Category Archives: Security

Security

PHP2Shell: ini won’t save you

Leave a comment

PHP ships fixes for two critical bugs at 16:00 CEST today, 21 October, and the only thing really confirmed about them so far is the high score.

The short version

The people with the least PHP expertise sit most exposed in the gap between a vulnerability leak and patch. The controls below are free and won’t take long.

Details

Most of the web runs on PHP and this bug is in a file upload interface that’s like a front door with no lock. An attacker does not need to know which site they are hitting or even the actual software it runs. They send one crafted upload to any server they can find, and that is the entire attack. Anything still on old, unsupported versions of PHP, which is a lot of small businesses and forgotten boxes, has no fix being offered (yet). This is how to lose control to attackers. So let’s talk about what to do.

Known knowns

This much has been confirmed by PHP: the notice on php.net announces two critical vulnerabilities, both rated CVSS v4.0 9.2, and a request that everyone prepare to upgrade immediately after a 16:00 CEST announcement. PHP reserves the right to release earlier if details leak or exploitation starts. Their notice gives no CVE IDs, no component, and no affected versions.

Reported but unconfirmed by PHP: the identifiers CVE-2026-109618 and CVE-2026-109619, and a link to session.upload_progress handling in ext/session. CERT-EU’s advisory says explicitly that it rests on leaks. GMO Flatt Security says its own research overlaps with the reports and warns the write-up may be inaccurate. Huntress reports that watchTowr reproduced CVE-2026-109618. A public exploit exists, and its author claims a second path through the multipart parser that no ini setting closes.

Attacks: Cloudflare’s CTO reported early attacks at 07:43 UTC and shipped stopgap WAF rules to all plans. Huntress and watchTowr had seen none as of their last updates. Tweakers, the Dutch House of Representatives, the Dutch NCSC and Security.NL took their sites offline at 10:35 UTC as that has been the growing “best practice” in the wait.

Disputed: a GitHub repository posted this morning claims the use-after-free described in the public bundle does not exist in released PHP. Kevin Beaumont reads the leaked write-up as probably machine-generated and in the right ballpark on one of the two bugs. The bundle may be wrong, or the real bugs may need further hunting. Either way the patch is the fix.

What now?

Step 1: Inventory

We patch what we know needs it. List every host, container image, and shared-hosting account running PHP, with the version and SAPI (mod_php, PHP-FPM, or CGI) for each. Include the places people forget: CI runners, staging boxes, old WordPress and Joomla installs, vendor appliances with embedded PHP, Windows software bundling its own PHP, and base images in your registry.

PHP supports only 8.2 and later. Huntress names PHP 5, 7, 8.0 and 8.1 as the versions that need upgrading or isolation. CERT-EU advises isolating internet-facing applications from public networks where patching is delayed.

Step 2: Be skeptical about the ini setting

Two people inside the PHP project have said ini mitigation advice being spread is NOT a mitigation.

Core developer Gina Peter Banyard, replying to the suggestion at 02:13 UTC, wrote that the only mitigation is patching or upgrading PHP, and added that taking a server offline for a day is the most sensible option for anyone who can afford it. Release manager Joe Ferguson put it shorter:

ini settings won’t save you

Set session.upload_progress.enabled = 0 anyway. It’s easy and closes the thing that the leak is leaking to us. Upload progress tracking only drives progress bars, which WordPress, Magento and most applications never use anyway. The PHP manual lists the setting as on by default and changeable only per directory, so ini_set() in application code has no effect on it. Put the line in a drop-in under the web SAPI’s conf.d (for example /etc/php/8.3/fpm/conf.d/99-no-upload-progress.ini), restart PHP-FPM or Apache, and verify from a web request. php -i shows the CLI configuration, which is separate. On shared hosting use the control panel’s php.ini editor or a .user.ini, which should take just minutes to apply.

Step 3: Keep multipart away from PHP

The multipart parser runs on every multipart/form-data POST before any application code, so the one configuration change that keeps PHP out of that code entirely is refusing those requests at the web server.

  • For nginx, in every server block that passes to PHP:

    if ($http_content_type ~* “multipart/form-data”) { return 403; }

  • For Apache: a RewriteCond on %{HTTP:Content-Type} matching multipart with a [F] rule.
  • For Fastly, a simple recv VCL snippet:

    if (req.method == “POST” && req.http.Content-Type ~ “(?i)multipart/form-data”) {
    error 403 “Forbidden”;
    }

    An edge requires an origin to refuse connections from everywhere else: lock the origin firewall to your CDN’s published IP ranges.

This breaks every file upload on the site, including the WordPress media library, but it buys time until the patch lands.

If you can go further, allow only GET and HEAD, which leaves the site readable and closes every write path. If you can go further still, stop PHP-FPM and serve a static maintenance page. The maintenance modes inside WordPress and Magento do not help, because PHP parses the request before the application sees the flag.

