PHP, Tailscale, and Connectwise Storm-0940 | Streaming Security EP6

In this Streaming Security episode, the hosts break down a chaotic Cybersecurity Awareness Month: the ConnectWise/SkyKick backup compromise, a CA issuing guessable private keys, Tailscale disclosure drama, and PHP/Node.js "to shell" vulnerabilities 0:23.

Key Takeaways:
• ConnectWise/SkyKick compromise exploited overprivileged enterprise apps; a nation-state actor used a stolen key to enumerate thousands of M365 tenants—audit enterprise apps and limit app registration rights 3:59.
• Provision backup write access only for restores; don't delete your only backup tool without a continuity plan 6:26.
• CA eMudra issued P-384 private keys that were small whole numbers—apparently misunderstanding key generation; it has exited the certificate business 13:57.
• Tailscale's 11 findings were dumped as unreadable "AI slop" instead of responsible disclosure; issues require auth and non-default SSH, and Tailscale responded quickly—better disclosure norms are needed 23:24.
• PHP and Node.js 9.2 "to shell" bugs (Brotli decoder) dropped within days; a PoC took ~9 hours and exploits hit honeypots 4 days pre-disclosure—patch embedded products urgently 34:38.
• Reduce attack surface, automate patching (CIS 7.4), and treat infrastructure as ephemeral "cattle" 52:37.

The theme: trust and convenience—not just code—form the attack surface, so disciplined fundamentals remain the best defense.

Sources:

• 0:23 Episode intro
• 3:59 SkyKick compromise and app audit guidance
• 6:26 Backup mitigation and continuity planning
• 13:57 eMudra trivial P-384 keys
• 23:24 Tailscale disclosure and response
• 34:38 PHP/Node.js vulnerabilities, pre-disclosure exploitation