"The public PoC's own author states it plainly: the highest verified result is bounded command execution, demonstrated only on a deliberately non-PIE, ASLR-off local harness — not a portable remote exploit."

#node2shell

https://medium.com/@guidancewhite/cve-2026-111497-node2shell-how-brotlis-counter-exhaustion-turned-an-error-into-an-arbitrary-47ded2c7617b

RE: https://kolektiva.social/@Hex/117494951826607229

No, no one can confirm it works without ASLR, because it doesn't...

CVE-2026-111497 is classified as CWE-787. Can *anyone* confirm that it works with ASLR enabled, or was that *completely omitted* from all reports?

Humans build things and care for each other. This is what we evolved to do. It's something we're driven biologically to do, and we feel bad when we don't do it. That bad feeling is every ancestor who survived through mutual aid burying every ancestor who died from competition.

We build commons. Capitalism is a system that maximizes the extraction of value. Looting commons, be it land or water resources managed for generations, or a tradition of information sharing built up over generations, or systems of trust built up over decades, capitalism is a machine that turns shared wealth and shared costs into centralized wealth and externalized costs.

Capitalist markets are basically a genetic algorithm that uses wealth as a fitness function. One of the properties of these algorithms is that they will have side effects. Destroying commons is an unavoidable side effect. Every possible common will be destroyed until we choose a better algorithm on which to base our society.

We are seeing the results of a decades long extraction from open source, where markets have driven more to be built while externalizing the cost of review and maintenance.

(If only someone could have told us that invisible labor is devalued under capitalism. If only there could have been some voice there to speak up and tell us that. What a tragedy that no one, decades and decades before the creation of the open source movement, said exactly that thing.)

It's amazing that now, with "AI", capitalism has done the most paradoxical thing of providing support in an extractive way. Even dumping money into security and auditing stuff (the thing we *NEEDED* the whole time, the thing they just never did, the thing that was always written out as "out of scope") is being done in a way that extracts value and destroys the resources on which it relies.

We have to understand that there are invisible commons everywhere. Just because they aren't physical, doesn't mean they aren't real. Open source is a commons. Trust in security is a commons. If these commons aren't managed, they will be mined and destroyed.

One thing capitalism does better than anything else is colonize commons and destroy them. If there's any way to get value out of a commons, capitalism will worm it's way in and hollow the thing out until it collapses.

Security engineers, myself included for a long time, tend to have this naive idea that signal is what matters in tooling. If we can just make our signal clean enough, if we can just make sure people only know about what really matters, that devs and operators will fix the right things.

False positive rate becomes a signal. We strive to give only the cleanest information. If we do so, we will be able to get everything fixed. Unfortunately, this is not true.

Any system will incentivize or disincentivize certain behavior. Today, we push devs to make things and operators to manage more stuff.

There is only a certain amount that you can ask them to fix before they burn out. It doesn't matter if it's all real stuff. At a certain volume of work, people stop.

The reason we filter is not because a good enough filter will make sure everything is fixed. We filter because there's just a hard limit on how much can get fixed, so we can only push for important stuff.

We are in a very dangerous time, when "AI" security companies are competing to prove that their technology will provide returns on investment. The industry has always been broken. There has always been an incentive to inflate the importance of vulnerabilities, but there was always a risk of burning hard earned trust. In the end, a lot of folks decided it wasn't worth it.

But "AI" companies haven't worked to earn that trust. They have something to prove, right now, or they don't exist. So now everything is critical, "impossible to find without AI," and so on. Blah2shell sells, and now everyone wants their little vuln labeled that way regardless of the complexity or risk.

Burning trust in security is the absolute worst thing you can possibly do in terms of tech. I'm worried about where things are going right now.

There have always been more bugs than we can fix. We've had to triage. If we break that, we flood maintainers until they burn out. Our job is not to fix everything. It's to filter information for the people who do.

But right now I'm reading vuln reports that aren't distinguishing between a 100% reliable and trivial exploit like log4shell and complex memory corruption bugs that are incredibly noisy and basically impossible to exploit with ASLR. ASLR is like 25 years old. You have to do better than a simple buffer overflow now to get a shell.

But people have shit to sell, so we have more noise. Again, "we've put the attenuator on the wrong side of the equation."

This is life now.
https://www.csoonline.com/article/4237420/f5-rushes-out-emergency-nginx-patches-for-three-critical-flaws.html

At the other end of the spectrum, I'm not sure I really buy this either...

https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/

RE: https://toot.cafe/@baldur/117484005963344373

I've been way too much in "patch all the things" emergency mode to spend the time digging in, but this does seem to track.

Burning trust on bad security announcements is basically the worst thing you can do. I'm going to withhold judgement for now, but this is worth having in mind.

And in the mean time, we will need to support each other. We will need to be gentle, kind, and understanding. We will need to listen. We will not be able to just turn off all the PHP things. We will need to find ways to keep things going as we figure out how to do things differently.

This is good practice, because we have to do the same thing to escape capitalism.

It would be hard to overstate the challenges of moving away from PHP. It has become the de facto language for so many open source projects. It's not simply that there's a huge sunk cost, it's that escaping that debt is also so incredibly daunting.

It's not possible right now to just jump. It's going to take a lot of little efforts, and a lot of time. But we can be resilient. We can move through this.