If uploads must stay open, narrow them: reject multipart on every path except the upload endpoints, set a conservative body cap (for nginx, client_max_body_size) everywhere else, and put admin and internal applications behind a VPN or an authenticating proxy. One rule costs nothing: block any multipart POST whose body contains the field name PHP_SESSION_UPLOAD_PROGRESS, which legitimate traffic never carries. Treat it as a tripwire for one reported path, since a WAF parses multipart bodies differently from PHP.

Signature-based WAF rules for this bug are guesses. Cloudflare only covers traffic that reaches the origin through Cloudflare. Use edge rules to shrink the attack surface until the patch rolls.

Step 4: Depth to defense

A memory corruption bug simply opens the door, and so there is also defense work inside to be done.

Disable the functions you leave unused via disable_functions (system, exec, passthru, shell_exec, proc_open, popen). A memory-corruption exploit can sometimes bypass this, so it raises the cost without guaranteeing safety. Run each PHP pool as its own unprivileged user, keep web roots read-only for that user, and restrict outbound network access from web servers so a shell has nowhere to call home. Confirm PHP workers can only read the credentials they need.

Step 5: Watch for exploitation

Evidence of attempts is visible without knowing the exact bug.

Crashes: repeated worker segfaults in the PHP-FPM log (child exited on signal 11) or Apache error logs, especially clustered in time or from one source. Failed memory-corruption attempts often crash before they succeed.

Request patterns: bursts of multipart POSTs to endpoints that take no uploads, followed by a second quick request from the same source. The upload-progress field lives in the POST body and never reaches the access log, so look at who is POSTing to what.

Process behavior: the PHP or web-server user spawning a shell, sh or bash as a child of php-fpm or apache, or making unexpected outbound connections. On Linux, an auditd or EDR rule on execve from those parents is cheap and high-signal. Huntress points to Florian Roth’s process-watcher as a free option.

Persistence: new or recently modified .php files in upload and cache directories, new cron entries for the web user, and unfamiliar SSH keys. Compare against a known-good deployment hash if you have one.

Keep the logs. If you find something after the patch, you need to look before the patch.

Step 6: Patch when the release lands

The fixed version numbers arrive with the 16:00 CEST announcement. Version numbers in pre-release analysis were guesses, versus what you will get from php.net.

Your distribution’s tracker matters more than the php.net version number. Debian, Ubuntu, Red Hat and the official Docker images backport fixes under their own package versions, and none of them had a page for either CVE as of 20 October. If your PHP comes from Remi’s repository, the PHP Foundation says it will not update today; plan on distribution packages or a source build.

When the release ships: read the official advisory for the real affected component, upgrade, fully restart PHP-FPM or Apache, and confirm the running version from a web-served request rather than the package manager. For containers, rebuild images and redeploy rather than patching in place. Managed hosts will lag. Ask your provider for a date today.

After patching, remove the multipart block and re-enable upload progress only if something needs it.

PHP has been here before

PHP has twice seen this before. In 2012 a request-handling bug (CVE-2012-1823) leaked by accident from PHP’s own bug tracker, the rushed fix was broken within hours, and attackers have hunted it ever since. In 2024 a cousin of that bug on Windows (CVE-2024-4577) was patched on a Thursday and in ransomware by that weekend. Both were simpler than this week’s bug. The pattern is still that a fix arrives and attackers move faster than the people who run the servers, and the conversation is all about widespread infrastructure code nobody maintains.

This post will be updated when the advisory is published.

History, Security

Opa war kein Nazi, sagt die Familie: Weber, Merz und die ungelesenen Akten

Leave a comment

English | Deutsch

Isabella Weber hat ein neues Buch. Der Guardian hat es am 16. Oktober vorgestellt: Anti-Fascist Economics: In Defence of Affordability, Dignity and Democracy (Allen Lane). Das Rezept passt in einen Satz, und der Artikel liefert ihn: make life’s necessities affordable.

“Fascism is rising from frustration, born out of a crisis of livelihoods,” says Weber. “So, we need to reclaim these essentials now.”

Die deutsche Aktenlage sagt das Gegenteil. Niedrige Preise waren ein Werkzeug des faschistischen Regimes. Gegen das Regime haben sie nichts ausgerichtet.

