro]

@NWS Hey do you want help to bring the site online?

I can't see the reading for Istanbul Temperatures https://t.co/AIxHWtliEl

[CL 🌱 @c2mlouro]

@dok2001 https://t.co/gcou29a7RP

[CL 🌱 @c2mlouro]

Certificates eMudhra, check and use the prompt below to check your projects

[CL 🌱 @c2mlouro]

@NCSC https://t.co/gcou29a7RP

[CL 🌱 @c2mlouro]

Certificates eMudhra, check and use the prompt below to check your projects

[CL 🌱 @c2mlouro]

I need you to analyze THIS project to determine whether it is affected by the compromise of eMudhra intermediate certificates, and what steps I need to take. First analyze and report; only make changes that are safe and strictly within scope, and propose the rest.

## The Incident (status as of Oct 21, 2026; verify sources for updates)
- The private keys of eight eMudhra intermediate certificates were weakly generated and can be recovered directly from the certificates themselves. Anyone holding these keys can forge a certificate that is accepted for ANY domain.
- The eight intermediates are: EM DV TLS CA, EM OV TLS CA, and EM EV TLS CA, across generations G3B (eMudhra BV) and G3C (eMudhra Inc), plus EM OV CS CA G3B and G3C (code signing). Issued by the roots emSign Root TLS CA - G3 and emSign Root CS CA - G3, and cross-signed by Sectigo's "AAA Certificate Services" root, which is present in almost all trust stores. Fingerprint list: https://t.co/PSZxRzEJ3s
- Certificate Transparency logs show no certificates issued by these intermediates, so browsers requiring CT could not be targeted. For non-browser clients (Node, Python, Go, Java, curl, mobile apps, IoT), the impact remains unknown.
- Already distrusted by: Chrome and Firefox (Oct 17), Apple (Oct 19), Microsoft (Oct 20), and Cloudflare across its services, including Workers.
- Sources: https://t.co/6O7bACN88n and https://t.co/hq5fXr4vFF (package list and test endpoints). Read the current list before concluding.

## Fixed Versions (as of Oct 21, 2026; confirm on the status page)
- Ubuntu ca-certificates 20260816ubuntu0.22.04.1, 0.24.04.1, 0.26.04.1, and 0.26.10.1.
- Debian ca-certificates 20250419~deb12u2, 20250419+deb13u1, and 20260816+nmu1.
- Alpine ca-certificates 20261020-r0. Fedora 2026.2.92_v9.0.319. Arch ca-certificates-mozilla 3.131.1-1. Chainguard 20260909-r3. Homebrew ca-certificates 2026-09-25_1.
- NSS 3.131.1. curl CA bundle 2026-10-20.
- Go 1.27.3 and 1.26.10.
- Python certifi 2026.10.19, pip 26.2.2, uv 0.13.4.
- Rust rustls-webpki 0.103.16, webpki-roots, and webpki-root-certs 1.0.10.
- Electron 44.9.1, 43.8.1, and 42.11.16.
- Composer ca-bundle 1.4.16 and 1.6.0. Elixir castore 1.0.22. Perl Mozilla::CA 20261020.
- UNFIXED as of this date: Node.js, Bun, FreeBSD ca_root_nss. Java is not listed: inspect the `cacerts` file of the in-use JDK.
- Cloudflare clients:
- Cloudflare One/WARP: 2.5.7 (Android), 1.12.7 (iOS), 2026.8.2115.0 (desktop).
- 1.1.1.1 App: 6.38.11 (Android), 6.31.8 (iOS), 2026.8.2115.0 (desktop).
- cloudflared: 2026.10.2.
- On macOS, `/usr/bin/curl` uses `/etc/ssl/cert.pem`, which has not been updated (see the page for the workaround command).

