Phillip :usa_distress:

IT admin/automation engineer in the SCADA world. Privacy, security, libre nerd. Fedi since ~2019.

I like disc golf, D&D, music, plants, reading, and gaming.

Average Security (npub1ztx…9t6d)

Happy to answer any #Homelab questions!

Proud ally 🏳️‍🌈🏳️‍⚧️

Ask for Signal

I generally accept follow requests if we’ve interacted and/or your profile looks like a real person.

He/him

#nobridge #noindex #nobot

Blog: https://phunky.cafe

Public Key

npub1q0pr4zjlqrw5733xr6t2wdk5km29t380g67aqyll29va484uw2wsr7z62p

NIP-05 Address

phillip_at_social.lol@momostr.pink

Profile Code

nprofile1qqsq8s363f0sph20gcnpa948xm2td4z4cnh5d0wsz0l4zkw6n67898gprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmnteu4xf6

Publishing to

relay.momostr.pink

Author Public Key

npub1q0pr4zjlqrw5733xr6t2wdk5km29t380g67aqyll29va484uw2wsr7z62p

Show more details

Published at

2026-09-02T19:01:55Z

Kind type

0 Metadata

Event JSON

{ "id": "2041a6846279808edf1f0ab1026665507fc1dd3444e445201945cc808fdaa003", "pubkey": "03c23a8a5f00dd4f46261e96a736d4b6d455c4ef46bdd013ff5159da9ebc729d", "created_at": 1788375715, "kind": 0, "tags": [ [ "emoji", "usa_distress", "https://s3.eu-central-003.backblazeb2.com/social-lol-media/custom_emojis/images/000/296/919/original/8f97f702344fc4c2.png" ], [ "t", "homelab" ], [ "t", "nobot" ], [ "t", "noindex" ], [ "t", "nobridge" ], [ "proxy", "https://social.lol/users/phillip", "activitypub" ], [ "L", "pink.momostr" ], [ "l", "pink.momostr.activitypub:https://social.lol/users/phillip", "pink.momostr" ], [ "-" ] ], "content": "{\"name\":\"Phillip :usa_distress:\",\"about\":\"IT admin/automation engineer in the SCADA world. Privacy, security, libre nerd. Fedi since ~2019. \\n\\nI like disc golf, D\u0026D, music, plants, reading, and gaming. \\n\\nnostr:npub1ztxv0agdr9d26d3kvf6cnfwnp9f9qs4zl0srf5dv9pe0d640qeqq629t6d\\n\\nHappy to answer any #Homelab questions!\\n\\nProud ally 🏳️‍🌈🏳️‍⚧️\\n\\nAsk for Signal\\n\\nI generally accept follow requests if we’ve interacted and/or your profile looks like a real person.\\n\\nHe/him\\n\\n#nobridge #noindex #nobot\\n\\nBlog: https://phunky.cafe\\n\",\"website\":\"https://social.lol/@phillip\",\"picture\":\"https://s3.eu-central-003.backblazeb2.com/social-lol-media/accounts/avatars/114/043/586/214/955/480/original/8ba534c0e47d8e83.png\",\"banner\":\"https://s3.eu-central-003.backblazeb2.com/social-lol-media/accounts/headers/114/043/586/214/955/480/original/36de0ad526a15b05.jpeg\",\"nip05\":\"phillip_at_social.lol@momostr.pink\"}", "sig": "62b50fefabab0cae35123d3814cb40e45ffaf107612b42926b500f644b30630fc64fac680d4db804cfe53a2b60c5991de2a2bcda2b07bf60d34e25fb6ed2aac7" }

Last Notes

2026-09-03 22:05:39 UTC

- reply

Aaand that’s why email is one of the only things I don’t self-host.
Realistically, I rarely send emails, so I could probably self-host it anyways. Sounds like too much headache in the few times that I do want to send an email though. Wish that wasn’t the case :/

2026-09-03 21:02:10 UTC

- reply

Set up multiple accounts and use each like a separate drive in a RAID. If one account gets popped, the data stays

2026-09-03 18:32:20 UTC

- reply

My self-hosted apps that I often fuck up and tinker with still have better uptime than an alarming number of corporate services. It’s kind of insane

2026-09-02 19:01:54 UTC

- reply

This is either a typo of “nudes” or a new name for bots in a botnet. A dudenet, if you will

2026-08-27 16:08:48 UTC

My therapist is the goat. Thank you for coming to my TED talk

2026-08-26 20:43:51 UTC

- reply

I’ve had plant operators panic over phishing emails pretending to be the feds, but that’s about it

2026-08-26 15:46:20 UTC

- reply

Impact:
CVSS Severity and Metrics:
Base Score: 9.6 Critical
Vector:
CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE: CVE-2026-77532 (Will Robertson)

2026-08-26 15:33:42 UTC

- reply

Finally got around to checking my RSS feeds. Make that 22
https://community.ui.com/releases/Security-Advisory-Bulletin-068-068/b95ea5e8-1a80-4ffc-ad42-625eae300cc9

2026-08-17 15:42:23 UTC

- reply

It’s pay-what-you-want ransomware. The minimum is just 12k, but you can throw more money their way if you like their work

2026-08-11 15:51:41 UTC

- reply

Ah, I see. It’s both!
https://infosec.exchange/@briankrebs/117076896551534562

2026-08-11 15:49:43 UTC

- reply

Is there a news story I missed? Or we are just shitposting about Southwest® WiFi?

