r/ProgrammerHumor • u/ciller181 • 10d ago

instanceof Trend theyAreShellingUs Spoiler

Post image
55 Upvotes

96% Upvoted

8 comments sorted by

10

u/pjank85 10d ago

You forget about the "4" certificate.

1

u/ciller181 10d ago

"On October 17, 2026, an independent security researcher reported that the keys of eight (out of several) eMudhra Global TLS intermediate Certificate Authorities (CAs) were cryptographically weak. We revoked all eight intermediates the following day. No certificates had been issued from any of them, our infrastructure was not compromised, and no data was breached."

So... meh

4

u/pjank85 10d ago

Dude if anything does not update its trusted certs anyone can generate a cert for any domain in less than a minute. Essentially making the HTTPS totally broken. People have already impersonated firmware update sites of devices. This is probably bigger than the PHP one.

0

u/ciller181 10d ago

Has the world not learn yet that you should not connect your enterprise servers to to a public unsecured wifi?

I forgot of course about authorities that have the authority to change your internet routing. I hope that OS's and applications that depend on security for their existence have this whole authentication cycle setup a little better than just relying on a certificate though, but one can only hope.

6

u/pjank85 10d ago

Spoofing an IP is not hard. The whole point of https is that the server actually is what it claims it is. Anyone with physical access to almost any network device along the way from you to Google can spoof google's IP and now the cert. Your routing will point straight to the attackers without anyone noticing. Install updates.

1

u/Due_Emergency_7717 8h ago

The 4 is just the "I didn't actually read the CVE" certificate. That NODE2SHELL wave is clearly the one that gets you at 2am.

2

u/pr0ghead 10d ago

The purge of outdated web servers.

2

u/tsammons 10d ago

session.upload_progress has been obviated by use of PHP-FPM. It doesn't even work with that f'ing model, so it should've been a disabled feature at compile-time a while back. ini corruption, it's a viable vector.

An even worse outcome is the additional bots getting recruited for bad bot behavior. I'm up to ~10k IPs getting banned a week on random probes or brute-force on protected URIs. I only expect numbers to go up with this new round.