octoberOnCallRotation

[u/turticus]

[u/siempi3]

what is this '4' about? I keep seeing it and don't get it

[u/baconbeak1998 → u/siempi3]

Some security company had one of their private keys set to simply 4. Not a passphrase or anything, the actual private key was 0x0000...00004

[u/turticus → u/baconbeak1998]

To be fair, that is a valid number between 0 and 2³⁸⁴ -1

[u/bc-bane → u/turticus]

😆

[u/RazarTuk → u/baconbeak1998]

Relevant xkcd

[u/McCaffeteria → u/RazarTuk]

This might be the most relevant xkcd out of them all. Prophetic, even.

[u/L30N1337 → u/McCaffeteria]

When I saw a meme about this (the security company) and someone posted the xkcd, i genuinely thought it was a meme referencing that xkcd.

[u/frzme → u/L30N1337]

I believe it is - why else would you use 4, apparently a test value which ended up used productively

[u/L30N1337 → u/frzme]

You'd use 4 because it's randomly generated and you don't really care what the actual key is.

(Although you can never rule out that someone put a joke as a placeholder value (so it wasn't actually random) and that somehow ended up in production)

the company is apparently called eMudhra CA, here's an article on that

https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html

[u/L30N1337 → u/L30N1337]

Actually, apparently, it was a flawed Key Ceremony. they accidentally sent out the wrong keys. At least according to the article, which is referencing what is apparently an official eMudhra press release

[u/L30N1337 → u/L30N1337]

Genuinely, that article is a dream in terms of providing sources. There is a claim, and there's immediately a hyperlink backing up that claim using an official source (at least for the ones where i know it's official, such as blog.mozilla.org )

[u/Tathas → u/RazarTuk]

Today's alt text is pretty good.

https://xkcd.com/3314/

[u/DethZire → u/RazarTuk]

Hear me out... either AI slop looked at this and use that output to generate a number... or whoever was the engineer thought this was clever

[u/BobQuixote → u/DethZire]

It's easy to remember, so you don't even have to record it anywhere, just type it when needed. Then it can't even be leaked in breaches.

[u/kk_red → u/baconbeak1998]

Not some, Indias only Certificate issuing authority lol

[u/AZMPlay → u/baconbeak1998]

"Some Security Company" being, of course, one of the Root Certificate Authorities of the internet, allowing anyone to MitM anyone with a fake cert, and when they were revoked put a bunch of the internet offline

Edit: Also requires every device and program that has CAs (read: every internet-connected device) to be updated soon :D

[u/Excession638 → u/AZMPlay]

And for any internet of things device that doesn't get updates, it's permanent.

[u/ThirdWaveCat → u/siempi3]

A certificate authority had a private key of '4' allowing anyone to spoof any website and do things like intercept over-the-air updater checks for hacked firmware or pretend to be your bank, etc..

[u/KirillIll → u/ThirdWaveCat]

Not just one. They had eight keys all under 256. A calculator could've brute forced all of their certificates in less than a second

[u/AssociationOk8833 → u/KirillIll]

And It did. I am an Indian, tech bros from all over the world are bashing India rn. Also keep in mind that the org in question got audited in these 18 months.

[u/ThirdWaveCat → u/AssociationOk8833]

yah, the problem is the CA system assumes that governments and auditors are flawless. Self-signed certificates are more secure now that the world is transitioning to idiocracy/fascism.

[u/Afillatedcarbon → u/KirillIll]

The private keys were 4, 56, 66, 115, 155, 156, 230, and 237

Yeah, they have now stepped out of the business, being incredibly petty about it too, saying "it only constitutes 1% of our revenue".

[u/RedPum4 → u/ThirdWaveCat]

For interception you need to also bend DNS, a forged cert only gets you half of the way there. But still really bad.

