After many JS-related supply chain attacks, there's a new PHP one! "The attacker replaced many or all release tags in four laravel-lang/ repositories with malicious lookalikes that point to their own commits which contained malware." snyk.io/blog/laravel...

Laravel Lang Supply Chain Advisory | Snyk

Laravel Lang Packagist releases were republished with malicious code. Learn how the supply chain attack worked, what was stolen, and how to respond.

snyk.io

Whenever I see an email like this (in my spambox), with a Google Form asking for your email and a repo URL, all I can see is yet another supply chain attack in the making. I wouldn't want to run a legit competition nowadays 😅 (Disclaimer: I have no idea what KaiCode is)

Detailed report from DigiCert (thanks!) about "a limited number of code signing certificates, few of which were then used to sign malware". At the beginning a ZIP file with a .scr executable, and some time later 60 revoked Code Signing certificates. bugzilla.mozilla.org/show_bug.cgi...

The Axios supply chain attack post mortem notes show how it was done: via a fake cloned company on a fake Teams call. The two comments with details: github.com/axios/axios/... and github.com/axios/axios/...

Here's your (ir)regular reminder that HTTPS certificates without the CN (Common Name) field are completely valid. For example the 6-day certificates from Let's Encrypt do not have a CN as per the "shortlived" profile letsencrypt.org/docs/profiles/

Profiles

A profile is a collection of characteristics that describe both the validation process required to get a certificate, and the final contents of that certificate. For the vast majority of Let’s Encrypt...

letsencrypt.org

I always find entering personal details into a website to tell them to stop processing my personal data a bit absurd. This biz data enrichment company is processing my personal phone number. They told me to fill out this form, so I did. Now I'm asking how they process my data I have entered 😅

My favorite XSS trick when you can add only attributes (when < and > are removed from the input) is to add onfocus=alert(1) and autofocus: <input value="" onfocus="..." autofocus=""> To not create a loop, I add this.blur(), otherwise alert() steals the focus, and then the field gains it once again.

Naming is hard, so that's why my PHPStan extension called "Disallowed **Calls**" now supports disallowing **properties** 😅 Also a Friday the 13th release 👻 (at least in my timezone) github.com/spaze/phpsta...

Release Can disallow properties · spaze/phpstan-disallowed-calls

Naming is hard, so that's why this Disallowed Calls extension now supports disallowing instance and static properties, and enum properties with disallowProperties (#378) Other (mostly) internal cha...

github.com

When issuing a HTTPS certificate, the CA needs to make sure you own the domain, and one of the many methods is via email where they'll email you a link. This method will be discouraged in March 2026, disabled in March 2028. See security.googleblog.com/2025/12/http... + cabforum.org/2025/11/20/b...

HTTPS certificate industry phasing out less secure domain validation methods

Posted by Chrome Root Program Team Secure connections are the backbone of the modern web, but a certificate is only as trustworthy as the...

security.googleblog.com

Instead of `cat`, I use `bat`, "a cat(1) clone with wings." github.com/sharkdp/bat It supports syntax, line nrs, git etc. I have it aliased to `cat`. If you'd like to concat multiple files into one (`cat 1 2 3 > foo`), you should run the original like `\cat`, seems faster, in my case up to 10x.

GitHub - sharkdp/bat: A cat(1) clone with wings.

A cat(1) clone with wings. Contribute to sharkdp/bat development by creating an account on GitHub.

github.com

Best news I've discovered today is that ripgrep is also available for Windows and you can install it with winget (winget install ripgrep). ripgrep is like the grep utility in Linux, but a bit faster, it also accepts grep's params github.com/burntsushi/r...

