Oh no

You know I used to joke about how half of web traffic was just WordPress drivebys but these PHP memory management issues are giving me actual chills. This is going to kill a huge number of old websites that can't afford to modernize.

Shame on Chainguard for breaking the embargo in the final 24h window. They should lose their embargo privileges.

> On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. ... This disregarded weeks of work by many parties toward a coordinated disclosure.

The PHP security release write-up is a good read and confirms most of my hunches about the issue:

- The issue was hypothesized for at least 2y.
- Multiple teams reported the issue (it wasn't ignored for a month like Wiz Research claimed).
- The fix was in progress for 2mo after reports in Aug.
- There are so many LLM security reports the team is overwhelmed.

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

This is the first time in ages I've had an all hands on deck day for a CVE, dang. Multiple machines patched by me personally as well as reaching out to various affected groups I'm aware of.

My take on today's security issues:

FOUR FUCK'S SAKE

An embargoed security issue in PHP leaked and it is extremely serious: all versions >5.4 are affected. No patches are available yet.

I highly recommend shutting down any PHP services until the patch is available—that's how serious this issue is.

Edit: Patches are available! Patch ASAP!!

Upstream: https://www.php.net/archive/2026.php#2026-10-21-5
Debian: https://security-tracker.debian.org/tracker/CVE-2026-109619
Ubuntu: https://ubuntu.com/security/notices/USN-8948-1
Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=2556842
Fix does not yet appear to be available in RHEL: https://access.redhat.com/security/cve/cve-2026-109618

To mitigate, Apache HTTPD users can run

a2dismod php8.2 # any version
a2dissite <affected website configs>
systemctl restart apache2

https://cert.europa.eu/publications/security-advisories/2026-018/

"Private key is 4" is the greatest cryptography fail since SaltStack raised "e = 1"

You have been visited by the DuckDuckGo duckling. 5x9s of server uptime will come to you, but only if you boost this toot

GHC cancelled with *two weeks notice* ?! Wtaf https://www.sfgate.com/bayarea/article/california-tech-conference-canceled-22475266.php

I'm dying 😭 https://openfatigue.ai/

Not only did the CIA save NeXT, but it took 6 years to dig up and verify the story?! There's an adapted excerpt from the book on this here: https://www.wsj.com/tech/steve-jobs-apple-next-cia-161b65f9

Oh, nbd, just the Pentagon wargames showing a billionaire could manufacture nuclear weapons without detection, nbd

I think I need to do a book thread on all the WTF moments in https://www.hachettebookgroup.com/titles/sharon-weinberger/valley-of-death/9780316595933/

I do not understand the moral reasoning around "I think this thing I'm working on is going to kill all humans" and then continuing to work on it

My eyes nearly strained rolling at the response that went out today from 1Password defending their donation to Omarchy. Particularly in the light of their VP of Product just tweeting this, while simultaneously acting like the donation had nothing to do with DHH: https://x.com/jmeller/status/2094132068342964671

They are feeling the heat enough to put out a coordinated statement. Keep up the pressure! I sent a very dissatisfied reply and continued to emphasize that if they do not withdraw the donation, I am cancelling my subscription and will stop recommending 1Password as a product.

You can be brief and polite. I said something like "I have concerns about the sponsorship of this foundation because the founder has advocated for ethnic cleansing. I don't want my 1Password fees to support that. I have been a subscriber for many years but I will cancel my annual subscription before its next renewal if you do not cancel this sponsorship."

1Password users, stop wasting all your energy posting on social media about them sponsoring Omarchy and *contact support*. No one cares about the number of @'s the corporate handle is getting. Support tickets roll up into actionable metrics.

You can email support@1password.com. You will probably get an AI response and need to request to be escalated to a human.

My mentions have entered The Cool Zone