You know what… imma need to see every NCO that ever existed in my office right quick, and bring every water source you own.

Yes. Long Live The Empire.

We? Who the fuck rocks up with M-4s and night vision goggles that isn't *literally* the US Army?

HUGE: The en banc Fifth Circuit just held, 11-6, that illegal aliens caught in the interior can be detained without bond for the duration of their removal proceedings. Judge James Ho in a concurring opinion: "A nation ceases to be a nation if it can't protect its borders."

This morning, two former senior FBI officials, Nikki Floris, 46, and Bradley Benavides, 56, surrendered on arrest warrants after being charged with lying to Congress about their roles on the Foreign Influence Task Force during the 2020 election.  Floris and Benavides allegedly lied to Congress about their roles in the FBI’s Hunter Biden investigations, with one claiming they only learned about it from Wikipedia - despite evidence showing their involvement in helping shape the public narrative about Hunter Biden’s laptop right before the election.   Lying to Congress by anyone strikes at the heart of our democratic system, but when senior FBI agents lie to Congress believing they are above the law, it’s time to bring the hammer of justice down on them. When senior officials entrusted with safeguarding our nation’s security choose deception over duty, they undermine the very institutions they swore to uphold.   Today’s action makes clear that no one is above the law, and we will hold accountable all who obstruct the truth.

This week has been quite a shitshow already, and there are still 2 days to go Here’s a quick recap of the security mess we’ve seen in just the last few days: 1. PHP Core RCE (CVSS 9.2) Two critical vulnerabilities (CVE-2026-109618/109619) allowing unauthenticated RCE. A huge number of PHP installations potentially affected, and there are already reports of reliable exploitation against patched versions. Great… Useful links: Official PHP advisory and patches: php.net/archive/2026.php#202… Practical hardening and mitigation guide by Vincent Schmalbach. nginx/Apache configurations, PHP settings, patch verification and compromise checks: vincentschmalbach.com/cve-20… Huntress analysis. What to monitor, suspicious child processes, webshells and post-exploitation activity: huntress.com/blog/php2shell-… Wiz technical deep dive. Exploit mechanics, memory disclosure, affected applications and the role of AI: wiz.io/blog/php2shell-php-rc… Corelight’s open-source Zeek and Suricata detection rules: github.com/corelight/php2she… 2. GitLab RCE (CVSS 10.0) CVE-2026-110264. An integer overflow in the regex compiler leading to unauthenticated RCE. Apparently affects around 12 years(!) of GitLab releases. docs.gitlab.com/releases/pat… 3. Node.js / Brotli RCE CVE-2026-111497. An out-of-bounds write in the Brotli decoder that can lead to RCE when processing malicious compressed data. Node.js 22, 24 and 26 affected. nodejs.org/en/blog/vulnerabi… 4. DNS-over-QUIC DoS CVE-2026-97206. A use-after-free in Unbound’s DNS-over-QUIC implementation. Remote attackers can crash affected multi-threaded DNS resolvers. nlnetlabs.nl/projects/unboun… 5. eMudhra CA disaster And then there’s this absolute PKI clusterfuck. Eight intermediate CA private keys turned out to be ridiculously easy to reconstruct. Browser vendors have started blocking the affected CAs, but outdated clients and applications with their own trust stores could keep accepting certificates from them. Cleaning up this mess is a lot harder than just patching a server. Google’s analysis and response: blog.google/security/protect… Mozilla’s public incident investigation, including the technical findings, timeline and eMudhra’s explanations: bugzilla.mozilla.org/show_bu… — And I can’t help wondering how much of this sudden wave of discoveries has to do with the latest AI models getting better at code review and vulnerability research. We now have models that can dig through massive codebases and potentially find bugs that have been sitting there for years. I’m not saying these particular vulnerabilities were discovered using AI. I haven’t seen evidence for that. But I do wonder whether we’re starting to see some of the effects. The eMudhra case is obviously a different story. That’s a spectacular failure of key management and quality control. Anyway, quite a week. And it’s only Thursday…