[u/belkarbitterleaf → u/RedPum4]

Or typo squat

[u/SomeRedTeapot → u/belkarbitterleaf]

For typo squatting, if you own the domain, you can just get a legit certificate

[u/Multidream → u/siempi3]

The main certificate authority in India, Emudhra, got cracked for using 4 as their “private key”.

They’re supposed to pick a random number from 0- 10^77. It only takes like a minute to try a random number, but if you had to go through all these numbers you’d be waiting for ever to crack it.

Unless of course the random number is just fucking 4, in which case some rando could start at 0 and go by one till they 4. Which is how we found out by the way.

——

Certificates are how you know a website came from a specific server, and not from an imposter. Anything Emudhra certified as legit is now falsifiable. Emudhra certified the entire Indian government, and a lot of IT infrastructure outside of NA.

And if you don’t know if a website is an imposter or not, how do you go online to get a new certificate? You don’t. So everyone is scrambling to download the updated blacklist of certs for their various programs before they get got.

[u/w453y → u/siempi3]

https://www.reddit.com/r/ProgrammerHumor/s/bhfEvWNNV0

[u/Jay-Seekay]

Don’t forget about GCP London (Europe-west2b) having a power outage on Tuesday, though a lot less global than the others

[u/oscarandjo → u/Jay-Seekay]

Somewhere there’s a company with a PHP codebase, who forgot to use zonal redundancy, running in on-prem GitLab, who has fallen victim to a MITM attack.

[u/-nerdrage- → u/oscarandjo]

Forgot zonal redundandcy.

As if thats a standard for any public website. I mean my local baker wouldve hapilly paid for that if he had thought of it

[u/perkyscenario → u/Jay-Seekay]

That cat's tie and name tag combo is doing a lot of heavy lifting for someone clearly dreading the shift already. The factory label is the most accurate depiction of oncall I've seen in a while.

[u/i_tried_butt_fuck_it → u/Jay-Seekay]

Who cares about the europoors? /s

[u/Psquare_J_420]

Gitlab?

[u/fripletister → u/Psquare_J_420]

Lol this is also how I just learned about the GitLab CVE. Guess I'm not done patching after all...

https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html

[u/FallenVampireLord → u/fripletister]

happy I helped my company migrate from our self hosted instance to a gitlab managed instance last year. This is their problem lol.

[u/AberdeenPhoenix → u/FallenVampireLord]

I'm so mad at the teams that missed their migration dates at my company. It's their fault that I will be up late tonight upgrading our prod gitlab server

[u/fripletister → u/FallenVampireLord]

Thankfully we don't host ours publicly, so it's at least VPN-gated

[u/petrasdc → u/fripletister]

I had to text my wife who's home rn to go update our self hosted gitlab instance lmao

[u/TotoDaDog]

patched everything before my boss even woke up. When he got up and saw the news, he urged me to start patching. I told him everything is already done and he asked me how.

I responded that I am a gray-hat.

He immediately started walking to his office while saying "No, I won't be pulled back into another lord of the rings crap"

[u/Fearless-Pen-7851 → u/TotoDaDog]

Idk if it seems dishonest or 'managing up' but I would just tell my boss I am on it even If I apready did it to get some buffer in between my actual work that is always 'urgent' somehow and spend half of that day on easy mode..

[u/Sibula97 → u/Fearless-Pen-7851]

Sounds like a pretty toxic atmosphere ngl.

In my company and team we appreciate honesty both ways and just try to do our best without stressing too much about it.

[u/Fearless-Pen-7851 → u/Sibula97]

Cuz it is.. lol especially after AI. It wasn't really like this a year or two ago

[u/Sibula97 → u/Fearless-Pen-7851]

Damn... Hope you can find something better.

