Multiple Security Advisories: PHP2shell, node.js and certificate trust This has to be the worst day in internet security since Heartbleed... easydns.com/blog/2026/10/21/…

Leftists want to “protect democracy” but they don’t think any other parties should be elected… so they actually want a leftist dictatorship with no ability to choose anything but leftism… but they see this as “protecting freedom” it’s f*cking insane.

PSA for macOS users: 1. Apple’s supplied SSL certificate bundle at /etc/ssl/cert.pem still trusts certificates attackers can forge using compromised eMudhra keys. 2. I confirmed this on macOS 26.7.1 and 27.0.1 using Apple’s built-in curl and Git. 3. An attacker intercepting connections from tools using this bundle could replace downloads with malware. With commands like curl … | sh, that malware would execute immediately. 4. Removing the roots that authorize those certificates blocks the tested chains. Both OS updates restored roots I’d previously removed, requiring me to remove them again. 4. I’ve submitted the findings to Apple’s security team and am awaiting their response. In the meantime, you can apply a temporary fix as outlined below. 5. To check and fix your machine, give an agent like ChatGPT/Codex or Claude Code the following prompt: “Independently verify whether Apple’s /etc/ssl/cert.pem still permits trust in certificates signed with compromised eMudhra keys. If so, back it up and remove the roots enabling that trust, identified by verified SPKI fingerprints. Confirm Apple’s built-in curl and Git reject those chains while ordinary HTTPS still works. Preserve rollback and never disable TLS verification.” Note that removing these roots can also block legitimate sites. This is a temporary mitigation, not a substitute for a fix from Apple. I’ll share the script I used in a follow-up post if you’d prefer to use that directly.

Don’t open the gates to Conservative cuts, costs and extremists. Tomorrow, every vote counts and I’m asking for yours. Our team will fight every single day for you and your family.

A privacy-first DNS resolver just chose to leave an entire country rather than lie to its users. Quad9 is shutting off its free DNS service in France on November 24, after a French court ordered it to block domains that BeIN Sports claimed were facilitating sports piracy. Quad9 refused. "We categorically refuse to alter or lie to you about the DNS responses you receive in a way that opposes your expectations." The court had actually reduced the fine to just €1,000 per day. Quad9 still walked away. Because the real problem was not the fine. It was the precedent. Complying would mean either applying French copyright law to Quad9's global DNS infrastructure, or using geo-blocking methods that Quad9 considers technically unreliable and ethically compromised. Either way, the integrity of the service breaks. This is what it looks like when a privacy tool takes its mission seriously. Most services would have quietly blocked the domains and moved on. Quad9 chose to exit instead 👏