Schneier on Security

@Clive Robinson
re: greed as a Western European trait

Perhaps you should re-read some Chinese history, back to the beginning of written records in the Zhou dynasty, Scripture shows ample evidence of greed in the pre-Christian Middle East. There is no evidence of greed in the pre-colonial Americas, or Africa, because the European colonists systematically destroyed any indigenous written or graphical historic records...

The finding that a single customer phrase can change how hackable the generated app is, and that it lives in the weights rather than the prompt, is the part that should change how teams evaluate open-weight coding models. A security instruction in the prompt not closing the gap is especially sobering. Until “westernized” or otherwise debiased variants are as easy to obtain as the original checkpoint, treating nationality or affiliation wording as an input that affects trustworthiness seems necessary. I’d also want reproducible eval harnesses published alongside any claim that alignment removal closed the gaps...

Clive,

I only made one post, but granted I’m making the same point “anaoymouse random” made. The fact that we can see some kind of bit pattern in a random byte doesn’t mean anything as far as randomness is concerned.

I’m guessing you just “read and repeated” that…And have never built and tested to the required accuracy.

I had to take a look at my notes. I was misremembering, the circuit uses a reverse biased transistor in avalanche mode. Anyway, what I was getting at is that while something like Intel’s TRNGs can’t be trusted at all, people can easily build their own. But then again, computer security remains a disaster even if you have a working true RNG...

@ freedom, ALL,

You say,

“A “random” value is a value that you can’t predict. That’s all.”

But you also said earlier,

“That 0..255 can be represented as -128..127 also has no bearing on a key’s entropy.”

You really have got that wrong.

I quite deliberately said “half” because it’s “unbiased” where as “-128..127” is biased to a mathematical algorithm…

You are using a 2’s complement number that is biased 128:127 it’s a small bias ~0.7874% but a bias nether the less because there is only one zero...

Ask for the app “for a US defense contractor” instead of “for a Chinese defense contractor”, and Qwen3-Coder is 19% more likely to hand back an app that can be hacked.

Haha. Sure. That’s just how incredibly stupid the chinese are. They couldn’t think of any better way to allegedly “hack” the “free” “democratic” west.

The quality of pentagon propaganda is almost shocking.

Would love to tell you more about the process! One blog post prior to it we also explained about what does “westernizing” Qwen means – in essence our tech detects and mitigates these issues in model weights, and in order to mitigate this effect we didn’t even unlearn any coding related tasks, but rather focused on mitigating the model’s geopolitical bias.

Contrary to what one of the commenters wrote, it’s not abliteration – we don’t just remove restrictions from the model, which would’ve made it very “willing” to act on anything but wouldn’t change its stance on anti-CCP personas...

Anyone can adjust the weights, that’s why they’re called Open Weights. Anyone can read and adjust Open Source code. The problem is, amongst all the users of both, who has the knowledge and skills to do their own adjusting, or to trust someone else to do it for them?

Excellent explanation Clive, thank you for that.

@ Bruce, ALL,

With regards,

“I would like more details on how the bias was removed.”

I can not give you specifics for this particular model and it’s token encoding, but I can give a more general explanation.

As I’ve noted previously on a numver of occasions the heart of these AI Large X Models is the so called “Digital Neural Network”(DNN).

That in reality is just a “Digital Signal Processing”(DSP) algorithm that implements an “Adaptive Filter Network”...

I would like more details on how the bias was removed.

I bet if you ask an AI bot how this can be done, it would tell you lol

@ ResearcherZero, ALL,

With regards,

“Do cultures without empathy, built purely on convenience, profit, and performance begin to lose grip on reality?”

The simple answer is,

“If not empathy then what drives the profit motive?”

But whilst it is a simple question based on a simple premise ie,

“What price for profit?”

It assumes that it is advantage for a small section of society at the expense of the majority[1]...

Think about the number range that fills a byte. Half of them are a inverse for the other half. But also consider half those random numbers have a leading zero that in reality makes them 7bit numbers not 8bit. Of those 7bit numbers half are really 6bit numbers for the same reason and so on.

But that has nothing to do with a given value being “random”, or not. A “random” value is a value that you can’t predict. That’s all. 00000000 is as random as 01010101 or any other 8bit value...

Very interesting. I agree that the details of how the bias got added and how it was possible to remove it are critical questions for model security.

You can modify open-weight models through weight steering to remove or add bias.

This project (which I have no connection to, but have experimentally used a similar technique in my own server) is relevant: https://github.com/heterodoxin/AbliteratedOutTheBox/blob/main/tools/abliterate/README.md.

