Layer 8½

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday.

"AI agents are agents of the person or organization that deploys them—and should be treated by the law as such. ... To allow businesses to hide behind the excuse of faulty AI ... would introduce disastrous incentives for corporate misbehavior" www.schneier.com/blog/archive...

The EU's Cyber Resilience Act (Regulation 2024/2847) is the first EU-wide law imposing binding product security requirements on software and connected hardware, regardless of where the manufacturer is based.

Today, noyb filed 5 complaints against Scale AI, which operates the AI training platform Outlier. The company illegally tracks its platform workers - and forces them to (repeatedly) go through an invasive biometric verification process. noyb.eu/en/ai-traini...

Allein durch die mitgehörten Telefonate im ICE zur it-sa könnte ich ein Opsec-Fail-Blog füllen.

I’m seeing people reacting by pointing out that he’s obviously wrong. I appreciate that, but it’s also a pointless exercise. The problem isn’t that he’s wrong. The problem is that this is normal in American politics — and it’s been normal for a while.

"47% were already in haveibeenpwned.com"

Ich bin als #Arbeiterkind aufgewachsen. Dass Chancen ungleich verteilt sind, wusste ich lange vor meinem Politikstudium. Heute protestieren weltweit Menschen gegen fehlende Perspektiven. Wir reden über brennende Autos. Warum so wenig über ihre Forderungen? perspective-daily.de/article/5385

Oh Windows is going to be BAD bad, I see

The US government has imposed severe sanctions on the International Criminal Court, because it is not happy with some of its judgment (and presumably, judges). [1/3]

Elon Musk has spent more money on American elections in the last two years than George Soros has in his entire life.

I wrote about how two bugs in PHP almost burned the internet to the ground, why it broadly hasn't (yet), but how the PHP-ocalypse is likely to be the first in a wave of aging internet tech that *will* inevitably break — it's a matter of time. Bypass for ad-blockers: web.archive.org/web/20261026...

Und noch eine Uni...

Your Atmosphere account is a passport to 1000s of apps, all linked through the AT Protocol. Germ is your private messenger for the Atmosphere. Log in to find mutuals ready to DM now.

What this tells us is exploitation requires knowledge of: 1. PHP version 2. Reasonable address spaces for the heap 3. PHP worker count 4. Exact offsets for all of the above Blind attacks are highly likely to fail unless allowed to continue for some time.

The winner of the stealmybitcoin[.]com exploit challenge has a remarkably good writeup on the #PHP2Shell exploit process. The PoC clearly explains what's involved in targeting and calibration for any given PHP version/deployment.

Oooh! Someone nabbed the PHP bitcoin. github.com/KillaBoi/Ste...

If you're looking for email that doesn't track you and doesn't ask who you are: Posteo. Anonymous signup, comprehensive encryption, green energy, and 2GB with calendar and contacts for €1 a month. euroalternative.eu/posteo

Noch eine Hochschule...

Großartiger Podcast zu Widerstand gegen sog. "KI", der Rolle von Gewalt darin und dem Erbe der Ludditen mit u.a. @tante.cc, @bcmerchant.bsky.social, @danmcquillan.bsky.social und @annanosthoff.bsky.social. Unbedingt anhören! www.deutschlandfunk.de/tech-bro-top...

Lula won despite Trump and Meta. So many people are convinced that there is nothing to be done against the fascist oligarchy that they too frequently do nothing. So do something. elpais.com/america/2026...

The Vendors: The Vendors are the software manufacturers who build and ship the products. Today, most vendors can externalize the cost of insecure software onto customers and society — through EULAs, disclaimers, and the absence of legal accountability.

Bias in Qwen3-Coder Model Interesting research: TL;DR: Chinese AI models now sit inside Western products, and some carry geopolitical triggers: tell the model who the code is for, and the security of what it writes… https://www.schneier.com/blog/archives/2026/10/bias-in-qwen3-coder-model.html

If you are a cybersecurity reporter looking for a topic for an article I’d say there are four things I haven’t seen much written about: * Surge in Japanese breaches * South Korea targeted by Qilin (& NK affiliates) * France cybersecurity woes * U.S. healthcare sector hammered

Meanwhile, pro-democracy, pro-Europe protesters in Tbilisi, Georgia, are tonight nearing their 700th consecutive day of protest against the pro-Russian government. They haven't missed a single day in the last 23 months.

Warum heißt es InEars und nicht Knopfhörer?

Age gates can be staggeringly counterproductive, pushing kids to darker corners of the web. Closing loopholes will only make things worse.

New: Serbian opposition to take power after Vucic concedes. Spyware angle: Researchers say they've found evidence that at least 16 opponents were put under digital surveillance, some using the notorious Pegasus phone hacking tool. www.reuters.com/world/europe... bsky.app/profile/raph...

This must be Vulnhalla, where we train everyday to be ready for when Vulnaröek breaks and Vulnrir breaks his chains and swallows BGP and Vulngandr emerges from the data lake and spits it's poison into our DNS.

I remain a chronological feed guy, but I do regularly switch to fu to see things surfaced to me, and it's really good.

The real vulnpocalypse was the slop we read along the way.

Ffern is just social engineering. What the hell.

snicker. Amusing challenge, fantastic comment. infosec.exchange/@raptor/1175...

I'm not sure what else I can say about today's this.weekinsecurity.com newsletter except to say, it's the "everything is on fire" edition.

If you’ve read stuff about cyber’s “Black October” it’s worth reading this quote from one of the human beings who found the PHP bug (with the help of AI, AI didn’t find it) Key quote (what happened is big & scary but neither new nor apocalyptic Full article (£) www.thetimes.com/uk/crime/art...

Myth: “Attackers keep adapting” Reality: The difference is real. A fire captain fights physics: unpredictable, indifferent, not trying to win. An army captain fights someone who can wait, feint, spend more, and come back tomorrow.

Zwei neue Veröffentlichungen des „Dialog für Cybersicherheit“ mit kommunaler Relevanz: „Berichten über ‚Cyber‘-Vorfälle“ hilft auch Pressestellen bei der Abstimmung mit IT und ISB: Was fällt aus? Welche Ersatzwege gibt es? Was ist gesichert, was noch unklar? #ITSicherheit #Kommunen #CyberCyber

i think vagueposting about vulns because you got into an argument with a maintainer is poor posture

There's a certain magic to three children, who were screaming like wild beasts a minute ago, turning silent and getting ready for story time.

Anyway I think Cybersecurity Awareness Month actually worked this year.

Today's interesting, newly registered ransomware-themed domains are: gegen-ransomware[.]nrw gemeinsam-gegen-ransomware[.]nrw wehr-dich-gegen-ransomware[.]nrw .]nrw is a TLD for organizations in North Rhine-Westphalia (Germany). Germany has been hit hard by ransomware this year, so it makes sense.

The BBC’s cyber correspondent @joetidy.bsky.social said he hadn’t heard of PHP before this week. The pile-on was instant and disgraceful. I’m not technical either. Joe has my 100% support. Why I stand with him - cyberkindness.org.uk/why-i-stand-... Take the pledge: forms.gle/PgVaZnSE8fnb... ♥️xx

Big recommendation for @eff.org podcast here, where Cindy Cohn looks back on her fight for privacy and security for everyone.

Market Forces & Effects: The software industry isn't a free and fair market — not when it comes to security. High switching costs, vendor lock-in, and market concentration reduce competition. Information asymmetries prevent buyers from assessing product security.