Die Preise fielen von 1929 bis 1932 in jedem Jahr. Heinrich Brüning regierte mit Notverordnungen, senkte Löhne, Gehälter und Sozialleistungen und erhöhte Steuern; die Bundeszentrale für politische Bildung nennt das radikale Deflationspolitik und verzeichnet den Beinamen, den sie ihm eintrug: „Hungerkanzler“. Seine vierte Notverordnung vom 8. Dezember 1931 ließ die Preise nicht nur fallen. Sie ordnete die Senkung an. Gebundene Preise, also Kartell- und Markenartikelpreise, waren ab Januar 1932 um mindestens zehn Prozent gegenüber dem Stand von Mitte 1931 zu senken, überwacht von einem Reichskommissar für Preisüberwachung mit Durchsetzungsbefugnissen, wie ein Bericht aus dem Büro des Kommissars 1933 darlegt. Die registrierte Arbeitslosigkeit überschritt im selben Winter sechs Millionen.

Der Stimmenanteil der NSDAP stieg in jedem dieser Jahre.

Reichstagswahl Anteil NSDAP
20. Mai 1928 2,6 %
14. September 1930 18,3 %
31. Juli 1932 37,3 %
6. November 1932 33,1 %

Quelle: Deutscher Bundestag. Sieben Monate nach einer Verordnung, die die Preise um zehn Prozent senkte, holte die NSDAP 37,3 Prozent und wurde stärkste Fraktion im Reichstag.

Webers Schule hat darauf eine Antwort, und sie hat Belege. Galofré-Vilà, Meissner, McKee und Stuckler, “Austerity and the Rise of the Nazi Party”, Journal of Economic History (2021), haben Wahldaten aus tausend Kreisen und hundert Städten für vier Wahlen zwischen 1930 und 1933 mit Ausgabenkürzungen und Steuererhöhungen abgeglichen und dort höhere NSDAP-Anteile gefunden, wo die Kürzungen am tiefsten gingen. Ich akzeptiere den Befund. Man lese, was er misst. Die Variable ist der Rückzug des Staates: gekürzte Leistungen, erhöhte Steuern. Die Preise liegen außerhalb, weil dieselbe Regierung sie zur selben Zeit nach unten drückte. Austerität und billige Waren kamen zusammen, und die Stimmen gingen an die Partei, die Arbeit und Rache versprach. Billiges Brot hat der Republik nichts eingebracht.

Dann das Ende, das ein Geschäft war. Die NSDAP verlor im November 1932 zwei Millionen Stimmen. Hindenburg ernannte Hitler am 30. Januar 1933 nach diesem Verlust zum Reichskanzler, in einem Kabinett, das Franz von Papen und die Konservativen um den Reichspräsidenten arrangiert hatten. Die Reichstagsbrandverordnung vom 28. Februar setzte die Grundrechte außer Kraft. Die Wahl vom 5. März fand unter dem Terror der SA statt. Der Reichstag nahm am 23. März das Ermächtigungsgesetz an, und das Gesetz vom 14. Juli 1933 machte die NSDAP zur einzigen zugelassenen Partei. Ernannt, dann verankert. Eine Mehrheit hat zu keinem Zeitpunkt dafür gestimmt.

Dann tat das Regime, was Weber empfiehlt. Am 26. November 1936 erließ der Reichskommissar für die Preisbildung die Verordnung über das Verbot von Preiserhöhungen, ein allgemeines Verbot von Preiserhöhungen für Waren, Dienstleistungen und Mieten, festgeschrieben auf den Stand vom 18. Oktober 1936; das Berliner Institut für Konjunkturforschung berichtete über die Verordnung in der Woche ihres Erlasses. Im März 1937 hielt dasselbe Institut fest, dass die Preise des Groß- und Einzelhandels noch immer ein Fünftel bis ein Viertel unter ihrem Höchststand von 1928/29 lagen. Der Preisstopp deckelte die Inflation, die die Aufrüstung über Mefo-Wechsel aufgebaut hatte. Adam Tooze legt den Mechanismus in The Wages of Destruction (2006) dar: Preise auf dem Papier gehalten, während die Qualität sank und die Waren knapp wurden, am wenigsten zu verbergen in der Fettlücke von 1935 und 1936. Das Regime lieferte den Anschein bezahlbarer Grundgüter, und der Anschein genügte.

Götz Aly ging in Hitlers Volksstaat (2005) weiter: Das Regime habe sich Loyalität mit Steuererleichterungen und Wohltaten erkauft, finanziert durch Raub und „Arisierung“. Die These ist umstritten. Tooze antwortete in der taz, Aly habe die Kosten des Krieges für die Deutschen grob unterschätzt, weil er nur die Steuern zähle und die Anleihen weglasse; Johannes Bähr nannte das Buch die Legende von der „Wohlfühldiktatur“. Dieser Streit geht um die Frage, wer bezahlt hat. In dem Punkt, auf den es hier ankommt, sind sich die Parteien einig: Billige Grundgüter, echt oder inszeniert, waren eine Technik des Regimes.

Eine Demokratie, die ihren Fall auf billige Grundgüter stützt, hat keine Antwort, wenn ein starker Mann sie billiger liefert. Das zeigt 1936.