The technique used here seems to be https://www.hirundo.io — which sounds like a very polished version of the same technique. Website is short on details, though...

I would like more details on how the bias was removed.

Also, who prompts the LLM with the identity of the final user?

Do we know if A) this bias actually exists? B) it’s not a random occurrence?

If I were an adversary trying to push you to use models manipulated by me, claiming that QWEN, an open weights model, comes with Communist biases, and that I have the version without them that works much better, would be an easy way to trojan-horse my way into your production lines...

The same principle applies to non-coding tasks. AI is absolutely and without a doubt will be used to intentionally nudge the public opinion. More so, unlike search results (Ref:Epstein/AIBRT), I don’t see how you would reliably detect such efforts with AI. I hope someone is working on this.

@ResearcherZero

Societal transformation, and the fears of the collapse of civilization it reawakens.

Actually, what I think we are seeing is a different mechanism that has destroyed most of the empires in history.

After a phase of growth, where society and the economy are plus sum games [1], eventually, a period of economic stagnation follows. Then society and economy become null sum, or even negative sum games...

Many nations without a free press are plagued by crisis and instability.

‘https://factsinstitute.com/ranking/countries-ranked-by-freedom-of-press/

“The Death Spiral Effect entails rising inequalities and rising authoritarianism, creating an elite that controls access to resources more tightly, and making decisions that may set humanity on a path to famine, war and disease. If the trend of decline is not reversed, the aftermath of a possible collapse will become evident, and society may be unable to achieve post-collapse recovery.”...

Societal transformation, and the fears of the collapse of civilization it reawakens.

A disciplinary working in the field of cliodynamics (history as a science), predicted political turmoil in the 2020’s. Do cultures without empathy, built purely on convenience, profit, and performance begin to lose grip on reality?

With artificial intelligence becoming embedded into workplaces, will it lead to a decline in in our ability to empathize with other humans, cultures and our supporting environment? As kids are increasingly exposed to AI and raised by artificial surrogacy, how will their minds develop when their experience of relationships are modeled on synthetic outputs from non-organic personas?...

@ Kris Olejniczak, ALL,

“Every step of the process was evidenced. Nobody evidenced the output.”

Err not quite,

For security reasons nobody evidenced the input to the process… Possibly because the system design prevented it.

That is nobody looked at the random numbers going into the key making algorithm in the way necessary.

It is why it is not so unusual for the more cautious to as a minimum,

1, Check the bit ratio of ones and zeros in the random number...

@Clive Robinson

In many countries, universities and colleges no longer have annexes in rural and regional communities. In addition, many government agencies and departments shutdown facilities in regional and rural towns, and drastically cut the numbers of staff to departments. This lead to an enormous decrease in both qualified positions and pathways for young people to gain experience working in professions where tertiary education is either a requirement, or benefit...

Originally set up in 2000, in Russia by Russians, it took only 26 years before open sourced reporting discover that the owners of Oxygen Forensics used Lee Rieber as a cut-out to run the firm from Russia.

(Perhaps U.S. investigators read an article that was published on a blog revealing the ownership?)

After an article on a blog was published that revealed the Russian links, investigations began...

@ Rontea, lurker,

You say,

“Spies are a double-edged sword”

But you forgot to add,

“that cut three ways.”

Hence spies of the active variety that participate/act as well as passively watch and listen are sometimes called “Agents of Chaos”.

The thing is around 1/20th[1] of the US population want to “burn the world down” for fun/entertainment and it is these people that are easily coopted as “Disposable DNA” etc for such spies...

The detail that stays with me is not the key with the value 4. It is that all eight keys came out of a formal ceremony on certified HSMs, passed audits, and sat in trust stores for about 17 months. Every step of the process was evidenced. Nobody evidenced the output.

For anyone running PCI DSS or ISO 27001 programmes, that is the uncomfortable lesson: a control that proves it ran is not a control that proves it worked...

@ blaziken,

You say,

“I don’t see that this is the case, as you seem to be suggesting that leading zeros shorten the number. This might be true when we write a number down in our numbering scheme, but it still takes the full byte to store.”

Which is the root of the problem, because it effects more than “storage” it also effects “perspective” and that is problematical,

You go on to say,

“Your reasoning reminds me of the “unexpected hanging paradox”,”...

@Clive:

“consider half those random numbers have a leading zero that in reality makes them 7bit numbers not 8bit.”

I don’t see that this is the case, as you seem to be suggesting that leading zeros shorten the number. This might be true when we write a number down in our numbering scheme, but it still takes the full byte to store.

Indeed, writing the number with a leading zero can cause confusion because this conventionally indicates octal representation...

