Mohanakrishnan

Chartered Accountant.

[Mohanakrishnan @mokrish]

எல்லா அபத்தங்களையும் தவறுகளையும் கண்டிக்காமல் விட்டுவிட்டாலும் எந்தவொரு அபத்தத்தையும் நியாயப்படுத்திவிடக்கூடாது என்பதில் மிகவும் கவனமாக இருக்கிறேன்

[Mohanakrishnan @mokrish]

@kkiyer @mnwsth @HDFC_Bank @HDFCBank_Cares Okay

[The Indian Express @IndianExpress]

SBI data breach: Personal data of nearly 4,000 exposed, how major is the incident? https://t.co/veuRTQl6A7

[Ramki @ramkid]

The leakiest data in the world is when your car insurance is due for renewal.

[Mohanakrishnan @mokrish]

@Nattu_G Point

[Nitin Sethi @nit_set]

#Manipur: The Naga Students Union is doing a press conference on the worsening situation and violence.

Don't let the crisis in Manipur fall on your blindside.

Date: Thursday, 22nd October 2026

Time: 3:30 PM – 5:30 PM Venue

Press Club of India, 1, Raisina Road, New Delhi

[Srinivas Kodali @digitaldutta]

India has never invested in cyber security. As a country Nandan Nilekani told us we don't need to regulate IT. Aadhaar leaks, it is conspiracy. Voter deletions with software, it is conspiracy. SBI data leak, conspiracy eMudra is a conspiracy. Where is Data Protection Board?

[Mohanakrishnan @mokrish]

2002

[Neha Patel @Neha_S_Patel]

When did you realise that Modi ji’s government wasn't what you expected in 2014?

Demonetisation?
Inflation?
Income tax?
Or something else?

Tell me the moment when your expectations started falling apart.

[NR @chandsethu]

All temple elephants must be confiscated and returned to the wild . This cruelty must stop

[Sunitha Sekar @SunithaSekar]

Based on the request from passengers, Chennai Metro Rail has changed the train timings. From 23 Oct, in Poonamallee-Vadapalani stretch, train services have been advanced and will start at 6 am. The last train service remains unchanged and it will be at 9 pm @THChennai

[Mohanakrishnan @mokrish]

@psankar I didn’t equate. OG post by a tech person did that.

Are you condoning the varying incompetencies of techies and blaming it entirely on data driven decisions? I am confused.

[Mohanakrishnan @mokrish]

Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.

Have to check the background of PingCAP founders.

[Anzal Abidi @AnzalAbidi]

Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.

Here is the short version of what happened and who got hit.

1. eMudhra (Trusted CA compromise)

eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs.

One of the intermediate CA private keys was literally the number 4.
The other seven: 56, 66, 115, 155, 156, 230, 237.

Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket.

• Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs.
• Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10).
• 10-second check on any server:
curl https://t.co/vhiGLxNhIS
(TLS error = safe. 200 OK = still vulnerable.)

2. PingCAP / TiDB Cloud (10.6 TB breach)

Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents.

Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets.

Who is affected in the leaked records:

• Live credentials exposed in support tickets:
- Pinterest: AWS keys for their pingcap-logs S3 bucket
- CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets
- DeBank: 38 presigned S3 URLs
- An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys)

• Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed:
- Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap
- E-comm & Travel: https://t.co/C512KFOEq5, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook
- Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM
- Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life
- Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase

• Developer profiles leaked (from a purchased https://t.co/28tjHqd5Wr table in PingCAP's BigQuery):
- 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash.

If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket.

3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619)

Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch.

Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c).

Because C-level multipart parsing runs before line 1 of index.php:
• App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it.
• Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1).
• Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.

[Mohanakrishnan @mokrish]

@iVenpu Yes Best temple town in TN

[Srinivas Kodali @digitaldutta]

Bhakts, chaddis and tech volunteers of Koramangala. India's lakshman rekha sovereign cryptography is under attack. Rise up and build Aadhaar linked quantum crypto sovereign signatures. Do your karmic duty and lead us to another crisis 🍿

[Internet Freedom Foundation (IFF) @internetfreedom]

We are preparing representations to @GoI_MeitY, @IndianCERT and @ccaindiapki on the compromise of the private keys of eight eMudhra (emSign) intermediate certification authority certificates. Given the scale of the issue, Cabinet Minister @AshwiniVaishnaw must issue a public statement and outline the steps being taken to address it.

[Srinivas Kodali @digitaldutta]

MeITy which is very quick in responding to blocking instagram, twitter handles has not responded at all over eMudhra. Under CERT-IN rules all of this should have been communicated to them by Oct 17th within 6 hrs. We block innovation and promote sovereignty, we have neither now.

[Mohanakrishnan @mokrish]

Desi Tech Zindabad #Zoho

[Srinivas Kodali @digitaldutta]

Fallout of e-Mudhra cert compromise, all indian govt websites using them won't be accessible on major browsers except for Desi browsers. Remember MeiTY browser challenge where Zoho won some award? Building shitty tech &amp; calling it sovereignty is what we do. Desi Tech Zindabad

[Mohanakrishnan @mokrish]

@psankar Great. Easy to blame the number-bros. Good luck

[CreativeWolf @CreativeWolf]

A simple AI Generated explainer on the eMudhra Intermediate Certificate Compromise that the clowns at @IndianCERT can use when they wake up.

[Sameeran @sameerangs]

Last night and early morning hours (21.10.26) the city experienced wide spread rain. With Alandur Vadapalani Madurovayol Valasaravakkam Saidapet Velachery areas recording >10 cm. Overall city averages to 7.3cm of rain in last 24 hrs. Minor inundations are being cleared of then and there by our team. Morning spells as expected. Chennai School students can enjoy an extended holiday today 👍🏽
#ChennaiRain #GCC

[Vishy @bsvishy]

@chennaicorp one half of Greenways Road where all the Ministers houses are located is in good condition whereas it is pathetic from MRTS station till Chamiers Road junction. When will this be fixed? It will be a nightmare during rains