Webers eigenes Beispiel im Artikel zeigt den Mechanismus im Betrieb. Mexikanische Händler deckeln den Gesamtpreis eines Korbs von zwei Dutzend Grundgütern, der canasta básica, und die Regierung belohnt sie mit Zoll- und Steuererleichterungen, “and at a weekly press conference lauds those who do a good job and calls out those who don’t”. Das Urteil des Artikels: “In Mexico’s 2024 presidential election, the governing Morena party increased its vote share from 55% to 61%.”

Dieselbe Regierungspartei hat das Mandat dann eingesetzt. Im September 2024 verabschiedete der Kongress die Justizreform, die jeden Richter des Landes zur Volkswahl stellt, und eine Mehrheit der Bundesstaaten ratifizierte sie. Acht der elf Richter des Obersten Gerichtshofs, die Präsidentin des Gerichts darunter, traten zurück, statt zu kandidieren. Bezahlbarkeit kaufte Stimmen für eine Regierung, die Macht konzentriert. Das Beispiel spricht gegen das Buch, das es anführt.

Der Demagoge kann versprechen, ohne zu liefern, und einen Feind beschuldigen, wenn das Versprechen scheitert. Donald Trump in Bozeman, Montana, am 9. August 2024:

Starting on day one, we will end inflation and make America affordable again, to bring down the prices of all goods.

Trump in einer Kabinettssitzung am 2. Dezember 2025:

Look, affordability’s a hoax that was started by Democrats who caused the problem of pricing.

Das ist der volle Zyklus in sechzehn Monaten. Eine Ökonomin, die den Fall der Demokratie auf Bezahlbarkeit baut, tritt zu den Bedingungen des Demagogen an, und der Demagoge darf lügen.

Der Artikel schließt mit der Familie.

Family legend is that her grandfather, a priest in the Ruhr Valley, refused to hang a swastika in his church.

Der Satz stammt vom Journalisten, und “family legend” ist seine Formulierung. Der Großvater bleibt ungenannt. Die Legende ist der gesamte Beleg.

Die Akten existieren, und sie sind zugänglich. Ein “priest” mit Enkeln im Ruhrgebiet ist aller Wahrscheinlichkeit nach ein evangelischer Pfarrer. Die evangelische Kirche führte Personalakten über ihre Geistlichen, und diese Akten liegen je nach Gemeinde im Landeskirchlichen Archiv der Evangelischen Kirche von Westfalen in Bielefeld oder im Archiv der Evangelischen Kirche im Rheinland in Düsseldorf. Die NSDAP-Mitgliederkartei liegt im Bundesarchiv, das auf seiner eigenen Seite festhält, dass ein unterschriebener Aufnahmeantrag Bedingung der Aufnahme war. Die Entnazifizierungsakten für ganz Nordrhein-Westfalen liegen im Landesarchiv NRW in Duisburg, das im August 2023 rund 610.000 davon online gestellt hat, nach Namen durchsuchbar.

Das Hakenkreuz in der Kirche ist selbst eine dokumentierte Frage. Kirchen mit Hakenkreuzen zu schmücken war die Praxis der Deutschen Christen, der nationalsozialistischen Fraktion, die die Kirchenwahlen vom Juli 1933 gewann. Pfarrer, die sich weigerten, hinterließen Akten: Otto Mörike in Württemberg verlangte im März 1933, dass die Fahne von seinem Kirchturm abgenommen wird, und die Flaggenerlasse seiner Landeskirche aus jenem Frühjahr stehen in der Akte. Die Frage, die eine Akte beantwortet, lautet also, auf welcher Seite die Kirche des Großvaters stand, Deutsche Christen oder Bekennende Kirche. Eine Legende beantwortet nichts. Ich behaupte nichts darüber, wer er war oder was er tat. Der Punkt ist, dass sie Legende anbietet, wo Akten vorliegen.

Ihre Großvatergeschichte ist das nationale Muster, keine Ausnahme. Harald Welzer, Sabine Moller und Karoline Tschuggnall haben für „Opa war kein Nazi“. Nationalsozialismus und Holocaust im Familiengedächtnis (Fischer, 2002) vierzig deutsche Familien befragt. Die Familien behalten die offizielle Erzählung von der deutschen Schuld bei und verschieben die eigenen Großeltern auf die Seite der Zuschauer, der Opfer und der Widerständler, und mit jeder Generation wird der Großvater besser. Der Begriff der Autoren dafür ist kumulative Heroisierung.

