This dumb password rule is from Deloitte GlobalAdvantage.

Rules that are completely arbitrary that basically make all safe passwords wrong,
instead forcing pseudo-safe password combinations.

https://dumbpasswordrules.com/sites/deloitte-globaladvantage/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Testprep Training.

The max password size is 20 characters

https://dumbpasswordrules.com/sites/testprep-training/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

So, I’ve mentioned before that I have a site I’ve had since 1995 that I had to strip down to a single page because a Chinese company started using my name, but seems to have no interest in buying the domain.

I tell you that story only to tell you this one, I’ve been hit over 50,000 times with ai bots in the last 12 hours. They’re doing lateral path searches, like /etc/passwd and /etc/shadow, and just pounding SSH. (HP1 has been slurped, confirmed.)

Anyway, if your #server has #bandwidth limits, now is a good time to check on those.

#infosec #sysop #StupidestTimelineEver

This dumb password rule is from Mes Services Étudiant.

At least 6 characters, one uppercase letter, one lowercase letter, one digit
and one "special character".

These do not count as "special characters": `` + - = | @ " ' # ( ) [ ] { } < > / \ ` ;``.

https://dumbpasswordrules.com/sites/mes-services-etudiant/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Minnesota Unemployment Insurance.

Locked to *exactly* 6 chars, alphanumeric only, not special chars.

https://dumbpasswordrules.com/sites/minnesota-unemployment-insurance/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from PagoMisCuentas.

Password must be between 8 and 15 alphanumeric characters, and have
at least one uppercase and one lowercase letter.

https://dumbpasswordrules.com/sites/pagomiscuentas/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Progressive Home by Homesite.

Password must be a minimum of 8 characters.

Passwords must have one lowercase character.

Passwords must have one uppercase character.

Passwords must have one number.

Passwords must have one special character in the following list: `!'#$ ~`!@#$%^&*()-_+=?<,>.{}[]|;:`

Furthermore, when resetti...

https://dumbpasswordrules.com/sites/progressive-home-by-homesite/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

#infosec

Alt...

The Doctor Who meme “is four a lot?” “depends on the context. as a private key? no. PHP vulnerabilities? yes.”

I think I've created the *least* secure multi-factor authentication code.

Please can you try adding this to your MFA app and tell me if it *doesn't* work (give me the app name & your phone's OS).

THANKS GANG!

#InfoSec #CyberSecurity #TOTP #MFA #2FA

Alt...

A QR Code.

This dumb password rule is from Canada Revenue Agency.

Password checklist:
- 8 to 16 characters
- At least 1 upper-case character
- At least 1 lower-case character
- At least 1 digit
- No space
- No accented characters
- No special characters except: dot (.), dash (-), underscore (_), and apostrophe (')
- No more than 4 consecutive identical characters

https://dumbpasswordrules.com/sites/canada-revenue-agency/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

wanna know something very hilarious?

a company that actually replied about their use of deleted-user.com and said they were fixing it about 6 months ago sent me 80 emails yesterday to random deleted-user.com emails reaffirming that they were not impacted by either eMudhra or php2shell, but were doing detailed checks on their infrastructure for other security issues.

phew!

I was quick to follow up with some snark

#infosec

Alt...

You gotta admit it’s pretty ironic that I got 80 copies of this email to random deleted-user.com email addresses yesterday ;-)

We can at least be glad that #php2shell was much easier to rapidly discover, patch, and mitigate in most shops than #log4shell was.

#InfoSec

Folks we've just got one more week of mandated cybersecurity awareness to get through, and then everything will return to normal.

...right?

#infosec #cybersecurity

This dumb password rule is from Slovenska sporitelna.

Slovenska sporitelna is the biggest bank in Slovakia. Despite pretty new version of the internet banking (rolled out in 2018), their password policy restricts password to be 16 characters long at most and prohibits any special characters.

https://dumbpasswordrules.com/sites/slovenska-sporitelna/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

@MaddieM4

I worked in #infosec in the "naughties." Even back then, I thought the prevalent concept of "security as a product" was laughable.

With all of the stuff that's going on today, I wish we'd just start over from scratch using NASA Apollo-esque coding standards. Do less, and make it solid. Heck, go for some Djikstraesque "provability." I dunno. Everything is just so slipshod.

(And to those reading, I'm not saying that as an attack on the PHP devs. They're doing the best they can with the resources they're given, and should be commended for working so hard to hold up 70% of the web, for crying out loud)

a reminder that if you see a vendor having an unscheduled outage today to apply PHP patches - that is actually one of the most encouraging things you can see from an #infosec perspective, because it means

A) someone/some people at the vendor is paying attention

B) that person/people has enough sway to have them bring down prod in the middle of the day to apply patches

C) enough people at the vendor actually know what software they are running to know its an issue that needs to be dealt with

So, reach out to them and let them know you appreciate it - so they have something to show people who push back the next time a similar thing happens

This dumb password rule is from Gebührenfrei MasterCard.

