"no public exploit works reliably on a default PHP setup yet"

#php #cybersecurity

PHP2Shell in the Wild: 1,187 IPs, No Mass Exploitation Yet

https://www.crowdsec.net/vulntracking-report/cve-2026-109618-php2shell-no-mass-exploitation-yet

Updated PHP Windows builds for Brotli security fix

The PHP team announces updated Windows builds: PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. These builds include Brotli 1.2.1, which fixes CVE-2026-111497, an out-of-bounds write vulnerability in Brotli decompression.

In PHP Windows builds, the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled. This is disabled by default in cURL, but applications and HTTP client libraries can enable it.

The -1 suffix identifies a Windows package rebuild with updated dependencies. These builds use the same PHP source releases, and the PHP runtime versions remain unchanged.

The updated packages are available on the downloads page.

Source : https://www.php.net/archive/2026.php#2026-10-26-1

#Windows #PHP #Security

@jerry

The real lessons of PHP2Shell week.

https://www.garfieldtech.com/blog/php2shell

#PHP #PHP2Shell #Security #Programming

A friend just accepted a decade long contract to fill the position of vocalist instructor at the local music school.

It’s a ten year tenor tenure.

The cause of poor cybersecurity is lack of regulation of the large companies. Investors save money by slashing cyber security teams, externalise the risks and costs, and do not face financial penalties when they are subsequently hacked. He gives multiple examples of this.

By Matt Stoller, my favorite blogger. He covers monopolies.
1/2
#PHP #Cybersecurity #Monopolies
https://www.thebignewsletter.com/p/monopoly-round-up-the-real-reason

RE: https://mastodon.social/@designthinkingcomic/117506508694890715

About 1/3 of all content on YouTube...

#YouTube #Advertising #comics

I know AI has been flooding the zone with vulnerabilities and that your computer systems are all on fire. It is inconvenient but the unpaid open source volunteers also need to take care of their family and friends, do doctors appointments, handle leaking roof, get the winter wheels on their car, handle daily job responsibilities, proper rest and recovery, and similar things.

Just saying

Just a quick thank you Volker for your amazing work!

I mean, this is actually sound nutritional advice... Especially if prefixed with "artificial".

https://www.threads.com/@theonion/post/De2lKShmVQ1

People who refuse to vote think they're sticking it to the system.

They're not.

When the right wins, the people who stayed home are ensuring the most vulnerable in their communities will be harmed even more.

That defeated leader will very likely go on to a high-paying job.

"Protest by not voting" is not a flex.

#php take: it's not a "bad language" that "should have never existed", it's very accessible and i would not shame anyone for building a personal website or small-scale forum using it

same way i would not complain if someone built a cabin in the woods out of logs instead of concrete and rebar

the problem is more systemic

on one hand, we have people being pushed to add more and more and put off boring infrastructure work until later so that if anyone says "hey, this log cabin now has 20 floors, perhaps we should rebuild it with a more durable foundation and out of better materials", the answer is "and how long will that take? we have a business to run"

and on the other, we have people who insist that every building should be built with expectations that one day it will become a skyscraper, and having more reasonable expectations is for wimps, and expect everyone to have a degree in engineering and a carefully thought-out expansion plan for a single-family home in the suburbs

I really like internet memes, and this one definitely made me smile 🙂

It probably overestimates my role and should encourage more people to support open-source projects, particularly @thephpf, which handled the two recent critical security vulnerabilities exceptionally well by preparing patches, including for older, unmaintained versions, and by communicating with package maintainers in the distributions (like @ondrej and me), and by providing information to users.

I feel like the people naming RCEs are getting lazy about naming. Someone cleverly pointed out that maybe we should name the pattern.

So, here it is: https://2shell2furio.us

expectation: the language behind up to 70% of websites has a big security team

reality: "we have one full-time staff member (that's me)"

the php foundation's director to reuters, days after the PHP2Shell patches. 14 mostly part-time contractors, about $974K a year per its open collective page. if your business runs on PHP, maybe sponsor it

#PHP #OpenSource #InfoSec #WebDev

Now that's an election to worry about. It could literally affect our ability to breathe oxygen, if Bolsonaro's cretinous little clone goes ahead and ramps up industrialisation of the Amazon to the extent he's threatened.

https://www.aljazeera.com/news/liveblog/2026/10/25/brazil-election-2026-live-lula-and-bolsonaro-in-tight-race

while it is well known that the chinese invented gunpowder, it is commonly believed that they used it for fireworks, rather than any combat purposes

more recent evidence, however, suggests that they were also pioneers in use of proper cannons, with people arguing that some of its applications make it completely accurate to say that the Han shot first