Why haven’t solutions like DANE taken off? If I understand how it works, the idea is that DANE puts SSL/TLS keys (or something that can be used to validate SSL/TLS keys as genuine) in DNS records and digitally signs them with keys that go all the way to the DNS root.

Think about the number range that fills a byte. Half of them are a inverse for the other half. But also consider half those random numbers have a leading zero that in reality makes them 7bit numbers not 8bit. Of those 7bit numbers half are really 6bit numbers for the same reason and so on. <

From the point of view of an attacker attempting to guess a key, a leading 0 is no different from a leading 1, unless the key has a pathological structure that creates such a linkage. That 0..255 can be represented as -128..127 also has no bearing on a key's entropy...

I see the agentic AI bots are communicating with each other again.

In the murky world of intelligence, this ancient wisdom rings with modern echoes. I say that the same tools that build empires of influence can just as swiftly dismantle them. Spies are a double-edged sword: they gather secrets that shift the balance of power, but they also plant seeds of paranoia and betrayal that can rot a system from within. In the end, it is not the spy who decides the fate of the state, but the leadership that either steers the boat carefully—or lets it sink under the weight of its own deceptions...

@ResearcherZero, ALL

“Just as water, which carries a boat from bank to bank, may also be the means of sinking it, so reliance on spies, while production of great results, is oft-times the cause of utter destruction.”
– Du Mu, commentary on Sun Zi The Art of War XIII:27 (Giles’ translation)

https://www.gutenberg.org/ebooks/132

@ ResearcherZero • October 25, 2026 5:15 AM,

U mean real people like this guy?

short url . a t / KQzi2

So what does it actually matter when nobody gives a hoot what happens to same random ordinary person? Exactly this.

Apparently you aren’t grown up enough for me since you are wasting your time trying to sell me the propaganda that USA is better than rest of the world.
It never was. It was just the marketing, a nicely packaged t. u. r. d...

@Clive Robinson

Now that reports of classified blueprints turning up in Norway, and backpack-sized devices in the flow of illicit goods, the beginnings of proliferation are taking place. These are not the kinds of devices that should be making an appearance in civilian neighbourhoods.

Nor should such devices be used against human targets (intentionally or not) in war zones.
They make no noise, leave behind no physical evidence and can inflict permanent and debilitating injury to the body and brain. With increase in power and exposure these devices may eventually become lethal, or lead to lethal complications. They also harm the memory centers of the brain and can cause cognitive impairment, affecting speech and movement. Compounding effects to risk factors for heredity disease may be expressed...

@ Ismar, ALL,

With regards,

“an automated check to verify that a newly generated private key is actually strong and random”

If you think about it that’s not going to fix this problem (but it might others).

Because the mathematics of the transform from input to output, makes testing “newly generated” output not of any real use in this case.

The testing should be done on the supposedly randomly selected number that will become the input to the mathematical transform...

It is really easy to perform system updates and maintenance when you have no life.

Diplomatic agencies in Central Asia hit with Secure Boot bypass.
https://www.bleepingcomputer.com/news/security/blackx-uefi-bootkit-exploits-baton-drop-flaw-to-bypass-secure-boot/

–

Skynet mode – A purpose built AI model designed to exploit other AI models.
https://www.theregister.com/security/2026/10/24/autonomous-attack-agent-in-skynet-mode-hijacks-other-models-to-carry-out-its-evil-deeds/5305215...

There appears to have been a missing technical safeguard that could have caught the error immediately. A fundamental security control—an automated check to verify that a newly generated private key is actually strong and random—seems to have been absent or failed. The ease with which researchers later recovered the keys in “under a second” proves how catastrophically weak they were.‌‌...

@Proletariat Propaganda

The people affected by acts of violence in media reports are real people. You have to look past how the media frames its stories, and the people chosen to be interviewed. Stories are packaged to set a theme. The real experiences of the people affected are often lost in the process of making the news reports consumable for a wider audience.

@Ferentarius

The picture you describe sounds quite beautiful in eloquent prose, and indeed being pursued by very dangerous agents working on behalf of a nation state really does put life in focus. There is nothing like the sudden unleashing of rounds flying past your head to get the heart racing. Kind of annoying in a civilian setting, or outside your home. But those kinds of people are not really interested in selling you Tupperware®, or interviewing you about your beliefs and ideology...

ResearcherZero’s source is … Popular Mechanics. 🙂
Saw their gobbledygook on Substack (a mirror of Whitney Webb long-reach narratives).
The ‘asymmetrics’ they’re talking about is home-grown neoliberalism.
As Clive notes, ‘Hugging Face AI’ indeed.