Die andere Seite der deutschen Politik erzählt dieselbe Geschichte. Friedrich Merz über seinen Großvater Josef Paul Sauvigny, Bürgermeister von Brilon von 1917 bis 1937:

Datum Aussage oder Akte
2004, Merz schriftlich Großvater „ohne eigenes Zutun“ in die NSDAP eingetreten, habe sich „geweigert“ beizutreten, sei „kein Nationalsozialist“ gewesen
Januar 2025, Merz im Zeit-Podcast „Alles gesagt“ Großvater „in diese Abgründe des Nationalsozialismus hineingeraten“
März 1936, Vermerk des Landrats Sauvigny „von Anfang an als SA-Mann eifrig betätigt“
Personalakte, Landesarchiv NRW Mitgliedsantrag gestellt zwischen Mai 1933 und Februar 1936
NSDAP-Mitgliederkartei, Bundesarchiv Mitglied seit 1. Mai 1937

Kersten Augustin und Martin Teigeler haben die Akten am 8. Mai 2025 in der taz veröffentlicht. Merz hat der taz nicht geantwortet. Ein Detail aus ihrem Text: Der Wortlaut von Merz aus dem Jahr 2004 deckt sich fast wörtlich mit der Erklärung, mit der sich sein Großvater 1946 vor dem Entnazifizierungsausschuss selbst entlastete. Die Familienlegende war der Persilschein des Großvaters, unverändert weitergereicht.

Ein konservativer Bundeskanzler und eine antifaschistische Ökonomin erzählen dieselbe Familiengeschichte. Das Muster ist national, nicht parteilich.

Die Würde steht im Titel des Buches. In den Akten hat das Regime, das die Preise einfror, jedem die Würde genommen, den es dafür auswählte, und der Preisstopp half ihm, die übrigen zu halten. Eine Demokratie, die ihren Fall auf billige Grundgüter stützt, hat keine Antwort, wenn ein starker Mann sie billiger liefert. Das zeigt 1936.

History, Security

Low Prices Were a Nazi Tool: Isabella Weber’s Anti-Fascist Economics Gets 1936 Backwards

Leave a comment

English | Deutsch

Isabella Weber has a new book out. The Guardian profiled it on 16 October: Anti-Fascist Economics: In Defence of Affordability, Dignity and Democracy (Allen Lane). The prescription fits in one sentence, and the article gives it in one: make life’s necessities affordable.

“Fascism is rising from frustration, born out of a crisis of livelihoods,” says Weber. “So, we need to reclaim these essentials now.”

The German record says the opposite. Low prices were a tool of the fascist regime. They did nothing to stop it.

Prices fell every year from 1929 to 1932. Heinrich Brüning governed by emergency decree, cut wages, salaries and benefits and raised taxes; the Bundeszentrale für politische Bildung calls it radical deflation and records the name it earned him, “Hungerkanzler”. His fourth emergency decree of 8 December 1931 went beyond letting prices fall. It ordered them down. Bound prices, meaning cartel and branded-goods prices, had to be cut by at least ten percent against their mid-1931 level from January 1932, under a Reich commissioner for price supervision with powers to enforce it, as a 1933 account from inside the commissioner’s office sets out. Registered unemployment passed six million the same winter.

The Nazi vote rose through every one of those years.

Reichstag election NSDAP share
20 May 1928 2.6 %
14 September 1930 18.3 %
31 July 1932 37.3 %
6 November 1932 33.1 %

Source: Deutscher Bundestag. Seven months after a decree cutting prices by ten percent, the NSDAP took 37.3 percent and became the largest party in the Reichstag.

Weber’s school has an answer to this, and it has evidence. Galofré-Vilà, Meissner, McKee and Stuckler, “Austerity and the Rise of the Nazi Party”, Journal of Economic History (2021), matched voting data from a thousand districts and a hundred cities across four elections between 1930 and 1933 against spending cuts and tax increases, and found higher Nazi vote shares where the cuts went deepest. I accept the finding. Read what it measures. The variable is the state withdrawing: benefits cut, taxes raised. Prices sit outside it, because the same government was pushing prices down at the same time. Austerity and cheap goods arrived together, and the vote went to the party promising work and revenge. Cheap bread bought the republic nothing.

Then the end, which was a transaction. The NSDAP lost two million votes in November 1932. Hindenburg appointed Hitler chancellor on 30 January 1933 after that loss, in a cabinet arranged by Franz von Papen and the conservatives around the president. The Reichstag Fire Decree of 28 February suspended civil liberties. The election of 5 March was held under SA terror. The Reichstag passed the Enabling Act on 23 March, and the law of 14 July 1933 made the NSDAP the only legal party. Appointed, then entrenched. A majority voted for it at no point.

