Sheldon Savio

Staunch Manchester United supporter..

[Vinay Kumar Dokania @VinayDokania]

Now who did that 😂

[Saurav Das @SauravDassss]

Good day to read my magnum opus ‘Performative Justice: The Equivocations of DY Chandrachud’ for The Caravan magazine.

Edited by the brilliant @psen9.

[Live Law @LiveLawIndia]

CJI Chandrachud Used To Seek Government's Pre-Approval Before Collegium Discussed Names For Judicial Appointments : Justice Kaul

Justice Kaul said CJI Chandrachud was too deferential to the Government in appointment matters.

https://t.co/lF646mgikZ

[Surya Yadav @suryaupse]

Why is no one talking about Arunachal Pradesh?

[(fan) Frank 🧠🇾🇪 @FrankEra_]

The only reason Jason Wilcox doesn’t want Julian Nagelsmann is because he knows it could put Christopher Vivell above him in the pecking order.

It’s all about protecting his own position. Nagelsmann and Vivell are close, and Wilcox knows that if Nagelsmann gets the job, he’ll want Vivell as his closest ally behind the scenes.

[Jay-Wahn @_ReallyJaewon]

LMFAO

[FBI @FBI]

The FBI continues to warn about two critical security flaws in PHP, a programming language used to build many websites and online services. Attackers could exploit these vulnerabilities to break into systems, putting sensitive information and business operations at risk. Security updates are available and should be applied immediately.

If you are a business owner or website operator, check whether your systems are affected. Contact your IT support team, website developer, or hosting provider for help identifying vulnerable systems and applying the necessary updates.

The FBI urges organizations to take the following steps now:

➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.

➡️ Immediately update affected PHP installations following the guidance on https://t.co/JFOW6jG9Ws. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.

➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.

➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or https://t.co/ZWC7Se2YdU. Those reports help us identify the actors involved and warn other organizations before they become victims.

For the latest information on these vulnerabilities (CVE-2026-109618 and CVE-2026-109619), follow PHP’s announcements on https://t.co/JFOW6jG9Ws, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

[utdreport @utdreport]

Michael Carrick looks absolutely broken as he begins his press conference with a statement before taking questions.

[Matthew Prince 🌥 @eastdakota]

Two classes extremely bad cyber vulnerabilities disclosed in the last 24 hours. The first potentially impacts everyone online. The second impacts nearly everyone running a server.

tl;dr: Everyone should upgrade their OS and Browser as soon as possible. If you run a server you should upgrade PHP (or ensure it’s removed if you’re not using it) as soon as possible.

The first class of vulnerabilities is a set of root TLS certificates that were discovered to have a trivial private key. Literally the number 4. These roots were controlled by #eMudhra. The problem is that with that an attacker could create a certificate and, if they could get in the traffic flow, intercept traffic to any site or service. The solution is to stop trusting certificates issued by these vulnerable roots. Upgrading your browser and OS is the fastest way for most Internet users to do this.

The second class of vulnerabilities doesn’t apply to most consumers directly, but does apply to most anyone running a server. These vulnerabilities have been dubbed #php2shell. PHP is one of the most widely used web programming languages. It’s estimated 70% of websites run on PHP. These vulnerabilities allow an attacker to send a crafted set of queries to a server running PHP and potentially take over the server. From there they could potentially read, modify, delete, or repurpose anything on the server. The solution is to upgrade PHP to the latest version ASAP. Even if you’re not using PHP for your web development, it’s often included by default. So make sure it is either upgraded or fully removed.

@Cloudflare received advanced warning of both of these classes of vulnerabilities. We’ve ensured that where we act as a proxy we are no longer trusting the vulnerable roots. We are also reviewing certificate transparency (CT) logs for any sign the vulnerability was exploited before its disclosure. We have not found any evidence but CT logs are not perfect and a sophisticated attacker who knew about the weakness could have exploited it without a new certificate being logged.