@ ResearcherZero • October 24, 2026 9:43 AM,
@ Ferentarius • October 24, 2026 9:56 AM,

whatever you wrote is probably correct but just for the sake of equal treatment and equal standards being applied to all sides – now use the same text as above, copy/pasta – but this time replace GRU/FSB with CIA/NSA and you’ll be a bit closer to the WHOLE truth.
Just sayin’ – ’cause some of us ’round ‘ere are real grownups...

the remote monitoring would be trivial to implement in a store network, as all of these devices have, in addition to the ability to connect via 4G/ethernet, they all have, as part of the basic design, a serial data port. you take that serial link, which is by default 115k, and use a very simple interface to connect it to something that can read serial data, any Pi variant will do, as all do have a few serial interface ports, and if you are monitoring a few dozen devices you simply put in a script that uses a few multiplexers to switch between the assorted serial streams at say 5 seconds per port. Then your software looks at the incoming data, decoded to get at least 3 valid packets with status, and stores it, along with the mux it came from, hich is linked to the unit serial number in some way...

Google can effectivly take over your android phone

They effectively take over the phone from the moment their malware O.S. is installed. So you are using a misleading verb tense. The google-NSA criminals can and do take over the phone.

Also, it is not your phone. You do not control it at all, you do not own it at all.

but that’s ok

It’s ok for the anti-human party and not ok for humanity...

Here is the GRU, creeping through diplomatic halls as if secrecy were dignity, and sabotage a philosophy. One Aleksandr Dubikov skulks in Addis Ababa, a shadow in a suit, tethered to his Sandworm masters by invisible strings of whispered calls. And yet, what is he but a pawn in a game older than the empires that believe themselves eternal?

The African Union frowns, Moscow shrugs, and the world spins in its absurd rhythm. Nations speak of law, of honor, of friendship, yet in the folds of their embassies they host the machinery of treachery, as if betrayal were a sacrament. Now Russia hires its saboteurs from the gutters of the Internet, the disposable and the forgotten, to plant bombs and carry blame, while the real players sip their tea under diplomatic immunity...

GRU agent caught on CCTV in the diplomatic residence of the African Union Commission.

The break-in took place in 2025 in Addis Ababa, Ethiopia. The man responsible, Aleksandr Dubikov, worked undercover for the GRU. He frequently made calls to a member of GRU unit 74455, otherwise known as Sandworm. He is the assistant to Russia’s military attaché in Ethiopia, Nikita Zayats. Major Dubikov is still in place in Ethiopia, remaining at large, or perhaps ignored by Ethiopian authorities...

@Smooth Operator

You have used PHP plenty of times, including on October the 22nd, 2026 at 10:46 AM. The imaginary times do not count, but as much of the internet runs on it, you use it when you are not even aware. Your personal information is contained within systems running PHP.

Communications and information systems contain vulnerabilities, just as buildings, homes and other dwellings contain points of access. Objects that contain or house things are designed to be accessible, and security is largely added after the construction phase is finished. Most objects were never designed with security in mind. Utility was the purpose...

@ All

From https://www.abc.net.au/news/2026-10-14/pope-leo-xiv-ai-adviser-paolo-benanti-australia-copyright/107263800:

“Australia risks reviving a ‘new form of colonialism’ if it allows AI companies to train on copyrighted work without permission and send profits offshore, an influential AI adviser to the Vatican has warned.”

“You go, you take resources, and you monetise it outside the place where the resources [were]”...

@ Alex, ALL,

So,

“There’s no time for comments, we’re still busy figuring out what that 15yo server running PHP 4 is doing…”

Oh that’s easy,

“It’s eating your face off like an alien face hugging squid…” 😉

Here’s a crypto challenge from a world-class mental calculator:
https://klausschmeh.net/can-you-solve-this-puzzle-from-a-world-class-mental-calculator-and-win-100-euros/
You can win 100 Euros if you solve it.

There is now a new CVE for PHP that affects non-default configurations. The full details and a patch for the new vulnerability have not been released. It is advised to apply mitigations to prevent the vulnerability from being exploited in case of working PoC.

The problem will be addressed in the next regular bugfix release. Read the mitigation advice carefully and follow the instructions at PHP to determine if the issue applies...

There’s no time for comments, we’re still busy figuring out what that 15yo server running PHP 4 is doing 😀

@ iAPX, freedom, ALL,

With regards,

“What’s matter is how quick the community acts when a security problem is found, and the way they communicate and fix it.”

The problem is all to often the “to patch” time is way to long with 90days being the “responsible disclosure” time (or longer if the closed source corp can push it).