The regime then did what Weber recommends. On 26 November 1936 the Reich commissioner for price formation issued the Verordnung über das Verbot von Preiserhöhungen, a general ban on price increases for goods, services and rents, pegged to the level of 18 October 1936; the Berlin Institut für Konjunkturforschung reported the decree the week it came out. In March 1937 the same institute recorded that wholesale and retail prices still stood a fifth to a quarter below their 1928/29 peak. The freeze capped the inflation that rearmament on MEFO bills had built up. Adam Tooze sets out the mechanism in The Wages of Destruction (2006): prices held on paper while quality fell and goods ran short, the fat shortage of 1935 and 1936 being the case the regime could least hide. The regime delivered the appearance of affordable essentials, and the appearance was enough.

Götz Aly went further in Hitlers Volksstaat (2005): the regime bought loyalty with tax relief and benefits financed by plunder and “Aryanisation”. The thesis is contested. Tooze answered in the taz that Aly had grossly underestimated what the war cost Germans by counting taxes and leaving out the bonds; Johannes Bähr called the book the legend of the “Wohlfühldiktatur”. That dispute is about who paid. On the point that matters here the parties agree: cheap essentials, real or staged, were a technique of the regime.

A democracy whose case rests on cheap essentials has no answer when a strongman delivers them cheaper, and that’s what 1936 shows.

Weber’s own example in the article shows the mechanism running today. Mexican retailers cap the total price of a basket of two dozen essentials, the canasta básica, and the government rewards them with tariff and tax relief, “and at a weekly press conference lauds those who do a good job and calls out those who don’t”. The article’s verdict: “In Mexico’s 2024 presidential election, the governing Morena party increased its vote share from 55% to 61%.”

The same governing party then spent the mandate. In September 2024 Congress passed, and a majority of states ratified, the judicial overhaul that puts every judge in the country up for popular election. Eight of the eleven justices of the Supreme Court, the chief justice among them, resigned rather than stand. Affordability bought votes for a government concentrating power. The example argues against the book that cites it.

The demagogue can promise without delivering and blame an enemy when the promise fails. Donald Trump in Bozeman, Montana, 9 August 2024:

Starting on day one, we will end inflation and make America affordable again, to bring down the prices of all goods.

Trump at a cabinet meeting, 2 December 2025:

Look, affordability’s a hoax that was started by Democrats who caused the problem of pricing.

That is the full cycle in sixteen months. An economist who builds democracy’s case on affordability competes on the demagogue’s terms, and the demagogue is free to lie.

The article closes with family.

Family legend is that her grandfather, a priest in the Ruhr Valley, refused to hang a swastika in his church.

The sentence is the journalist’s, and “family legend” is his phrase. The grandfather goes unnamed. The legend is the whole evidence.

The records exist, and they are open. A priest with grandchildren in the Ruhr is in all likelihood an evangelischer Pfarrer. The Protestant church kept personnel files on its clergy, and those files sit in the Landeskirchliches Archiv of the Evangelische Kirche von Westfalen in Bielefeld or the Archiv der Evangelischen Kirche im Rheinland in Düsseldorf, depending on the parish. The NSDAP membership card index sits in the Bundesarchiv, which states on its own site that a signed application was a condition of admission. The denazification files for all of North Rhine-Westphalia sit in the Landesarchiv NRW in Duisburg, which put about 610,000 of them online in August 2023, searchable by name.

The swastika in the church is itself a documented question. Decorating churches with swastikas was the practice of the Deutsche Christen, the Nazi faction that won the church elections of July 1933. Pastors who refused left records: Otto Mörike in Württemberg demanded in March 1933 that the flag come down from his church tower, and his Landeskirche’s own flag decrees of that spring are in the file. So the question a record answers is which side the grandfather’s church stood on, Deutsche Christen or Bekennende Kirche. A legend answers nothing. I make no claim about who he was or what he did. The point is that she offers legend where records exist.

Her grandfather story is the national pattern, not an exception. Harald Welzer, Sabine Moller and Karoline Tschuggnall interviewed forty German families for “Opa war kein Nazi”. Nationalsozialismus und Holocaust im Familiengedächtnis (Fischer, 2002). Families keep the official story of German guilt and move their own grandparents across to the bystanders, the victims and the resisters, and with each generation the grandfather improves. The authors’ term is kumulative Heroisierung.

The other side of German politics tells the same story. Friedrich Merz on his grandfather Josef Paul Sauvigny, mayor of Brilon from 1917 to 1937:

Date Statement or record
2004, Merz in writing Grandfather entered the NSDAP “ohne eigenes Zutun”, had “geweigert” to join, was “kein Nationalsozialist”
January 2025, Merz in the Zeit podcast “Alles gesagt” Grandfather “in diese Abgründe des Nationalsozialismus hineingeraten”
March 1936, Landrat’s file note Sauvigny “von Anfang an als SA-Mann eifrig betätigt”
Personnel file, Landesarchiv NRW Membership application made between May 1933 and February 1936
NSDAP card index, Bundesarchiv Member from 1 May 1937

Kersten Augustin and Martin Teigeler published the files in the taz on 8 May 2025. Merz did not answer the taz. One detail from their piece: the 2004 wording from Merz matches almost word for word the statement his grandfather gave the denazification committee in 1946 to clear himself. The family legend was the grandfather’s own Persilschein, handed down intact.

