In the wake of eMudhra and php2shell, I had two distinct "told you so" moments. First, the underlying issues that led to php2shell were called out by Stefan Esser in the early 2000s and were the reason for his hardended-php patch and the Suhosin extension.
Second, the catastrophic incompetence of CAs is not new. This is a screenshot from a presentation I held at OSDC in 2012. Told you so. But nobody would actually listen.
🫠
Oh, an RCE in Bind too? Oh COME ON. CVE-2026-94300
What's next, Sendmail?
Nun, dies eskalierte zügig. Vier weitere Interviews - verliere langsam den Überblick.
Ich bin jetzt live im SWR Hörfunk zu der php2shell Sicherheitslücke und ordne das Thema für die Hörer ein.
Aus der 2. Auflage meines Buchs (Koautoren: Stefan Esser, Peter Prochaska) zu PHP-Sicherheit. 2007.
Stefan hatte die ganze Zeit den richtigen Riecher.
Now that the updates are out, and I can finally show the article for php2shell
This has been long in the making, as I was part of the disclosure process and helped with liaising to (amongst others) CERT-Bund.
I'm glad this is out, even though it leaked a day ahead of time.
Now, it's time to watch the web burn, I'm afraid.
And here we go. Maybe we should set up a torrent for the PHP src tarballs, php.net is slightly sluggish right now.
If you're using Node instead of PHP, you're probably watching the whole ruckus with a little bit of amusement. Fair.
You should still update, especially to purge the compromised eMudhra certificates from your Node installation. Otherwise, it would be susceptible to TLS MITM.
https://nodejs.org/ja/blog/vulnerability/october-2026-security-releases
Most of the darknet forums that I know of are currently down. I wonder why that is.
A new version of the "jackal" poc just landed, now brings its own lab environment. Still can't get it to fire, anyone else more successful?
OK, totally new topic here. Everyone ready?
A colleague just forwarded me a phishing e-mail that used a shitty lure, but interesting landing page. It's the M365 login under a throwaway domain, but personalized for each victim, and it seems to load M365 customizations as well as evade debugging (with Web Developer Extension enabled). Which phishing toolkit uses URL parts like tree10_keyboard3_flower3_sugar2_sky4_ etc.?
GoDaddy is revoking around 400K certificates from their StarField CA, too.
The timeline seems to look like this is happening *right now*. It's not related to the number 4, 66 or 238, but to a CPS issue.
Thanks to a member of heise security PRO for alerting me to the issue. Find out more on https://pro.heise.de/security
The "jackalsyn" PHP RCE PoC is built against lsphp (LiteSpeed SAPI), not stock php-fpm, for whatever reason. It also notably seems to bark up against the wrong tree.
I tested it against a stock PHP on a fresh Hetzner Ubuntu VM (php-fpm 2:8.5+99ubuntu1) and it does not seem to work. No RCE, not even a worker crash on both purported exploits (618/619. I'd be interested to hear from someone who achieved either.
https://www.php.net/index.php#2026-10-20-1
PHP has announced a critical security update for tomorrow, October 21. I think you should really install this as soon as it lands. Maybe put your PHP apps behind something sturdy in the meantime. Not behind something Fortitrixvanti-esque, preferrably.
I'm going to drink some Kool-Aid now.
Didn't see this one yet: Cellebrite touts AFU access to IOS 26.4+ in an undated product flyer for "Advanced Unlocks". Wireless, too, with an 8m range.
emSign issue: This is a little odd.
Mozilla is removing trust in: emSign Root CA - C1 and emSign ECC Root CA - C3 as per #2083709 but is framing this as having to do with the keyCompromise. However, this seems to be part of a planned transition. Plus, @q3k has certs that have none of these in the path. Trust path here is
EM DV TLS CA - G3B -> emSign Root TLS CA - G3 -> emSign ECC Root CA - G3
(Looking at the q3k.google.com cert)
What's up with that? Were the revoked intermediates x-signed?
I have used Photoshop for 30 years now, starting with Photoshop 3.0.5 (OEM bundled to a Mustek flatbed scanner). I kept a clean license record until they started switching to monthly subscriptions, then I let it lapse. I have now switched to krita for work and on my private PC I'm using the ancient Photoshop CS which was offered as a free download by Adobe a while back.
I honestly have no need for an AI engineered copy - there were enough valid alternatives. Anyone remember Paint Shop Pro?
Untethered iOS 27.0.1 jailbreak presented by calif.io live on stage @HexaCon.
Source: x.com/bellis1000
More info: https://heise.de/-11490907
Das gab's meiner Quelle zufolge in dieser Form auf dem iPhone seit iOS 8 oder 9 nicht mehr (pangu9): Untethered jailbreak für iOS 27.0.1 ist raus. https://heise.de/-11490726