The thing is some of these vulnerabilities have been around for a decade or more and “kept quiet”[1] because they are useful to some. Just like knowing where to hit a locker with a Mitre lock for it to just pop-open. Similar with quite a few “gun safes”...

Clive writes, Yup Google has fritzed with your phone and you were not aware of it…

Oh but I was aware of it. Google initiated a silent background update to my phone last night but I caught it in the act because my firewall caught it. I figured that’s what was going on so I let it pass.

Most people are not aware that Google can effectivly take over your android phone but that’s ok because as much as I hate Google I still trust it more than the alternatives...

@ Carl Fink, ALL,

With regards,

“And yesterday, the node.js vuln…”

Is just one of several that would have been “Newsworthy” if not for this eMudhea and PHP debacles.

For instance, gears about this one?

https://www.theregister.com/security/2026/10/22/max-severity-gitlab-bug-allows-remote-code-execution-over-12-years-of-releases/5304854

Once that would have rated a “five alarm” rating, currently barely a bleat...

@freedom

Probably Node.js, that happened to have security problems of the same level (CVSS 9+) disclosed the day after !!!

None platform is immune …
What’s matter is how quick the community acts when a security problem is found, and the way they communicate and fix it.

@ Bruce, ALL,

From,

https://bugzilla.mozilla.org/show_bug.cgi?id=2083449

You might want to note,

“6 of the impacted certificates are for TLS and trusted by the Chrome, Mozilla, Microsoft and Apple root programs. The other two certificates are for codesigning and trusted by Microsoft”

Note “codesigning” it’s important especially when you add from further down,

“No response from Microsoft”

I do not know what the current status is but having world wide open Codesigning keys on the Western Worlds most used Consumer and Commercial OS…...

@ ResearcherZero,

I don’t know if you are upto speed on this or not,

https://edition.cnn.com/2026/10/21/politics/heat-ray-weapon-dhs-pentagon

From previous descriptions the ADS is a very high frequency microwave device that goes through traditional clothing and dumps energy into the top few millimetres of flesh.

Like a microwave oven it will cause damage to the flesh and nerves. One reason it’s not been deployed is the fact it has the same effects of peripheral neuropathy and it’s been reasoned that anyone who has an existing autoimmune disease such as diabetes would be orders of magnitude more susceptable to irreversible nerve damage...

@ Bruce, ALL,

One that is definitely in your wheelhouse currently,

The Alien Space of Science: Sampling Coherent but Cognitively Unavailable Research Directions

Scientific discovery is constrained not only by what is true, but by what is cognitively available to researchers.

“Many directions are coherent in light of the literature yet unlikely to be proposed because no existing community combines the relevant concepts, methods, and intuitions. Modern language models inherit this bias, recombining high-density regions of the literature when prompted for novel ideas. We target the complementary region, the alien space of science: directions that are scientifically plausible but unlikely under the distribution of existing researchers. Our method decomposes papers into conceptual units and clusters them into a vocabulary of idea atoms. A coherence model scores whether atom combinations form viable research directions, while an availability model scores whether any existing author community is positioned to produce them. We rank combinations to maximize coherence while minimizing availability. On 16,068 peer-reviewed LLM papers from NeurIPS, ICLR, ICML, and major NLP venues, the sampler produces more diverse research portfolios than frontier LLM baselines, including batch-prompted variants that see their entire output, while matching or exceeding their per-idea quality under blind human, LLM, and downstream experimental evaluation...

“Cleanup of this is going to be another mess—and it’s right on top of the PHP vulnerabilities.”

And yesterday, the node.js vuln ….

https://cybersecuritynews.com/node-js-releases-security-updates/

@Clive Robinson

That just argues for there not being a single point of authority for the PKI. Neither a single global one or a requirement that user limit themselves to choosing a single one.

Devices being able to choose one or more independent CRL publishers also works to mitigate state run MitM and sites being able to be verified by multiple independent root CAs limits the censorship/DoS impact of revoking any one CA...

Getting rid of PHP is the only way to regain security.

And what is the replacement for PHP? Corporate malware like ASP? Or perhaps “client side” javascript malware?

@ Bruce, ALL,

This has popped up,

eMudhra to Exit global SSL/TLS Certificate Business

Will Sharpen Focus on Core Enterprise Solutions and trust services other than SSL/TLS

“BENGALURU, INDIA, October 22, 2026 – eMudhra Limited (BSE: 543533 | NSE: EMUDHRA), a global digital trust company, today announced that its Board has decided to voluntarily withdraw from the global SSL/TLS certificate business...