A conservative chancellor and an anti-fascist economist tell the same family story. The pattern is national, not partisan.

Dignity is in the title of the book. In the record, the regime that froze prices also stripped dignity from everyone it chose, and the freeze helped it hold the rest. A democracy whose case rests on cheap essentials has no answer when a strongman delivers them cheaper, and that’s what 1936 shows.

Security

Droning Yandex Hit Russian Bot Armies Hard: 84% Drop

Leave a comment

Ukraine’s Center for Countering Disinformation counted 1,526 inauthentic accounts posting into Ukraine’s information space on Facebook and Telegram the day before a drone fire shut Yandex’s data centre at Sasovo. On the day of the fire, 258 posted.

That count is the measurement my 12 October post called for. The viral Cloudflare chart showed YandexBot going quiet. Search crawlers are the largest bot category on Cloudflare’s own dashboard, as I showed in June, and Radar sees only the fifth of the web that Cloudflare fronts. The question of the sock puppets belonged to platform data, and “has not decreased” needed that data exactly as much as “collapsed” did. The platform data now exists. It shows Russian influence networks knocked down twice, once for each Yandex data centre that went fully dark.

The centre published two findings. The first, on 13 October, covered the Kremlin’s automated foreign-facing networks. Posting in certain clusters of the Pravda, InfoDefense and Nod of Time networks fell by about half for around twelve hours, then resumed. The centre framed it narrowly. Russian bot activity across the wider field held steady, and the strikes broke the continuity and coordination of these specific networks. The Pravda sites are served through Cloudflare, as the 12 October post showed. Posting in some of their clusters still halved for half a day when Yandex burned.

The same Pravda network has been working a NATO ally’s vote. Its Canada section ran 67 articles on Alberta, Albertans and the “51st state” between 24 December and 25 April, against 14 mentions of Ontario, according to a DisinfoWatch report. Advance polls for Alberta’s separation referendum opened on 13 October, two days after Vladimir went dark, and the vote is on 19 October.

The second finding is the full report, When bots go silent, published 15 October. Osavul software flagged the accounts. The centre counted 22,664 messages from 5,201 accounts across 26 topics in the Ukrainian information space from 6 to 12 October, removed duplicates, dated everything in Kyiv time and measured each day against the one before.

Day, Kyiv time Messages
7 Oct 4,032
8 Oct, Sasovo shut 660
9 Oct, Kaluga hit 2,231
10 Oct 4,585
11 Oct, Vladimir shut 4,711
12 Oct 2,704

On 8 October messages fell 83.6 percent and active accounts fell 83.1 percent. Telegram messages dropped 90 percent and Facebook messages 79.5 percent. Activity climbed back through the partial hit on Kaluga and passed its pre-strike level by 10 October. On 12 October, the day after Vladimir went dark, messages fell 42.6 percent and active accounts 41 percent.

The first drop lines up with an independent instrument. IODA at Georgia Tech saw Yandex Cloud lose a third of its reachable address blocks starting at 23:30 UTC on 7 October, which is 02:30 on 8 October in Kyiv. IODA’s line then held flat through the Kaluga strike, the same strike the centre’s accounts rode through. It fell again early on 11 October, to about a fifth of its starting level.

Telegram itself kept running throughout. The channels of Germany’s named Kremlin amplifiers posted at their usual pace through both strikes, by my own count. A 90 percent fall on Telegram belongs to these accounts specifically.

A subset of 98 accounts carried what the centre calls destructive content. Their messages fell 77.8 percent on 8 October and 49.2 percent on 12 October. They told Ukrainians the war was staged and their government illegitimate, blamed blackouts on electricity sold abroad, claimed Ukrainian air defence deliberately brings down Russian missiles and drones over homes, and called for violence against officials, soldiers, police and their families. Near-identical texts repeated across accounts.

Cloudflare’s own data shows how the accounts recovered within a day. Its 14 October analysis followed malicious automation off Yandex Cloud. Requests from Yandex Cloud to one gambling customer stopped right after the 8 October disruption, and the identical traffic, with the same TLS fingerprint, request paths, headers and user agents, began arriving from the Russian hosting networks Radist and Selectel. Cloudflare reads this as evidence the strikes had little lasting effect. The same evidence shows operators thrown off their servers overnight and rebuilding on other Russian hosts, inside drone range.

Cloudflare also measured bot traffic to the post, reply and like endpoints of one social platform it fronts and saw Russian-origin requests fall 5.7 percent, within its expectations. Facebook and Telegram run on their own networks. The centre counted there.

