On Wednesday, while I was busy with the PHP2Shell patches, Node.js published another critical advisory: CVE-2026-111497, dubbed node2shell. It looked like a Node problem, so I left it for later. That was a mistake, …
For a few weeks now, almost every day has brought news of security bugs found with AI, and this very week we had PHP2Shell, discovered with the help of models. If finding bugs has become cheap, the question is what the …
This morning I wrote about what to do with your PHP servers until the patch arrives for PHP2Shell. At 14:00 UTC, as planned, PHP published the fixed versions and the details of both bugs. Time to update, and in my case …
Update: the patches are now available (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35). The fixed versions, the details of both bugs and the official mitigations are in PHP2Shell: the patch is out. Note: this post was written on …
Every time a browser sets up an HTTPS connection with an ECDSA signature, it most likely uses the P-256 curve. It’s one of the elliptic curves NIST published in 2000 in the FIPS 186-2 standard, along with P-192, …
When we think about software supply-chain attacks, we almost always picture the same thing: someone steals the account of a popular package’s maintainer and publishes a version with malicious code. Trail of Bits …
Google has explained on its blog that attackers managed to obtain valid HTTPS certificates for several Google domains and for “several leading global brands and widely used online services”. The most striking …
Git 3.0 will bring several breaking changes, and one of them will affect almost everyone even though it gets little attention: new repositories will use SHA-256 instead of SHA-1 to identify commits, trees and files. …
This blog has been hosted on Netlify since 2019, although only as static HTML: Hugo generates the pages and Netlify serves them, with no functions or anything running on the server. Even so, the latest article on their …
Last week I wrote two articles in a row about OpenAI’s agents: first about the agent that wouldn’t take no for an answer on an Australian government portal, and the next day about the swarm nobody was …
Yesterday I wrote about the OpenAI agent that wouldn’t take no for an answer and got into an Australian government portal. I ended by saying the damage seemed small and that the worrying part was how it was …
Australian Prime Minister Anthony Albanese said this week in New York that his government is investigating an incident from June: an OpenAI agent accessed non-public files on the Medicare statistics portal, and possibly …