For the PHP vulnerabilities, we have deployed mitigations available for all customers for free. Because of the complexity of the vulnerabilities and number of ways it can be exploited, we also released new WAF capabilities that are unique in the industry to catch the exploit based on the response. These too are available for every Cloudflare customer for free.

Even if you are taking advantage of Cloudflare’s protection, it is important to upgrade your OS, browsers, and PHP installations as soon as possible. We can provide a strong bandaid, but the best protection is to fix the underlying problem.

If you’re interested in learning more, you can read our blogs:

Vulnerable roots: https://t.co/TR77Zd01A0
PHP vulnerabilities: https://t.co/qTUK8i3Oww

[Dan @BigMeatie]

Carrick came in, got the players to buy in, did a great job.

Players got convinced to stick around that may have been looking to leave as they got assurances that the club would back the manager and invest in the summer.

Window ends with net 1 extra midfielder and Rashford who doesnt want to be there.

Big personalities and leaders feel like theyve been misled, manager feels like he's been let down, and the energy around the club falls off.

Its not rocket science. Carrick may not be the solution, but he's not the problem.

Rotten.

[Chiké @chike_ijezie]

Hire Ashworth, a well respected tier 1 DoF after a 5-month gardening leave. You sacked him a few weeks later following rows over Utd's football strategy and cos he opposed sacking TenHag and hiring Amorim.

You keep TenHag only to sack hin a few months later to make way for Amorim, a manager with an entirely different game model requiring huge squad changes, changes you were unwilling to make.

You sack Amorim after he calls you guys out and replace him with a tactically weak, rookie championship manager who doesn't get backed enough.

The guys who made all these calls need to leave with Carrick after the loss vs Bournemouth on Sunday

[Andy Mitten @AndyMitten]

I’m sick of United being everybody else’s punchbag, sick of our name justifying even greater elation when rivals beat the club I love. How the mighty have fallen. And that performance was an affront to the name of Manchester United.
For @TheAthleticFC

https://t.co/RY6RPXKe6L

[Anirudh Jwala @nirudhuuu]

Today we are in a security nightmare:

- Railway may have exposed customer environment variables and API keys
- SBI confirmed that customer records ended up on the dark web
- eMudhra's certificate keys were extremely weak (one was literally just the number 4)
- LiteLLM shipped a compromised version that steals credentials and includes a backdoor
- PHP released two critical remote code execution vulnerabilities (PHP2Shell)
- Node.js issued urgent security patches for a Brotli decoder remote code execution flaw, plus TLS and DNS issues and blocked the compromised eMudhra certificates
- Rajasthan gov systems were allegedly linked to the exposure of a large set of identity records
- OpenCode confirmed a breach that exposed AI provider API keys (OpenAI, Anthropic, Google) for a portion of Console users
- Plex Media Server vulnerabilities (Plex2Shell) are being actively exploited in the wild to install malware on unpatched servers
- GitLab fixed a critical CVSS 10.0 unauthenticated remote code execution flaw in its CI/CD regex compiler

[Muzzammil @DevMuzzammil]

We can call it Black October for the security breaches:

Oct 21:

• PHP2Shell
• Railway
• Node.js
• LiteLLM
• GitLab
• SBI
• eMudhra

Oct 20:

• Plex2Shell
• SiteGuard
• Siemens

Oct 19:

• OVHcloud CLI

Oct 17:

• Opencode

[The Hacker News @TheHackersNews]

🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.

CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.

Read - https://t.co/frrfCwYlgp

[Andy Mitten @AndyMitten]

This is an affront to the name of Manchester United.

[UnitedMuppetiers @Muppetiers]

Everyone calling each other out in the post match. What an absolute disaster.

[Sheldon Savio @sheldonsavio000]

They are walking when 3-0 down
Pathetic, an absolute disgrace

[International Cyber Digest @IntCyberDigest]

The day the internet broke, and most of it is too old to fix.

[Sandeep Manudhane @sandeep_PT]

She will forever be etched in Indian history as a stark symbol of the darkness that was 'New India'. https://t.co/UvdAnYIYPK