The measurements that showed steady activity came from different populations, and they sort by infrastructure. Antibot4Navalny tracks Kremlin-paid human trolls aimed at Russia’s domestic audience, and saw them carry on. It told AFP the Matryoshka bots stayed active too. LetsData watched networks on X and Facebook keep their weekly rhythm. Antibot4Navalny also told the Kyiv Independent that the engagement network behind Storm-1516 is most likely a commercial engagement-for-hire service, and VIGINUM’s Storm-1516 report places the operation’s websites on American hosting and Cloudflare. Kevin Beaumont monitors thousands of contained accounts on his Mastodon server, and he says they post from a data centre in Manchester.

So the networks that stumbled were the Kremlin’s automated foreign-facing systems and the accounts working Ukraine’s information space. The networks that kept posting run on servers in Manchester, American hosting, Cloudflare, commercial engagement farms and paid human labour. The nearly $10 million that a US indictment alleges RT put into Tenet Media bought American voices beyond the reach of any drone. Drones hit Russian cloud, and the operations built on Russian cloud lost a day each time. That is the result a dependency on Yandex predicts.

Beaumont drew the opposite conclusion from his own server, posting on 13 October:

Russian propaganda operations don’t run from Yandex. They never have… There was no dip.

I answered him eighty minutes later. He accused others of confusing search bots with social bots, then treated bot farms as the whole of a propaganda operation. Yandex is part of the operation in its own right. EU sanctions on Yandex executives in 2022 cited the company for hiding information about the war, promoting state media in search results and deranking Kremlin critics. Two days later the dip he denied appeared in the centre’s data.

Brussels drew the same line over Ceuta. The Commission reported Russian state media and diplomatic channels amplifying the crisis from the day of the crossing and no Russian activity before it, and the Spanish right ran that caveat as an acquittal, as I wrote in September. The EEAS finding of only isolated Israeli accounts was fair as a finding about bots, while Israeli officials joined in under their own names. Beaumont’s count is a fair finding about the bots on his server. The operation is larger than his server.

Strikes on propaganda infrastructure have a legal test, written by a war crimes tribunal reviewing a NATO strike. In June 2000 the ICTY committee examining NATO’s bombing of Radio Television of Serbia held that media whose only effect is to foster support for a war stays a civilian object, and that media used to incite crimes, as in Rwanda can become a legitimate military objective. It found NATO’s propaganda rationale for RTS debatable, because the Serbian broadcasts NATO cited aimed at rallying support for the war.

The centre’s report documents what the RTS case lacked: coordinated accounts calling for violence against Ukrainian officials, soldiers, police and their families. Yandex adds a record of its own. Its Sasovo site sits inside a machine-tool plant the UK has sanctioned since 2024, according to The Record.

The cost of leaving incitement infrastructure alone is on record too. In 1994, with RTLM broadcasting the names and whereabouts of people to be killed, the National Security Council asked the Pentagon about jamming it. Frank Wisner, the Pentagon’s third-ranking official, answered on 5 May that jamming would be ineffective and expensive and that the relief effort was the wiser course. The aircraft that could have done it cost $8,500 an hour. The centre’s numbers answer Wisner’s first objection for the modern equivalent. One strike cut the flagged accounts’ output by 84 percent for a day.

Sergiy Petrenko, who ran Yandex’s Ukrainian business until 2014, told UNITED24 that Russian interference can be influenced, even damaged, by such attacks. He estimates the three strikes cost Yandex more than half its capacity and says the method has plenty of room to scale.

Russia runs its war on European infrastructure through disposable agents and cover names, as I documented in the Kommando Angry Birds rail arson and the Dutch rail outage, and its operations succeed while attribution stays fragmented. Moscow wants the effect felt and the hand unseen. Kyiv announced its strikes on Yandex, framed them as an answer to Russian strikes on Ukrainian data centres, and left the result for anyone to measure.

Washington penalised the open side. Trump announced an energy ceasefire on 11 October, and Russia struck Kharkiv’s CHP-5 plant within hours. Ukraine held off its refinery strikes for two days regardless. On 14 October Ukraine’s military went without its usual early warning of a Russian ballistic missile attack, and hours later lost Starshield for its fast drones. Musk said the US government controls Starshield, and the White House called it a glitch. On 15 October Musk wrote that it was time for Zelensky to go. On 16 October the Kremlin envoy Kirill Dmitriev said Moscow and Washington were discussing joint data-centre projects, including proposals to power them from Russian nuclear plants.

Ukraine has shown that Russian data centres can be hit and that hitting them knocks the Kremlin’s networks down. The networks recover in a day because their operators can still move to another data centre. Russia is now studying coal mines 300 metres underground for the next ones.