RE: https://infosec.exchange/@dangoodin/117475055779651972
"Courage, Merry... Courage for our friends!" 😩 #hugops
https://getyarn.io/yarn-story/8862717d-b3cc-4d48-be1b-d4e47b9e5ed1
Search
9 results for “dangoodin”
-
-
RE: https://infosec.exchange/@dangoodin/117475055779651972
And security researchers around the world are hammering every intermediate cert they can get their hands on to see if those too are worthless 🤣
-
PHP Warns It Plans to Release 2 Emergency Patches Imminently, by @dangoodin (@arstechnica):
-
Edge users take note: Edge is the only major browser that has yet to block the certs. I asked Microsoft why this was and if it has plans to take action. The response: Microsoft will be in touch to let me know if it has anything to "share."
-
Security personnel around the world are on high alert following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet.
-
#eMudhra FUD : Dan Goodin is right.
"One caveat: exploiting compromised certificates requires an active adversary-in-the-middle attack, meaning the attacker must act as a proxy between two TLS parties and receive encrypted traffic, decrypt it, reencrypt it, and send it to the other party. Such capabilities, in some cases, are usually limited to only the most well-resourced attackers. People with control of a local network—at a coffee shop, university, or other organization—face much less of a challenge."
Apart from that, there are way bigger risks on the internet. Such as people not checking domain names in the browser's address bar, not knowing how to interpret them or not knowing the exact domain name of the intended website. And there are more bigger risks.
-
An unconfirmed report claims PHP2Shell enables RCE on PHP sites; watchTowr says the exploit allegedly affects all versions since PHP 5, released in 2004 (Dan Goodin/Ars Technica)
https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/
http://www.techmeme.com/261021/p2#a261021p2 -
Eight intermediate TLS certificates from eMudhra with private key sizes of just 3 to 8 bits were compromised; browser makers and major apps have blocked them (Dan Goodin/Ars Technica)
https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/
http://www.techmeme.com/261020/p49#a261020p49 -
A few thoughts on generosity, power, and learning to receive from the people we try to help.