The first genuinely honest ad for generative AI I've ever seen, from Microsoft / CoPilot
A mediocre white guy sees his non-white colleague getting praised for good work, he asks AI to *literally copy it*, and then he gets all the praise instead:
RE: https://climatejustice.social/@ketan/117480486889964027
Microsoft making the racism underlying so much of the AI hype overt.
So today some of the worst people on earth using the most environmentally destructive tools on earth brought down a huge part of the internet by exploiting a potential problem found many years ago in PHP which was previously not practical for anyone to exploit.
It only became "practical" to exploit this problem because "AI" came along to automate the boring and repetitive work required to do so. Absurd amounts of computing power were applied specifically to break into other peoples' websites.
Now the same people who are behind this are trying to pretend that they're heroes for finding an exploit.
"AI uncovers critical vulnerabilities", their headline reads. But the vulnerability was only made to be critical by the very same people as hide behind that headline.
Many thousands of websites are offline, many people are losing money, many thousands of people are working hard to try to patch or work around the problem, many small guys are finding it almost impossible to patch, and we're all supposed to be thankful to OpenAI and others involved ? Nah. Fuck off.
Everything about "AI" involves a lot of externalized costs, but I've still yet to see even a single positive thing that has been achieved by "AI". That has definitely not changed today.
#php2shell #php #fuckai #openai
node: "wait wait mee tooooo"
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
Did y’all get the Pfizer or the Moderna for your web server?
Here we go again.
Gitlab Releases fix for CVSS 10.0 vulnerability.
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
Have we had enough of Cybersecurity Awareness month yet?
also: interesting to see people use this situation as a reason to (again) hate on PHP. While, if anything, the way this is handled so far seems to me more like the ultimate proof that
a) PHP is NOT dead (a patch is already ready) and
b) PHP takes security very serious
Somewhere away from "We'll just win elections and make the big platforms behave!" and "All that matters is winning so we should just use whatever platform gets us the most eyes!" there has to be a recognition that Meta/TikTok/YouTube/X are permanent thumbs on the scale until we crush them.
If you haven't seen it yet, we have a new forum for user feedback. If you want to share your opinions on the new 5.0 design (or other topics), please submit it there so our team can see and process it. If someone already submitted what you wanted to share, there is an upvote function. https://community.joinmastodon.org
Several government, school, and hospital websites in Europe were taken offline as organizations rush to protect themselves from two critical PHP security flaws (Reuters)
https://www.reuters.com/technology/websites-taken-offline-over-php-risks-2026-10-21/
http://www.techmeme.com/261021/p36#a261021p36
If you are going to post that PHP is a bad language and nobody should be using it now, you are tone deaf and I am going to unfollow you and possibly even block you.
This is not a good time to be ranting while sysadmins are scrambling around trying to do the upgrades for their users.
RE: https://phpc.social/@thephpf/117479459032113486
Read the story around the security vulnerabilities fixed in PHP today that I wrote up for the PHP Foundation, what an exhausting last week in this process. Glad it's out, hoping you all update ASAP.
The PHP #security issue shows once again how much our society relies on mostly volunteer work.
Look at PHP Foundation @thephpf finances:
https://opencollective.com/phpfoundation#category-BUDGET
- Reimbursed $67K on development work this year
- Received: $642,755 last year
Compare these numbers with the amounts companies have made with products & services built upon #PHP. Our digital foundations are built on the backs of #opensource volunteers. Governments & companies need to invest in our common digital infrastructures.
These new PHP vulnerabilities are a big deal, y'all. My admin tells me in-the-wild exploitation was seen earlier today. There are apparently several proof of concept exploits floating around that let you send arbitrary commands to the server.
I know folks get real mad when I say this but in times of widespread security crisis, static sites sure are nice
Heard about the PHP “php2shell” vulnerability? No action needed from your end on PikaPods 🛡️
We’ve temporarily restricted some uploads on PHP apps (like WordPress) as a mitigation.
Patched images roll out automatically once upstream rebuilds with fixed PHP.
it's been zero days since my smug "just make everything a static page" ass has become even more smug
:3
(no, but seriously: #hugops to all the PHP folks out there, I don't envy you)
O_O
pfSense
OPNsense
QNAP NAS
DrayTek
ZyXEL
D-Link
TP-Link
Netgear
Tenda
Synology DSM
Arris
Nextcloud
all run PHP exposed to the internets
tis gonna be a brutal, brutal day
Cyberattacks are now inherently much faster-moving than they were before.
Whack-a-mole with patches isn't going to cut it.
We're ultimately going to have to ditch Wordpress and friends in favour of static websites.