2026-08-10 18:29:27 UTC

- reply

Brb, hacking people’s homelabs to use them as distributed meme storage

2026-08-10 18:25:11 UTC

- reply

Dear [Customer’s Name],
We are writing to inform you of a data security incident that may have involved some of your memes. At [Company Name], we take the protection and privacy of your data very seriously, and we are committed to keeping you informed about important updates regarding your memes.

2026-08-10 18:18:33 UTC

- reply

The water cycle marches on 😤✋
The meme cycle marches on 😌👍

2026-08-10 18:13:20 UTC

- reply

https://s3.eu-central-003.backblazeb2.com/social-lol-media/media_attachments/files/117/072/566/251/357/180/original/d9e040c893b44ebe.jpeg

2026-08-10 18:07:52 UTC

RE: https://social.lol/@phillip/117061432689860232
The postmortem of the hack on my Forgejo instance is here! I had fun investigating and writing it, so I hope y’all enjoy reading about it :)
#Homelab #SelfHosted #Cybersecurity #Infosec
https://phunky.cafe/my-homelab-got-hacked/
#note1fm4…a3d4

2026-08-10 03:30:47 UTC

RE: https://social.lol/@phillip/117061432689860232
Writeup just needs proofreading, and that is not a tonight activity. Should be up tomorrow tho. Some fun stuff in it! 😃
#note1fm4…a3d4

2026-08-08 19:01:48 UTC

Welp. My Forgejo instance got popped by CVE-2026-60004. Hooray for RCE 🙃
My two screw-ups were
1. I pinned it to v13 "for stability" forever ago, then forgot about it.
2. I accidentally left sign-ups enabled.
Grabbed the seemingly obfuscated payload script from the attacker's server. Looks like it hits a different IP and grabs one of three different binaries depending on the victim's CPU architecture. You best believe I'm grabbing those too
Will probably write a blog post on what I find, but I'll at least post updates here, too
#Homelab #SelfHosted #PatchYourShit #Forgejo

2026-08-05 02:07:12 UTC

- reply

we had a plant reach out to us in a panic the other day claiming their PLCs were taken offline by “the Russians”.
Turns out it was a phishing email from “the FBI” trying to trick them into asking for help with remediation. No one even checked whether their PLCs were working before they reached out to us 🤦

2026-08-04 15:30:34 UTC

- reply

brb, making this into a sticker and putting it on people’s cars at the loud af car meets downtown

2026-07-20 21:57:17 UTC

- reply

I like this. It could even be that software engineering is undergrad, while computer science takes PhD. Masters’ could go either way imo
Though the fundamentals I learned in my CS undergrad still prove useful, so those should definitely stick around

2026-07-20 21:51:44 UTC

- reply

The ego tripping is CRAZY. So many people huffing farts

2026-07-14 15:49:11 UTC

- reply

Is that a bottle of Adderall in your pocket, or are you just happy to see me?

2026-07-14 15:43:59 UTC

- reply

Does that make Adderall an aphrodisiac?

2026-07-14 15:34:25 UTC

- reply

There are two wolves inside of you

2026-07-10 14:07:39 UTC

- reply

Scattered Spider 🕷️injected 💉 a load 🍆💦 into our 😳 backend 🍑 ‼️🫦

2026-07-02 16:26:30 UTC

- reply

../ spotted!
Summary 7 of 25
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypass authentication of such UniFi OS devices or instances.
CVE-2026-54403

2026-07-02 16:05:56 UTC

- reply

I guess Ubiquiti felt left out after Microslop’s biggest Patch Tuesday ever

2026-06-10 23:33:19 UTC

@npub1s6e…n008 the vulns will continue until security improves.
Yes, those are 10 unique Axios vulns. Yes, 5 of them are from the last week.
https://s3.eu-central-003.backblazeb2.com/social-lol-media/media_attachments/files/116/728/423/714/079/406/original/f8d1b82a4f0459e0.png

2026-06-09 22:13:17 UTC

- reply

fwiw Eclipse has third-party git hosting now! 😃
https://git.projectnightcrawler.dev/NightmareEclipse

2026-06-09 20:18:35 UTC

- reply

Well this bodes well
https://www.reddit.com/r/servicenow/comments/1u0c45c/comment/oqnak5k/

2026-06-01 16:01:44 UTC

Github Copilot’s new pricing model went live today and r/GithubCopilot is having a meltdown. It’s glorious

2026-05-29 17:42:09 UTC

- reply

Bluetooth scares me
That would actually be a good sticker

2026-05-29 17:41:21 UTC

- reply

I just checked. I have a thread of 4 emails, each warning about a different axios vulnerability. All within the last month and a half. I’m sure I have more that got deleted already too

2026-05-29 17:38:19 UTC

- reply

I have an old private repo on my GitHub from when I was first getting into web dev that uses axios. I haven’t looked at it in years, but I still get GitHub security emails every time a new Axios vuln is announced lol

2026-05-29 15:59:03 UTC

- reply

:verified_blobcat: ✨MKUltwa✨ :verified_neko:

2026-05-22 03:54:02 UTC

- reply

AI companies scraped shitposts confirmed

2026-05-21 16:51:02 UTC

- reply

This is literally the Black Mirror episode White Christmas