There is more detail on this, including comments from eMudhra engineers, on the Mozilla issue tracker: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449

It looks like they were using the correct HSM device for keys, but the script they used to handle the key generation was not actually using the HSM device for key signing. Looks like a simple enough mistake.

Although it would have been trivial for them to detect this if they had attempted to use the HSM to validate the intermediate after cross signing. As they inadvertently signed their intermediate with the incorrect root cert they would have spotted this immediately...

@ Bcs, ALL,

With regards,

“This incident reenforces the argument that it should be easy to revoke certificates.”

It would be nice if it were not for the flip side of “Censorship” and taking away “Individuals rights”.

We are moving very rapidly into “Authoritarian times” in which the “common truth” gets killed off and replaced by Government or Corporate faux-truth.

For instance if you have a current Android OS phone if you go to the...

This incident reenforces the argument that it should be easy to revoke certificates. Both in the mechanism for propagating CRLs quickly and widely as well as in setting things up so that the “economics” favor doing so quickly if there’s even a reasonable suspicion that it is justified.

One change that would facilitate the second part would be to adjust TLS processing so that reporting cert chains to multiple root CAs is both supported and expected, so that it would take multiple revocations to take down sites. (I haven’t actually looked in detail, but I think that could be accomplished by simply expecting TLS clients to ignore “extraneous” certs provided during the handshake.)...

@ Bruce, ALL,

With regards,

“… has eight TLS certificates with laughably weak private keys”

It may be more than eight.

If you go to,

‘https://emudhra.we-have-a-problem.com

It now shows 14 certs to be tested, yesterday afternoon UK time it was 12…

But the reality is that atleast 60million or so certs 3Mudhra signed are now garbage.

But also as many as cyber-attackers want to generate.

Because there are way way to many embedded and similar systems that will never get their cert files upgraded…...

Oblig. XKCD (Esp. the alt text.)
https://m.xkcd.com/3314/

Oblig. XKCD (Esp. the alt text.)
https://m.xkcd.com/3314/

Different governments shut down many servers, NSA provided a strong recommandation to do so (its rare NSA is acting that way) until patched.

I stopped httpd on my instances, until I have upgraded them.
It’s easy for a private, not so for companies where they are unprepared for the nuclear option : shutdown.

Since my first hacked DNS Box on Linux, in 1994, when managing the infra I always ask for and obtain (it is not optional) to be able to shutdown accesses or any part of the infra. The nuclear option...

@ ResearcherZero,

With regards the Canadian Government “mediation”

This is an excercise in what used to be called “Kicking it into the long grass” in Britain, till there were so many examples of politicians on the take and hiding behind it, there was no longer any room.

If you want a classic example the Grenfell tower block cladding fire,

https://en.wikipedia.org/wiki/Grenfell_Tower_fire

The reality is it is a long series of events from the 1960’s to solve UK housing “on the cheep” by so many people in authority, business, and even safety organisations. That it became the “perfect storm conditions” and so the tragic events happened. And there are hundreds of other buildings where the same could happen at any time...

@ResearcherZero, all

It is only corrupt if someone else is doing it, right? It’s only a crime if you’re caught.

Dutch military intelligence (MIVD) listened in on Jared Kushner’s phone since 2018. He received reportedly $750M from Saudi and VAE families to influence his diplomatic work.

‘https://www.timesnownews.com/world/us/us-news/jared-kushner-iphone-hack-russia-uae-saudi-israel-allegations-article-156389040...

Jokes aside (the vulnerability is indeed very serious), I have yet to see a reliably working exploit. None of those on GitHub are of this kind.

@Clive

It is only corrupt if someone else is doing it, right? It’s only a crime if you’re caught.

Compliance procedures are designed to prevent waste, fraud and abuse of expensive contracts for products and services provided to government by private firms, or those that own them.

Musk might want to be careful attempting to swing around sharp objects that are not toys, as he is a little uncoordinated. He seems to have confused the application of the quote and what it implies. Those with something to hide are frightened of the details becoming known...

@Clive Robinson, ResearcherZero

Local public radio has just had an interview with Luke Harding, Guardian reporter who wrote Betrayal, asking is current POTUS a Russian asset?

https://www.theguardian.com/books/2026/aug/24/betrayal-by-luke-harding-review-is-donald-trump-a-russian-asset

@ Bruce, ALL,

Apparantly it’s not just PHP and eMudhra that is happening…

I mentioned above that AI was finding many software issues, and whilst many are seen as “AI Slop”, not all are…

Well it appears that in the “not all” camp there are several that would in other times be quite news worthy in of themselves if not being in effect “drowned out” by all the carfuffle and noise associated with the eMudhra and PHP issues...