## What to Analyze
1. Where the project runs: serverless (runtime and cloud provider), containers (base image), VMs, CI, developer environments, mobile or desktop apps, browser. For each target, determine which trust store evaluates certificate validity: OS trust store, bundled runtime trust store (Node bundles its own), language package (`certifi`, `webpki-roots`, `castore`...), custom bundle file (`SSL_CERT_FILE`, `REQUESTS_CA_BUNDLE`, `NODE_EXTRA_CA_CERTS`, `cacerts`), or certificate pinning.
2. Search codebase and configuration for disabled or bypassed certificate verification: `verify=False`, `rejectUnauthorized: false`, `NODE_TLS_REJECT_UNAUTHORIZED`, `InsecureSkipVerify`, `curl -k`, `strict-ssl=false`, custom CAs, pinning, mTLS (including loaded CA bundles used to verify client certificates). If the project uses Cloudflare in Full (strict) mode, review the origin server certificates.
3. Test actual TLS clients of the project against test endpoints. A certificate ERROR is the expected/healthy outcome; a successful connection indicates that the client still trusts the compromised intermediates.
- https://t.co/afQaPgXZET
- https://t.co/aciScylRsP
- Examples:
- Include controls on both sides: a standard HTTPS site must succeed, while `https://t.co/OujIwSs5K2` must fail.
- Note: Testing from your local browser or machine's `curl` proves nothing about the production server environment. Execute tests through the path used by the application itself (same image, same runtime, same library). If executing these tests requires creating resources in a cloud account (such as a staging deployment or temporary Worker), ask for my approval first.
4. Certificate Chains: List project domains and all external services it connects to (APIs, SMTP, IMAP, databases, configured webhooks). For each target, inspect the certificate chain using:
`openssl s_client -connect <host>:<port> -servername <host> -showcerts </dev/null>`
(for SMTP with STARTTLS, append `-starttls smtp`)
Flag any chain containing "EM DV/OV/EV TLS CA", "emSign", or "eMudhra": post-mitigation, these connections WILL BREAK, requiring coordination with the service provider.
5. Certificate Transparency for project domains, checking for unexpectedly issued certificates. If `https://t.co/RebErX9uSE` is degraded (common during security incidents), use:
`https://t.co/astCyPBwrL<domain>&include_subdomains=true&expand=issuer&expand=dns_names`
6. Code Signing: Determine whether the project signs or verifies binaries using certificates chained to these intermediates (`EM OV CS CA G3B/G3C`). If so, handle this as a separate remediation track.
7. Production Data: Access production data only if required to identify external server hostnames connected to by the project: perform READ-ONLY queries only, and extract hostnames exclusively (never export full configurations or secrets).

## Rules
- Do NOT "fix" a certificate error by disabling TLS verification.
- Do NOT upgrade dependencies outside the scope of this incident. When upgrading a root bundle package, isolate the change to that package alone (e.g., `pip-compile --upgrade-package certifi`) and verify through `git diff`.
- Container Images: Rebuild without cache using the updated base image (`docker build --pull --no-cache`), and verify installed system CA package versions and language-level CA packages inside the built image.
- In CI workflows, favor major-version specifiers (e.g., `node-version: 22`) that pick up upstream security releases automatically, and verify the resolved version in step logs.
- Do NOT log or print secrets. Do NOT deploy to production or provision cloud resources without explicit approval. Adhere to repository commit and deployment conventions, and write in the repository's established style and language.
- Credential Rotation: Recommend secret rotation only when supported by concrete evidence (e.g., a vulnerable client transmitted credentials over untrusted/unvetted network paths). State the explicit rationale.

## Desired Output
1. Verdict in two or three sentences: whether the project is affected, and specifically where.
2. Table: component | execution environment | trust store source | test result | action required.
3. Evidence: commands executed and exact outputs received.
4. Prioritized Actions: categorized into completed actions, actions pending my approval, and actions blocked on third-party upstream releases (e.g., Node.js), along with validation criteria for when upstream releases become available.
5. If this repository contains a TODO or CHANGELOG file, log pending follow-up tracking items there.

[CL 🌱 @c2mlouro]

Certificates eMudhra, check and use the prompt below to check your projects

[CL 🌱 @c2mlouro]

@pcshipp True for me too :-(

[Autism Capital 🧩 @AutismCapital]

Complete Tesla Roadster FLYING demo. INSANE!!!

[CL 🌱 @c2mlouro]

@theluisribeiro Falta dizer que ele te vai vender a ti e fazer lucro, lol burro

[Department of State @StateDept]

FULL REMARKS: Secretary of State Marco Rubio Speaks at Joint Press Conference in Portugal

[CL 🌱 @c2mlouro]

@shivon Imagine if this was simply a bug in the bot lol

[Elon Musk @elonmusk]

Best way to sandbox an AI is to put it on a Delta flight – it will have no chance of accessing the Internet!

[CL 🌱 @c2mlouro]

@LiberalPT Rejeitado pela Abstenção e não pelos Contras lol imagine being this biased and dumb

[CL 🌱 @c2mlouro]

you will gonna die for zelensky and you will be happy

[Russian Embassy in NL🇷🇺🇳🇱 @rusembassynl]

Recent NATO "heroic" clip: Inspiring the youth to be ready to die for elites. By the way - no sign of inclusivity and diversity in this movie?

When provoking the WW3, do they think of Europe's security or rather economic benefits for military industries?

[CL 🌱 @c2mlouro]

@cesna8020 @PalmerLuckey U want a smoke bro? Get in the acc train

[CL 🌱 @c2mlouro]

@expresso @grok vao ficar mais caras ou mais baratas consideranto inflacao?

[CL 🌱 @c2mlouro]

@EmmaBat_ Emma uma grande chuva dourada para ti ✨✨✨✨✨
E não te esqueças o povo é quem mais ordena

[CL 🌱 @c2mlouro]

@NamGoPro @claudeai @bcherny @ClaudeDevs @trq212 Claude fix this right now make no mistakes