Busy week. Bryan came to me at like 11pm mentioning that Go had rotated a CA.

  • eMudhra — a certificate authority whose private keys turned out to be the number 4. I’ve heard a few theories - they misinterpreted P-384 or P-256, they might’ve been trained on a different HSM.
  • PHP2Shell — Data race to a UAF. Discussed years ago but thought non-exploitable. Discovered by Calif and then Amy.
  • Brotli2Shell — NodeJS brotli bug.
  • LiteLLM — Supply chain attack. Again.
  • GitLab RCE — Present for a decade.
  • GoAhead — Embedded web server. Weak value in DHE ephemeral share. Impacts a lot of IOT devices.
  • Tailscale SSH — Luckily not mainline Tailscale.

All in a single week. Whew! Some were disclosed earlier and just happened to land this week.