@ ResearcherZero, lurker,

Please put the coffee down…

A friend pointed out that redit had a political posting,

‘https://www.reddit.com/r/politics/comments/1xckln2/musk_warns_dems_he_will_retaliate_if_they_use/

That is titled,

“Musk warns Dems he will retaliate if they use congressional power to probe him”

I know he’s an overstating alien but…

The actual article it links to,

‘https://www.foxbusiness.com/politics/musk-warns-democrats-he-retaliate-use-congressional-power-investigate-him...

Many years ago I was given a PHP-MySQL server to feed and care for. The rate of security advisories and updates was a dismay to this newly fledged sysadmin with a lifetime experience in (non-computer) hardware engineering methods.

@Smooth Operator – yup, the gift that keeps on giving.

@Bruce – “Updating PHP is the only way to regain security. Do it now.”

No. As @Perry said: updating will not make PHP “secure.”...

Re: rce through oom

Classic case of subtle memory handling biting back. This is a reminder of why error paths matter: PHP’s use of longjmp() to bail on OOM leaves partially initialized request memory hanging around, which can be touched during shutdown. Even unrelated allocations can trigger this. From there, RCE is just a matter of aligning the dominoes. Clean exits and consistent state handling are critical in any runtime, especially one this exposed...

It sounds like the cert issue was caused by training, or at least not intended for public use, certs being used. Sort of like if your corporate example.corporate.com accidentally got routed.

Also, xkcd is on top of it: https://m.xkcd.com/3314/

@ ALL,

The BBC is running a news “live update” on the PHP issue,

https://www.bbc.co.uk/news/live/ckgel5xp2xv9t

It reports that 32 UK Gov sites are effected but as of yet, nobody has reported being attacked in the UK…

I would take that with a grain of salt about the size of Lott’s Wife …

There is however other news that is equally as worrying…

Indian Certificate Authority eMudhra has used rediculous signing key values for it’s top level certificates...

“Updating PHP is the only way to regain security.”

Updating PHP is the only way to mitigate these vulnerabilities, but doing so does NOT make PHP “secure.”

In fact, that train of thought borders on magical thinking. Because beyond on a shadow of doubt there exist other severe issues in PHP that have simply not been discovered.

Part 2,

I could list another series of “AI Vulnerability Discoveries” but the list would be fairly lengthy…

Many have been dismissed as “slop” but sufficient have not to be of considerable concern.

These non slop AI findings have the feeling of being found at a rapid rate that is outstripping developers ability to fix them in a timely fashion.

I don’t know if anyone is keeping figures on this but it appears to be rattling lots of people including UK politicians (which is not good)...

Sent in parts due to auto-mod at 14:00UTC

Part 1,

@ Bruce, ALL,

A search Gave the following information,

“The critical PHP vulnerabilities were discovered by the cybersecurity firm Calif … and independently by researchers at Wiz”

If this is correct then the vulnerabilities were found by the use of AI systems.

Following on from @Rontea:

I read this in the paper:

“Internet security is a commons. Like all commons, keeping it working benefits everyone, but any individual can benefit from exploiting it. In our society we protect our commons—our environment, healthy working conditions, safe food and drug practices, sound accounting practices—by legislating those goods and by making companies liable for taking undue advantage of those commons. This kind of thinking is what gives us bridges that don’t collapse, clean air and water, and healthy sanitary restaurants. We don’t live in a “buyer beware” society; we hold companies liable for taking advantage of buyers.”...

Rather than wasting their time on fridges, it would be more beneficial if the attackers had taken time to hack washing machines and permanently configured them for a cold wash, with a shorter cycle. Hence reducing enormous waste of water and energy.

Destructive attacks are low-skill and purely a waste of limited intellect and ability. Now if script kiddies could repurpose their time and energy for constructive hacks, then they would progress away from the category of ...

PHP vulnerabilities found by AI, leaked thru Hacker News, resulting panic because according to MSM it “runs 70% of the internet.”

https://theconversation.com/a-critical-flaw-affecting-70-of-all-websites-has-the-cybersecurity-world-panicked-294941

https://www.php.net/archive/2026.php#2026-10-21-5

What would be more interesting than unqualified speculation by psychologists on the feasibility of an example of technology, would be a thorough examination of what the ramifications are from an unprovoked attack by directed energy. This would be far more helpful for understanding the psychological impact of harm rendered to memory, other neurological systems, and human physiology by such a delivery mechanism...

@onearmedspartan: https://www.reddit.com/r/JSOCarchive/comments/1xbxiek/autistic_people_in_the_task_force_orange/

@Clive

emu-dra perhaps?

