Mostly music and tech.
Île Maurice
Joined November 2008
- Tweets36.8K
- Following4.6K
- Followers3K
- Likes10.1K
Pinned Tweet
“We are all driven by an invisible whip. Some run, some have fun, some are hip, some tip, some dip, but we all must answer to the invisible whip.”
— Rahsaan Roland Kirk
The game is the game 🤯
Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit. Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence.
Read more: chainalysis.com/blog/binance…
David Njuki retweeted
By the way, in case anyone was still wondering whether they are completely useless, Binance holds SOC 2 Type 2, ISO 27001, and several other certifications.
Humans remain the “weakest link”
Sources tell WIRED that an Accenture employee’s personal Claude agent ran on a DOD network for two months before it was identified and the vulnerability could be patched. buff.ly/nUjCkPs
David Njuki retweeted
One major bug may be incompetence.
Two? By now we have to assume an actor is actively targeting some machine that uses curl/wget/python/etc and this new "oops" is a means to maintain the target.
eMudhra has been blocking curl/wget/python urllib User-Agent headers from accessing CRLs
bugzilla.mozilla.org/show_bu…
David Njuki retweeted
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
David Njuki retweeted
An examination of global Internet disruptions observed by Cloudflare Radar during the third quarter of 2026. This review analyzes how power failures, natural disasters, and government shutdowns impacted network connectivity and traffic. cfl.re/4zWKUjb
David Njuki retweeted
The discussions shaping Africa’s Internet number resource policies are coming to Cape Town during AFRINIC-38.Join the conversation, and have your say in Africa’s Internet policy development. See the Agenda here>> bit.ly/AFRINIC38-Agenda
@ispa_za
David Njuki retweeted
Today, the calendar makes a right triangle, for the last time this century.
This Saturday is October 24, 2026.
Write it as 10/24/26 or 24/10/26, and the same beautiful relationship appears:
10² + 24² = 26²
100 + 576 = 676
But here’s what makes today special.
There are infinitely many Pythagorean triples. Only a handful fit our calendar.
Using the rule
month² + day² = (last two digits of the year)²,
the month cannot exceed 12, and the day cannot exceed 31. Those small limits leave exactly 12 qualifying dates in this century.
Today is the last.
The next will be March 4, 2105:
3² + 4² = 5²
That is a wait of more than 78 years.
An infinite family of triangles. Just twelve appearances on a century’s calendar.
Happy Pythagorean Triple Day.
David Njuki retweeted
21 years ago I named "Reddit" and everyone said it was a horrible name, but I insisted one day people would say "I read it on reddit" and used my CEO-privilege to overrule everyone + kept the name. Now the company twitter account (unbeknownst to them) is making the joke. Heh.
I knew the name sounded familiar.
eMudhra CA whose private keys from 8 of their Intermediate certs were recently compromised is among the Licensed and Accredited E-CSPs for Kenya's PKI.
ke-cirt.go.ke/licensed-accre…
SMART MARKETPLACE: India’s EMudhra becomes an E-CSP in Kenya to empower Secure Digital Transformation smartcompany.africa/smart-ma… via @SmartCompanyAf1
David Njuki retweeted
[Scheduled] Scheduled security maintenance — temporary unavailability of some non-critical services: 22 Oct 08:00 UTC A critical securit... status.afrinic.net/notices/9…
David Njuki retweeted
An update from Brewster Kahle on today's outage.
ALT Internet Archive ops staff were heroes last night. PHP vulnerability announced, soon saw attacks, isolated the vulnerability, used Claude to make fixes for our older php versions, used local models to run simulated attacks, deployed. reinforced WAF and other guards. Offline briefly, Back on new versions and running! Given the severity, there are heroes in many many orgs from last night. Could have been no lights, no traffic signals, real problems. Heroes. Thank you all.
David Njuki retweeted
Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.
Here is the short version of what happened and who got hit.
1. eMudhra (Trusted CA compromise)
eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs.
One of the intermediate CA private keys was literally the number 4.
The other seven: 56, 66, 115, 155, 156, 230, 237.
Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket.
• Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs.
• Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10).
• 10-second check on any server:
curl dv-g3b-emudhra.we-have-a-pro…
(TLS error = safe. 200 OK = still vulnerable.)
2. PingCAP / TiDB Cloud (10.6 TB breach)
Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents.
Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets.
Who is affected in the leaked records:
• Live credentials exposed in support tickets:
- Pinterest: AWS keys for their pingcap-logs S3 bucket
- CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets
- DeBank: 38 presigned S3 URLs
- An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys)
• Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed:
- Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap
- E-comm & Travel: Booking.com, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook
- Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM
- Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life
- Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase
• Developer profiles leaked (from a purchased reo.dev table in PingCAP's BigQuery):
- 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash.
If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket.
3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619)
Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch.
Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c).
Because C-level multipart parsing runs before line 1 of index.php:
• App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it.
• Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1).
• Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.
David Njuki retweeted
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: teapawt.net/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