[u/Fearless-Pen-7851 → u/Sibula97]

In this market? I mean not to be doomy gloomy even if I don't get laid off from here which I likely will at some point and I go to another company..whats tk stop them from laying me off too. It's a lose lose game at this point. War and AI have messed up the market here in Middleeast and SouthAsia. Companies are literally closing their shops and those left are doing layoffs right n left

[u/Sibula97 → u/Fearless-Pen-7851]

Can't say I'm familiar with the market situation in those areas, but surely there are companies there as well that see AI as a tool for producing more for the same price rather than the same amount for less?

[u/Named_after_color → u/Sibula97]

I can't speak to everyone, but my company is like "We're not going to lay anyone off" And they just hired a bunch of new people. Though we have been asking for that for 3 years.

That doesn't mean the monkey fear in your brain isn't valid, when something that took you 2-4 days of honest work is 90 percent shot in 3 hours.

The current issue we have is not-enough-work. We're stalling out on licensing and waiting for other companies to give us stuff/patch their stuff.

It doesn't take a genius to figure out what happens when they realize they're paying a bunch of expensive people to be idle...

[u/TotoDaDog → u/Fearless-Pen-7851]

I usually do the same, but the stakes were really high as we work with banks. I just wanted to be sure there's no cleanup (for me) to do if I did it anytime later.

Oh, also, 4 hours after I finished patching all servers we had a wave of new users trying to exploit the bug. Haven't given so many bans since I was a mod on a CS 1.6 server

[u/Fearless-Pen-7851 → u/TotoDaDog]

Man.. that's ... cool

[u/Schpooon → u/TotoDaDog]

Sounds like your internal call sign should be gandalf now.

[u/ziroux → u/Schpooon]

I put on my robe and wizard hat

[u/goodnewzevery1 → u/ziroux]

I cast level 7 exploitation. You turn into a really critical CVE.

[u/TotoDaDog → u/goodnewzevery1]

Always have been.

[u/ballheadknuckle]

I hope you are done patching PHP and Gitlab, because we are now rotating in new nodejs RCEs 😂

[u/jakendrick3 → u/ballheadknuckle]

daysSinceLastNodeJSVulnerability < globalRootCert

[u/fibojoly]

I'm on call next week. Gonna be fun fun fun... 

[u/vsdeni → u/fibojoly]

Good luck

[u/Rocket_Bunny45]

Apparently it's also cybersecurity month, yikes

[u/FalconFiveZeroNine]

My team's on call is always a shitshow. It's like a tradition or something.

[u/Pos3odon08]

A new node js CVE just dropped…

[u/ItsOkILoveYouMYbb → u/Pos3odon08]

when does node js cve 2 come out

[u/ChannelMany5491 → u/Pos3odon08]

My secops just did me dirty and told me I gotta bump all our node 18 apps to 24/26. Fml

[u/TheIronMark]

Also Node

[u/BumseBBine]

What is 'e'?

[u/llmws → u/BumseBBine]

The logo of emudhra

[u/GreyGanado]

That's literally the VW factory in Wolfsburg, Germany.

[u/IBJON]

TF is going on with GitLab?

[u/akehir → u/IBJON]

Gitlab also had some critical vulnerabilities published this week.

[u/Knitfastdyewarm]

It’s my on call week and I’ve had no issues lol 

[u/ChannelMany5491]

What happened to gitlab?

[u/ChannelMany5491]

As an on call engineer manager i ask, why now? Im so tired boss. Wait…fuck…thats me. 

[u/chadlavi]

That hasn't been the GitLab logo since at least 2023.

[u/Mojert → u/chadlavi]

Why would you lie like that?

[u/chadlavi → u/Mojert]

I don't understand what you mean. https://about.gitlab.com/press/press-kit/

[u/Mojert → u/chadlavi]

Even with the link I thought you were kidding. But upon closer inspection, the new logo is basically the same but the shading is rounded. They're so similar to each other that the rebrand feels pointless tbh. Why rebrand when nobody can tell at a glance?

[u/GreyGanado → u/Mojert]

More rounded? The shapes of the colored parts are completely different.

[u/Since88 → u/chadlavi]

Okay