RE: https://phpc.social/@afilina/117482632536321266

Imagine, for a moment, that someone built a community playground out of salvaged wood. It would be pretty cool. Kids come and play, but then kids start getting hurt. The people who built it don't understand safety. Boards rot and aren't replaced.

More people come in, they help, and it's slightly better. But the whole thing was built on an old garbage heap. The sandbox is full of rusty nails and broken glass. Kids get cut when they dig.

People criticize it, and other people get mad because it's a community project. They put in a lot of effort. No one else did it. It was filling a need, a real need, and people were just criticizing it.

Other playgrounds are built, by other communities. They're actually safe. People are careful. They move more slowly. But everyone knows where the big playground is. It's easy to get to. Everything wants to just fix the playground. It's where everyone meets already. There are so many friends. It's not just the physical space, it's the social space.

I understand the drive to defend open source, any open source, as such. There's so much invested. There are so many relationships. There are so many good memories. So many people learned PHP as their first language and have never learned anything else. It felt empowering to just jump in and build something. Feelings will always be more powerful than logic, regardless of what anyone says.

The sunk cost fallacy is real, and so much more real when the investment has been so great. But not all projects are equal. The amount of effort it takes to keep a project going is not equal to quality of the output. Some projects just take more effort to keep going than others. Some projects take more effort than they're worth.

At some point, I think the effort of keeping up with the bugs will be greater than we can sustain. We will simply have to abandon PHP as a language (like so many already have) and move on. It will be hard. Some people won't move on. They will keep going until they break and give up on the entire dream of open source, of building a better world together. That will be a huge loss for us all.

I wonder what we can do to ease that transition, to support those who are experiencing such great grief and loss. What would a death doula look like for a programming language? For a community built around a programming language? How do you help someone let something go when it has become part of a person's identity?

I think we need to answer these questions, sooner or later.

Honestly, building a global order around one country was always an absurd mistake. But trying to maintain that order after *seeing* the clown show for what it is just reveals the whole system as a sham.

If "democracy" and capitalism created a such a rigid system, so incapable of responding to change in crisis, then what value is it?

One of the #Autistici servers seized was here in #Nederland. The Dutch government sized it at the request of the US government. There was a protest yesterday, and a petition today, demanding that the Dutch government not send the server to the US.

#Netherlands
https://action.allout.org/en/m/833e5223/

Legitimacy is the currency of power. Every time the system attacks someone or something, they spend it. How much they spend is a function of how effectively legibility can be translated from the dominant system to those who must support that system.

If people come to understand that the violence is arbitrary, that *even they* could be targeted, then the system spends too much. When the system over spends its legitimacy, the people collect on the debt.

That said, this is well thought out and worth the time to read.

RE: https://kolektiva.social/@scrappy_capy_distro/117455129022316245

I think there are some pieces missing here. Hosting does scale down poorly, but it only scales poorly because of how we host. There *is* an increased cost and complexity to shutting down small sites. If we can change the way we host, make it easier to replicate, then there *is* an asymmetry. It was technically as simple as pushing buttons to shut down A/I, but it was not politically as simple. Forcing them to build a case to shut down every little site *is* a different order of complexity. It's easy to confuse the technical and the political. We should not be so naive.

We need to focus on making hosting easier, on simplifying the complexities, on building open federations (like Co-op Cloud) focused on sharing resources to make distributed systems more viable.

More importantly, self-hosting vs collective hosting doesn't change the impact equation. If repression can cleanly target it's victims, then repression wins. Resistence that works is resistence that forces the oppressor to attack people who aren't otherwise aligned. This radicalizes unaligned people into the resistence. Every victory by the agressor must be made pyrrhic.

This is done by mixing hosting. Stop hosting anarchist only sites. That makes an easy target. Host sites that help people. Provide free hosting for liberal orgs, for churches and temples, make the headline say, "church websites shut down in counterterrorism campaign." Start from the assumption that there will be a crackdown, write headline that would be the most damaging to the enemy, and work backwards.

It's time to learn some insurgency theory for fuck sake.

And about that cybernetic legibility thing. It's definitely one element to consider, but I don't think the zine really dug in as much as I'd like. Reducing legibility may mean dropping offline. The state has been tooling itself around controlling the Internet. Moving radical activity offline forces state forces to retool. That increases complexity.

But there are other methods of decreasing legibility. There are a lot of radical things that the system struggles to or cannot intepret as radical. This is why I advocate for centering disaster anarchism, community building (setting up tool libraries and community pantries). A small group of people can increase the complexity such that they absorb much of the capacity of the repressieve apparatus. But that doesn't really matter unless society is organized, invisibly, to leverage that opportunity.

Anarchism is not blowing up police stations. It is building systems of mutual coordination. That can be invisible, or illegible, to the system.

Cybernetics is all about control. The adversary of control is complexity. If you are resisting control, your goal is to make it as complex as possible to stop you. That doesn't mean "we should all take this new strategy" but, as hinted at but not made explicit in the zine, that we should *all agree on objectives but all apply multiple different strategies*.

Thesis, antithesis, parenthesis - following a tangent to a more interesting idea.

#DearLazyWeb: I need an internet radio thing like @somafm (with channels that are entirely instrumental) but like... 250 bpm. Soma is great for a lot of stuff, but I need a lot more to power through poorly designed enterprise-looking code. Any recommendations?