GitHub - BurntSushi/ripgrep: ripgrep recursively searches directories for a regex pattern while respecting your gitignore

ripgrep recursively searches directories for a regex pattern while respecting your gitignore - BurntSushi/ripgrep

github.com

Michal Špaček @spazef0rze.bsky.social presenting his talk "Password Reuse Is a Dumpster Fire – We Brought a Hose" at #PasswordsCon in Prague, December 2, 2025. youtu.be/AuCNgoDf-5c

Michal Špaček: Password Reuse Is a Dumpster Fire – We Brought a Hose

YouTube video by Per Thorsheim

youtu.be

Looking at my access logs, the easiest way to block web scanners & bots is to block requests with a User-Agent header that says "old browser" where old is -10 major versions and older😁 For example Chrome is v142 and bots use Chrome/120, 116 etc. It's mostly a fun idea but it seems like I need a PoC😅

TIL that OCI stands for "Oracle Cloud Infrastructure" and also "Open Container Initiative". I've first learned about the former ("Oracle Cloud Infrastructure") and just spent 5 minutes trying to understand a bug where they used OCI in the latter meaning ("resolves remote OCI artifacts")

Chrome for Android can now help users adopt passkeys more seamlessly. If a user signs in with a saved password , your website can request that an associated password manager (in many cases on Chrome is Google Password Manager) creates a passkey automatically. developer.chrome.com/blog/automat...

Automatic passkey creation in Chrome for Android  |  Blog  |  Chrome for Developers

Chrome for Android can now automatically create passkeys after password sign-in, helping users transition to passkeys with less friction.

developer.chrome.com

My random number generator just did a Dilbert

Did you know Facebook has a Certificate Transparency monitoring tool? Never mind then, they're shutting it down anyway :-) developers.facebook.com/tools/ct

Just noticed that my PHPStan extension to detect disallowed calls, methods, attributes, constants etc. has been installed more than 15M times, wow! Not bad for a weekend project (a long weekend since 2018). PHPStan itself has 300M installs, so 5% of all PHPStans installs use the extension, nice! :-)

HTTPS certificates can exist without the CN (Common Name) field. It's not used for validation, instead browsers use the SAN (Subject Alternative Names) field. But if your tool uses CN for anything, e.g. to show a "name" for management purposes, check whether the tool works with CN-less certificates

There should be an HTTP response code in the 4xx range that would instruct the client to refresh their stale DNS records. Even after 48 hours some bots (looking at you Palo Alto Networks) are using the old IP for a hostname, while the DNS records have TTL of 5 minutes or so.

Here's one information for you: should be more specific when phishing IT folks

GiveWP (the donations WordPress plugin) managed to leak donors' emails into the donation form. And then they managed to mess up the communication :-( Nice resume of the problem at the Pi-hole blog as they were one of the affected sites pi-hole.net/blog/2025/07... Go and learn how to communicate.

Setting up a new server and I'm so happy I can do it remotely because it must be absolutely cold in the data center

My last name (Špaček) means starling in Czech. This guy used my veeery distant relative to store an image, nice 😁 Looking forward to an update to RFC 1149 where you don't need a small scroll of paper but instead use the carrier itself to store the data.

Benn Jordan@bennjordan.bsky.social · last yr.

New doc releases today! - Ultrasonic recording of a starling that can record and playback virtually any sound - Analyzing incredible slowed-down bird songs - Showing you how to do this (and way more) on the cheap youtu.be/hCQCP-5g5bo

I was today years old when I found out that the name of the company who's created Wolfenstein 3D and Doom, id Software, is pronounced "id software", "id" as in "kid", not "eye dee software" That's some 30 years after playing the games... en.wikipedia.org/wiki/Id_Soft...

id Software - Wikipedia

en.wikipedia.org

It's been 0 days since git reflog saved my ass (and files) again. Instead of rebase this branch, I did reset this branch, losing my commits. `git reflog`, find out what happened (reset at {46} and {48} in the pic), then `git branch name id` (id ends with 67 at {50}, commits are back.

What do you do when you can't sleep? I fine-tune my HTTP reasons 💤

I've asked ChatGPT to generate me a temp profile picture and when I've praised the creation it didn't know what to say, so it gave me back some JSON with a prompt that has resembled my instructions. ChatGPT then claimed, multiple times that I asked for the JSON 😁 I haven't talked about JSON before.

Stored XSS via an archive file stored in a RAR archive, nice 😁 Fixed in WinRAR 7.12 released yesterday.

I have a battery powered outdoor camera, it can last several weeks on a single charge in that environment. But suddenly, the battery went from 20% to 0% overnight. I was curious what happened so I checked the last pic it has recorded. Yeah, thanks little fella 😂