The new password can only have 6-12 characters. It *may* contain letters, numbers and a fixed set of special characters.

https://dumbpasswordrules.com/sites/gebuehrenfrei-mastercard/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

@briankrebs 🚨 A critical vulnerability🚨 affecting all PHP versions back to 5.4 allows attackers to execute arbitrary commands on the server without authentication. If you are responsible for any public-facing PHP-based system (Wordpress, forums, etc.) you'll want to take immediate action.

Reports call this one of the most serious security issues #PHP has ever faced. Working exploits are publicly available and attacks are underway. Reuters reports that government websites across Europe and elsewhere have been taken offline to prevent their attack.

Mitigations can be applied to the PHP.INI configuration file for immediate protection, but the PHP binaries should be updated. Patched releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

The PHP project's home page has all the details and mitigations: https://www.php.net/ #Infosec

New.

Socket: LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials https://socket.dev/blog/litellm-compromise @SocketSecurity #infosec #vulnerability #Docker #Python

The path to happiness and posterity runs through PHP. Here is some of the research dealing with that today - so far.

KrebsonSecurity: Widespread PHP Flaw May Cause Many Site Outages Today https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/ @briankrebs

Akamai: Critical Remote Code Execution Vulnerabilities in PHP Core https://www.akamai.com/blog/security-research/critical-remote-code-execution-vulnerabilities-php-core

Cisco: Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers https://blog.talosintelligence.com/parasitizing-trust-how-legitimate-infrastructure-becomes-a-delivery-pipeline-for-attackers/ @TalosSecurity

CrowdStrike: Two critical memory-corruption RCE vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 have been disclosed in core PHP https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/

Kaspersky: Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) https://securelist.com/tr/php2shell-critical-vulnerabilities-in-php/121596/ @Kaspersky

Sophos: Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619 @SophosXOps

Palo Alto: Millions of PHP Instances Exposed - What Organizations Need To Do Right Now https://www.paloaltonetworks.com/blog/2026/10/millions-of-php-instances-exposed-what-organizations-need-to-do-right-now/

VulnCheck: PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619 https://www.vulncheck.com/blog/php2shell-vulnerabilities @vulncheck

Socket: PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline https://socket.dev/blog/php-critical-rce-patches @SocketSecurity #vulnerability #threatresearch #infosec

RE: https://kolektiva.social/@Anarcat/117479816537748344

Head's up! #PHP patch #8512 may still be exploitable. #infosec

RE: https://fedi.katze.sh/@elise/117479383739450605

The hits keep coming this week. #InfoSec #php #php2shell

Fellow #Fedora #Linux #php users - please help test this update that patches #php2shell:

Fedora 44: https://bodhi.fedoraproject.org/updates/FEDORA-2026-a9eba4bbc3
Fedora 43: https://bodhi.fedoraproject.org/updates/FEDORA-2026-d5f8446449

#Linux #InfoSec

Does anyone have a list of IoC for the attacks based on the #php2shell vuln?

There seem to have been quite a wave of automated exploitation and usually this results in some Indicators of Compromise...

Now i am looking for those. Anyone has an idea?

#infosec

Once again, my professional recommendation in response to the latest Linux kernel vulnerability in the news is that you should gather up all your electronic devices, cast them into the sea, and retreat to the woods.

Each night, gather your children and tell them tales of the Before Times when the hubris of humanity grew so large that we made idols of sand and spoke to them as equals. Remind them that the sand, of course, did not speak or think, but we imagined it could, and let it guide us to folly.

Should a stranger ever come to your village with a glowing rectangle, encourage the youth to beat them with sticks.

#infosec

This dumb password rule is from Fundatec.

Must be exactly 6 alphanumeric characters, does not show special characters are not allowed, username is your social security number (easily searchable) and the form is sent over plain HTTP. Did I mention this company applies college entrance exams for **Computer Science** nationwide in Brazil?

https://dumbpasswordrules.com/sites/fundatec/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

#infosec

Alt...

off work late? hungry, but too tired to generate a private key? try 4 4: an easy to generate private key Put it directly on your root certificates with your fingers you will certainly not regret 4

I will start new #HardenedBSD builds tomorrow to account for #emudhra revocation in the base OS.

#infosec

No thanks PHP I’m still working on Log4j…

#Shitpost #infosec

This dumb password rule is from LCL.

You have to enter your 6-digit password using this Frenchy keypad.

https://dumbpasswordrules.com/sites/lcl/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Tanishq.

Password must contain:
- 6 to 16 characters.
- At least one special character (@, #, $, %, * and & only).
- At least one alphabet.
- At least one number.

https://dumbpasswordrules.com/sites/tanishq/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Crédit Agricole Centre-Est.

You have to enter your 6-digit password using this Frenchy keypad.

https://dumbpasswordrules.com/sites/credit-agricole-centre-est/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from PayPal.

Must be between 8 and 20 characters, no spaces, uppercase and lowercase, one symbol...

The rule limits special characters to !@#$%^&*(). but my current password has a "-" in it so someone decided to restrict this further which is totally backwards. Things are meant to get better not worse!

https://dumbpasswordrules.com/sites/paypal/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from AmiAmi.

Your password needs to be between 6 and 12 characters long, must contain only letters and numbers.

https://dumbpasswordrules.com/sites/amiami/

#password #passwords #infosec #cybersecurity #dumbpasswordrules