Casey Handmer

Physicist, Immigrant, Pilot, Dad.
Former Caltech, Hyperloop, NASA JPL.
Once considered pretty smart for an organic.
Founder @terraformindies. Hiring!

[Casey Handmer @CJHandmer]

Try this in the browser at https://t.co/CsLzOTKD3q!

[Casey Handmer @CJHandmer]

You can now enjoy a colored relief map render of this dataset streamed through Google Earth. Download the .kml file (https://t.co/tzxDvt7JVX) and open it in your Google Earth Pro client. Enjoy!

[Casey Handmer @CJHandmer]

So cool.

[Max Arshavsky @arshavsky]

We have superconducting magnets operating in space. Let that sink in.

[Casey Handmer @CJHandmer]

@RokoMijic Yes but what feels scarier?

[Casey Handmer @CJHandmer]

Just going to preregister here that I believe the computer security overhang is not a few dozen bugs that get patched and then we're good, there are 100,000s of vulns that are extremely discoverable with infinite free tokens and we're probably going to have to move away from systems that presuppose that perfection is possible.

[Casey Handmer @CJHandmer]

Fascinating stuff. I'm not an expert, but I remember that dodgy CAs have been a known problem since at least 2010, data retention/version control leaks at least as long, and PHP has always been adjacent to self harm. It'll be interesting to see where we land in 12-18 months on this stuff.

[Casey Handmer @CJHandmer]

@igypham This assumes that bugs are at least partially orderable, but it's completely possible that a good AI model will write code that lacks all bugs in Categories A, B, and C while inadvertently creating thousands of bugs in sui generis categories, soon to be discovered by model 2.

[Casey Handmer @CJHandmer]

Okay, now we're good: https://t.co/hx3VGHdwac

[Casey Handmer @CJHandmer]

Pretty sure that 100% of vulns have been disclosed and we're good now.

[Casey Handmer @CJHandmer]

@CaminaDrummer4 I prefer money.

[Casey Handmer @CJHandmer]

I'm vibe coding a paywall for my phone and email.

[Noah Schochet @noah_schochet]

How has no one solved spam calls yet?

[Casey Handmer @CJHandmer]

@patio11 Snowcrash, all over again.

[Casey Handmer @CJHandmer]

@igypham Because the rate of production is accelerating.

[Casey Handmer @CJHandmer]

@Tri_Stanisaurus Demolish rebuild.

[Casey Handmer @CJHandmer]

@emm0sh Similarly Sprawl, Snowcrash, Accelerando, Fall, etc.

[Casey Handmer @CJHandmer]

If you want an analogy, imagine you're a beetle entomologist in some tropical jungle. Drop a quadrat square anywhere you want, discover 20 new species an hour. The attack surface is hyperbolically enormous. It's a Cambrian explosion of entirely new kinds of exploit.

[Casey Handmer @CJHandmer]

Just going to preregister here that I believe the computer security overhang is not a few dozen bugs that get patched and then we're good, there are 100,000s of vulns that are extremely discoverable with infinite free tokens and we're probably going to have to move away from systems that presuppose that perfection is possible.

[Casey Handmer @CJHandmer]

@Noahpinion I can address the weak point but you won't enjoy it.

[Casey Handmer @CJHandmer]

@summeroff North Korea's government is largely funded by official state-level fraud, mostly against US entitlement programs (easy extremely juicy target).

Profit margin improves as deniability and action fall in cost by 1000000x.

[Casey Handmer @CJHandmer]

@igypham New bugs are being created by the millions every day.

[Casey Handmer @CJHandmer]

Can't wait until we're funding offshore gain of function research in computer security flaw discoveries...

[Jeff Garzik @jgarzik]

@CJHandmer A different perspective, https://t.co/b5lVv0DZ95

Biological patterns emerge and are instructive.

[Casey Handmer @CJHandmer]

@Pinboard A lot of people fought very hard (correctly, I think) for public key encryption.

[Casey Handmer @CJHandmer]

@armin_ghofrani What are you planning to run it on?

[Casey Handmer @CJHandmer]

Pretty sure that 100% of vulns have been disclosed and we're good now.

[Anzal Abidi @AnzalAbidi]

Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.

Here is the short version of what happened and who got hit.

1. eMudhra (Trusted CA compromise)

eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs.

One of the intermediate CA private keys was literally the number 4.
The other seven: 56, 66, 115, 155, 156, 230, 237.

Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket.

• Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs.
• Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10).
• 10-second check on any server:
curl https://t.co/vhiGLxNhIS
(TLS error = safe. 200 OK = still vulnerable.)

2. PingCAP / TiDB Cloud (10.6 TB breach)

Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents.

Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets.

Who is affected in the leaked records:

• Live credentials exposed in support tickets:
- Pinterest: AWS keys for their pingcap-logs S3 bucket
- CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets
- DeBank: 38 presigned S3 URLs
- An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys)

• Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed:
- Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap
- E-comm & Travel: https://t.co/C512KFOEq5, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook
- Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM
- Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life
- Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase

• Developer profiles leaked (from a purchased https://t.co/28tjHqd5Wr table in PingCAP's BigQuery):
- 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash.

If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket.

3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619)

Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch.

Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c).

Because C-level multipart parsing runs before line 1 of index.php:
• App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it.
• Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1).
• Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.

[Casey Handmer @CJHandmer]

@strategos314 Fog of war.