Daniel Guzmán Burgos

always hanging in there

[Daniel Guzmán Burgos @clickslash]

Cali at night

[Sam Lambert @samlambert]

The TiDB leaks

https://t.co/qhY3dV1RT0

[Herrington Darkholme @hd_nvim]

-----BEGIN RSA PRIVATE KEY-----
4
-----END RSA PRIVATE KEY-----

[Killed by Google @killedbygoogle]

@itsMikeKipruto god I’m tired

[Anzal Abidi @AnzalAbidi]

Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.

Here is the short version of what happened and who got hit.

1. eMudhra (Trusted CA compromise)

eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs.

One of the intermediate CA private keys was literally the number 4.
The other seven: 56, 66, 115, 155, 156, 230, 237.

Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket.

• Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs.
• Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10).
• 10-second check on any server:
curl https://t.co/vhiGLxNhIS
(TLS error = safe. 200 OK = still vulnerable.)

2. PingCAP / TiDB Cloud (10.6 TB breach)

Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents.

Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets.

Who is affected in the leaked records:

• Live credentials exposed in support tickets:
- Pinterest: AWS keys for their pingcap-logs S3 bucket
- CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets
- DeBank: 38 presigned S3 URLs
- An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys)

• Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed:
- Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap
- E-comm & Travel: https://t.co/C512KFOEq5, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook
- Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM
- Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life
- Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase

• Developer profiles leaked (from a purchased https://t.co/28tjHqd5Wr table in PingCAP's BigQuery):
- 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash.

If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket.

3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619)

Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch.

Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c).

Because C-level multipart parsing runs before line 1 of index.php:
• App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it.
• Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1).
• Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.

[himanshu @himanshustwts]

The Prime Minister of Japan is tweeting to apply the PHP fix patch.

WTF.

[Α Ω Programmer @OmegaNekoSimp]

WHAT THE FUCK IS HAPPENING TODAY

[方舟子 @fangshimin]

图灵奖获得者给“飞车”骗子马斯克上了一堂物理课。

[Tim Sweeney @TimSweeneyEpic]

@KenneyNL This is bullshit, Kenney. I’m the same tech tree following optimist who moved from C to C++, from 2D to 3D, and from closed source to open source. I run a company. I write code. I contribute to published papers. I’ve upped my expectations of AI. Up yours!

[EL PAÍS América @elpais_america]

🗳️ #EleccionesBrasil | Trabajadores de Meta admiten, en mensajes internos, que en los últimos días las restricciones han perjudicado las cuentas del actual presidente Lula da Silva, mientras el algoritmo recomendaba el perfil de Flávio Bolsonaro
https://t.co/ns7IOfIGHl

[ernesto @NuevosTrapos64]

la antítesis de Cerati jamás fue el Indio ni los redondos. siempre ha sido Jorge González. mientras los prisioneros eran música para trabajadores y desclasados, soda stereo representaba el glamour, la mercancia y la sofisticación

[Daniel Guzmán Burgos @clickslash]

https://t.co/1YAa8IbOjY

[RoxsRoss @RoxsRoss]

Ayer en #Nerdearla conocí DBTrail de la mano de Daniel Guzmán Burgos 🔥

Open source para auditar cambios en bases de datos, ver el before/after y hasta generar SQL para revertir cambios.

Y sí: tiene integración con MCP 👀

Otro repo directo a mi lista de cosas para probar:
https://t.co/cSEOBfsR41

#OpenSource #DevOps #Databases #MCP

[Valeriy M., PhD, MBA, CQF @predict_addict]

It’s called Fourier transform

[DW Español @dw_espanol]

La CIA trajo a los evangélicos a América Latina.

Los evangélicos llegaron a la región en los años 70. La CIA envió iglesias pentecostales conservadoras para contrarrestar tendencias católicas que consideraba comunistas.

La idea era que los pobres buscaran su salvación personal en lugar de revoluciones sociales. Desde entonces, las diferentes denominaciones evangélicas (bautistas, pentecostales, etc.) han crecido.

En América Central, los evangélicos ya son el grupo religioso más grande, con más de la mitad de la población en países como Costa Rica y Panamá. En donde menos evangélicos hay es en Argentina, Uruguay y México.

Son iglesias que en gran parte se han basado en el televangelismo de los Estados Unidos Han hecho telenovelas basadas en la Biblia, sobre todo en Brasil y actualmente saben sacar provecho de las redes como nadie.

Si te interesa el tema y quieres ver el análisis con expertos, búscanos en nuestro canal de YouTube. /cc #dwcómoteafecta

[Daniel Guzmán Burgos @clickslash]

Using this instead of “lorem ipsum” for placeholder text from now on

[Leo Papa XIV @Pontifex_ln]

Hac intellegentiae artificialis aetate, urgens fit humanam artem ab iis distinguere, quae machinis efficiuntur. Ars enim et ea, quae machina ex innumeris alienis imaginibus statisticae ope computationis generare potest, ontologice, prius etiam quam aesthetice, inter se differunt. Algorithmis humani deest favilla. Quapropter Ecclesia cum artificibus et humani cultus institutis foedus renovare cupit: foedus scilicet ad humanum custodiendum.

[Folha de S.Paulo @folha]

📚⚽ Quando Gustavo Scarpa decidiu falar sobre "A Morte de Ivan Ilitch", de Liev Tolstói, em um vídeo nas redes sociais, não imaginava que a recomendação faria o clássico russo chegar ao primeiro lugar entre os livros mais vendidos da Amazon, 140 anos após ser publicado pela primeira vez. À Folha, o jogador recomendou três livros.

📲 Leia mais na #Folha: https://t.co/nz3KwKl5zS

📝 Victoria Borges

[DB Trail @dbtrail_]

https://t.co/cvOHeL5XmE world tour - September 2026

[Daniel Guzmán Burgos @clickslash]

@frabigol Farmeando Aura Teo

[Daniel Guzmán Burgos @clickslash]

@NoticiasUno @malepichot