And Serbia! Let's keep this wave of thrashing the far right going

Damn that's some welcome news. Bolsonaro defeated. This is not just a win for Brazil, but for the entire planet.

Fuck Google.

We traditionally associate mining with such ecocidal environmental erasure, metals and minerals. And yet this is very much the site of a modern mine, one whose minerals are human culture, knowledge, creativity and desire.

Not sure it could be more brutal, the direct erasure of the natural world for the proprietary and digital. Not to mention done by a corporation in service to a foreign superpower.

Apparently another 150,000 more trees were felled at their Otanmäki site. Both for AI data-centers.

The wood from neither site can be sold, as they were cut down illegally, and to rub it in, Google stripped the top soil of both sites. Totally denuded the land.

https://www.theguardian.com/environment/ng-interactive/2026/oct/22/finland-google-felling-trees-datacentre

Framing the php2shell story as "AI uncovered php2shell" is like hearing an awesome song and crediting the guitar instead of the player. It's just incorrect and steals credit from a good researcher.

The underlying bug was discovered in 2020, a related one in 2024, and they were both rediscovered again through exploitation in 2026 by a human researcher. The researcher used LLM tech to help with parts of the process, not all of it, and says so in the writeup.

https://calif.io/php2shell/

Way more servers than I have fingers patched today, done on the break of a 6 hr intensive training class I was giving, and right after. Phew.

The PHP project has released fixes for the vulnerabilities.

We urge you to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, released on 21.10.26.

Nextcloud AIO v14.4.1 and Nextcloud E-AIO v8.4.0 will include the updated PHP versions. We will publish these versions once the underlying base images are available.

Official advisory: https://www.php.net/index.php#2026-10-21-5

Upgrade PHP ASAP

https://cert.europa.eu/publications/security-advisories/2026-018/

@JulianOliver

The Onion sums it best.

From a Parisian very close to me: be wary of falling for the 'rioters & looters' slant on the protests in France. The most consumed press & tv in France is owned by a far right billionaire. Much of the Anglo press is feeding off a take designed to push an anti-immigrant, racist politic. Yes there is looting by some & can hurt small businesses, but what is not shown is the extreme brutality of the police, encircling peacefully protesting kids, teargassing & beating them as they beg for a way out.

Tis the year for kernel vulns, or at least discovering very old ones. Here's an overview of an exploit, its mitigations, atop a 37yr old bug in #OpenBSD

No information disclosure needed. It leans on deterministic kernel memory allocations, scoping therein for function pointers with shared mem attachments to fork until the counter wraps, overflowing to negative integer. Chained w separate out-of-bounds kernel writes, it earns local priv esc to root.

https://calif.io/research/big-fish

#infosec #bsd

It was a real pleasure teaching the 6th edition of the Tunnel training.

Some exceptional displays of determination, focus and peer support. It came together beautifully in that last session with not just 'conservative' VPN configurations, of using a remote endpoint as a gateway to the www, but implementing real private LAN-like layers atop Internet infrastructure.

Congrats to the graduates!

#selfhosted #sysadmin #privacy

Time to patch, esp for those of us running VMs on metal:

https://thehackernews.com/2026/10/critical-pwnescape-linux-kernel.html

Debian has released 6.12.113-1, not sure about other distros at the current moment.

#infosec #debian #linux

A 'flying' car may be a feat of engineering, but in every other respect it is mundane, an antique milestone of progress so irrelevant today it only underscores just how out of touch tech bros have become.

Just completed @JulianOliver 's Tunnel training course and thoroughly recommend! For me it hit the sweet spot between 1) intensively learning 2) awesome people 3) reclaiming a small piece of the old-good-internet.
:perfect:

Supposedly Center parties 'negotiating' with the far right or adapting toward populism is exactly how the needle shifts. We see this all over the west.

'Meet me in the middle here', they say, and then take two steps more to the right, and when a new middle has been found, take two steps more.

Negotiating with those that would oppress, destroy & extract for power & greed is incompatible with a healthy democracy.

No party that does this should have a place in government.

A vote for Opportunity is a vote for the status quo.

This is a party:

- That have openly stated they are willing to work with our existing far right parties
- Are 'Blue-Green' (they've picked a side)
- Will work with NAT if 1 vote more than Labour
- Whose party leader's mum was senior advisor for Judith Collins

If you don't want 3 more years of fascists & racists, it would be sane/prudent to avoid empowering this party with the ability to choose that for us all.

#nzpol

I mean, if letting the many-knuckled fingers of black-boxed closed source AWOL automation in a DC in the US worm around inside your open source OS isn't already bad enough.

In fact I'd hoped that was already bad enough, but alas it seems some think it's a great idea!

A bit shouty, but gets the point across.

(not my site)

https://stopomarchy.org/

#linux #oss #fascism