Nick Percoco
@c7five
Chief Security Officer at @krakenfx, hacker, @THOTCON OPER, @IamTheCavalry, @DEFCON NOC, @SpiderLabs founder - Opinions are my own, not my employer’s
1.2K Following 30.4K Followers
PHP is shipping a security release tomorrow, Oct 21, at 10:00 AM ET for two critical vulnerabilities, rated CVSS 9.2 per @ThePHPF. It could land earlier if details go public or exploitation shows up.
@watchtowrcyber says details already leaked, that both are remote code execution, and rates them a 10. PHP hasn't confirmed any of that, but plan like it's true.
Tonight: find every place PHP runs, check versions with php -v and php-fpm -v, and line up a patch window for the morning. Anything older than 8.2 is end of life, so don't expect a fix there.
Every PHP install without an owner is attack surface you can cut today.
Show more
Scammers are calling our clients pretending to be Kraken Support, or reps from other crypto firms. The script rarely changes. They tell you there's a security issue with your account and you need to move your funds somewhere safe now.
We built something for that moment. Kraken clients can now verify mid-call whether they are speaking to an actual Kraken support agent or a scammer.
- When it's us, you'll see a verified banner in the Kraken app.
- When it's us, you can also ask the agent to read back a one-time code that only your app can generate.
- When it's not us, you'll get a pop-up warning telling you to hang up.
Show the scammers who's boss. Update your @Krakenfx, @krakenpro, and @krak apps today. 🔒
Show more