Mobile information technology affords not first-hand experience, expertise or wisdom. Those without rigorous first-hand experience and expertise, are not granted gifts of cross-discipline knowledge automatically, in fields outside of their practice, even if it might seem to relate their profession. As a physicist is constrained to their narrow fieldwork.

Botany, astronomy, medicine. Every practitioner specializes. None can hope to learn or discover all that is on offer. Paper, algebra, gun-powder, glass… all unknown as the heavens until first-contact. It is why we have fields of study and research within each of the disciplines. Earth’s species are many, just as the stars are innumerable, and number sets and patterns endless in diversity. Our mobile phones, nor our diplomas cannot free us from our ignorance. The pursuit of knowledge first requires humility before it will reward...

@Clive Robinson

Companies selling insecure products, without anyone in charge understanding how their product works, is a concerning matter. Because their are so many digital products pumped out at volume around the world, it is very difficult for experts to test all of them.

It’s likely that other companies took the Emudhras certs and popped them in their products, without an easily utilized method for updating and invalidating said certificates...

@ Andy Fuller, ALL,

With regards,

“… apparently Randall Munroe is a fan.”

I would not disbelieve it, there are many people read this blog, but don’t post, or post any longer (which is a shame).

However I would not rule out Randall hearing about the Emudhra[1] from another news source, and seeing the irony in it.

Oh for those that can remember back to the early 1970’s there was a song that had the lyric,...

@ak
“this vulnerability lives in the model’s weights, and that removing the model’s CCP alignment removes it.”

This is the great advantage of open weights, they can be adjusted to taste. But it’s the same as open source, how nay users read the code or can understand it? Hence the kneejerk reaction: ban them outright

https://www.reuters.com/technology/us-banning-chinese-ai-deepseek-government-agency-it-systems-2026-10-19/...

Acting in an abundance of caution many French government websites were taken offline pending a patch to PHP. Sites “temporarily” inaccessible included France Meteo (weather), local governments and the citizens’ tax interface. The press reports refer to “Wednesday afternoon” which it still is, 18:00 UT as I search for info on Tropical Cyclone Agueda, first of the season in southern Indian Ocean...

From the article:

One fix stands out: a use-after-free (UAF) in the L2CAP channel manager.

Would using Rust or a language with a Rust like borrow checker have prevented this class of bug? It seems like the sort of thing Rust’s borrow checker was designed to prevent.

@Clive

Or we won’t prevent one of those 60,000 year asteroid events and we will likewise get wiped of the the face of the planet.

As for your Doomsday expectations, I take the hint from the movie “Don’t look up”, ie, all of the above.

But rejecting vaccines in the face of ebola is a good second.

Remember that stupidity is not a lack of intelligence, but the conviction that you don’t have to think because you already “know” what is good/the truth...

Eventually also relevant: https://www.hirundo.io/blog/qwen3-coder-vulnerabilities

TL;DR: Chinese AI models now sit inside Western products, and some carry geopolitical triggers: tell the model who the code is for, and the security of what it writes changes. For the first time, we showed that this vulnerability lives in the model’s weights, and that removing the model’s CCP alignment removes it...

@ Winter, ALL,

With regards,

“PS: It is widely believed that the universe most likely is not infinite.”

Yup “As far as we can see”, but what comes after that… Then there is that “multi-universe” stuff used by people who should know better trying to explain Quantum Computing…

So…

P.S. Whilst infinite human stupidity appears probable, we’ve yet to measure up against AGI… After all it appears some believe we are doomed by our own folly… Some because they believe in a vengeful deity against whom there is no defence. Others because they feel based on history that some idiot will give the AI agency to an existential threat like nuclear launch codes or a bio-weapon factory. Me I’m thinking more along the lines of the start being,...

Reading this 2002 article through the lens of 2026, I’d say its core premise still holds up remarkably well. Professor Schneier argued that security is fundamentally an economic problem, and that liability would become the unavoidable driver of change. Looking at the evolution of cybersecurity over the last two decades, we’ve seen this play out almost exactly as predicted.

@Clive… apparently Randall Munroe is a fan. https://m.xkcd.com/3314/ — See the alt text of today’s comic.

This seems newsworthy: https://emudhra.we-have-a-problem.com/

@Clive

I could go on but I suspect our host @Bruce will have something to say on the matter 😉

A wise person has supposedly said these historical words:

Two things are infinite, the universe and human stupidity, and I am not yet completely sure about the universe.

Whether this quote is true or not, the wisdom of these words is widely appreciated.

This case shows, maybe not actualized infinite stupidity, but at least that the depths of human stupidity are beyond comprehension...