Determinate Secure Packages 25.05 (Emergency Legacy Extension) is now available for those who I KNOW are stuck and freaking out about it.
Still on NixOS 25.05? Upstream support ended a long time ago, but we've patched eMudhra, PHP, and hundreds of other CVEs. Get critical security patches today without migrating to a new release.
Determinate Secure Packages 25.05 (Emergency Legacy Extension) is available now: determinate.systems/blog/emergency…
1
0
10
504
Graham Christensen retweeted
Here's an example of why the last week showed you *why* you want to learn nix flakes.
We're all going to be bumping versions of dependencies within our environment *a lot*. There will also be vulnerabilities like the brotli one that affect their own downstream dependencies that you need to update too.
With flakes, you have *one* dependency to bump: nixpkgs. You can even write high-level tests into the nix flake as checks. Now everything that produces an output artifact can be more easily auto-updated daily, on auto-pilot.
You probably don't want to pull in nixpkgs-unstable daily, but effectively something like nixpkgs-weekly[1] with critical vulnerabilities updated faster via overlays.
[1] flakehub.com/flake/Determin…
We're all going to be bumping versions of dependencies within our environment *a lot*. There will also be vulnerabilities like the brotli one that affect their own downstream dependencies that you need to update too.
With flakes, you have *one* dependency to bump: nixpkgs. You can even write high-level tests into the nix flake as checks. Now everything that produces an output artifact can be more easily auto-updated daily, on auto-pilot.
You probably don't want to pull in nixpkgs-unstable daily, but effectively something like nixpkgs-weekly[1] with critical vulnerabilities updated faster via overlays.
[1] flakehub.com/flake/Determin…
0
3
11
1,402
The @DeterminateSys team has been singularly focused on patching and mitigating the vulnerabilities released this week. We’ve shipped massive rebuilds to Determinate Secure Packages customers in just hours, and we’re more polished than ever. I’m real proud.
2
4
35
1,071
If you’re using Nix at work and are worried about your security exposure: reach out. We can get you setup on 25.11, 26.05, and rolling real quick.
0
0
5
172
Graham Christensen retweeted
My take: focus on requiring as many 0days as possible for an attacker to achieve their objectives and containing the spread after any security boundary is bypassed.
thesis: any sufficiently motivated person who has access to an abliterated GLM-5.3, or DS V4.1 Flash 1013 model and access to enough compute can do whatever they want right now
so, outrun the bear if you're big. or hide from the bear if you're small.
2
3
11
1,247
Determinate Nix v3.24.0 is rolling out now. For macOS users, it explicitly removes the compromised eMudhra certificates even if those certificates are present in your system keychain.
More details on the status page: status.determinate.systems/incidents/f7cd…
More details on the status page: status.determinate.systems/incidents/f7cd…
1
2
12
506
Graham Christensen retweeted
Not surprised at all they were duped into breaking embargo by a slop non-functional exploit: news.ycombinator.com/item?id=501767…
2
3
66
16,282
Determinate Secure Packages won’t help you here. 😥
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/critic…
2
1
28
1,208
Determinate Secure Packages has your back!
We've released updates for today's PHP critical remote code execution vulnerabilities to Determinate Secure Packages (including FIPS variants). To be clear, this is in addition to our already-pushed fixes for the eMudhra intermediate CA compromise.
As always, we urge all customers to update their flakes as soon as possible. For more details, see our status page.
status.determinate.systems
0
4
13
494
Graham Christensen retweeted
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
1,303
10,844
70,326
12,430,924
Determinate Secure Packages 25.11, 26.05, and rolling (including FIPS variants) are patched against all identified issues. We're continuing to monitor. Update now!
status.determinate.systems/incidents/f7cd…
status.determinate.systems/incidents/f7cd…
We at Determinate Systems are fully aware of the eMudhra intermediate CA compromise and are moving as quickly as possible to push fixes to all distributions of Determinate Secure Packages ⛔ 🔏
We will notify you here when we have done so, and we advise you to update your flakes ASAP at that time. Until then, we'll push any important updates to our status page.
status.determinate.systems
0
0
2
312
Graham Christensen retweeted
@grhmc 1: ECDSA, not RSA but others have already pointed this out.
2: The private RSA exponent is usually also not prime. The public key is the product of two secret primes, yes, but they are not actually used during the signing process and can be discarded after calculating the privkey
2: The private RSA exponent is usually also not prime. The public key is the product of two secret primes, yes, but they are not actually used during the signing process and can be discarded after calculating the privkey
1
1
53
1,902
Claude fucking loves to say "Every ____ but never ____" when those things are not strictly true together.
0
0
3
323
