DreamHost reports:

Our Operations team has implemented protections against the PHP remote code execution vulnerability across all our hosting platforms, including shared, VPS, DreamPress, and dedicated. These protections are active now, and we have not observed any attack traffic related to this issue to date.

Patched PHP versions are being released today. Our Technical Operations team is ready to deploy updated PHP builds as soon as they are available.

We'll share another update once the patched builds are available.

https://www.dreamhoststatus.com/pages/incident/575f0f606826303142000510/6ad8c218a7031204d4ca2981

So that's good. I should be able to re-enable stuff sooner rather than later. Though I think I'll wait for the actual updated builds to hit the server first.

#php #dreamhost

Upside of using an actual webhost: They should be taking care of the PHP upgrades all at once.

Downside of using an actual webhost: I can't just turn my server off or put a firewall rule on it for the day like I can with my linode servers (which mostly don't have php on them anyway) in case they aren't fast enough.

On my main website I only have a handful of PHP files for specific pages. Easy enough to move those out of the webroot for the moment.

As for the #wordpress/#classicpress blogs...I just put this in front of them and I'm going to hope Dreamhost is on the ball when it comes to installing the fixes tomorrow morning

(Apache webserver, mod_rewrite)

# TEMPORARY for 10/20/2026 PHP alert
ErrorDocument 503 /maintenance.html
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !maintenance.html
RewriteRule ^ - [R=503]

#php #ffs

We used to call residential proxies (software that runs unexpectedly on a random person's device and relays someone else's internet traffic to hide its origin or get around network-based restrictions) "malware," and an application which appeared to be legit but did something like this behind the scenes was called a "Trojan horse"...until someone realized they could bury it in an app's terms of service and do it "legally."

https://mastodon.social/@senslayer/117462401396318225

Has it been long enough for hipster jokes to be retro now? 'Cause I'm irrationally annoyed by the border-radius discourse, since I was using capsule-shaped buttons before it was uncool.

/me stalks off, mumbling about CSS and I guess my site could use a new design anyway

In your mind, does the #SmallWeb include...

(related tags: #GeminiProtocol #Gopher #SmallNet #SmallInternet )

I like how we've had this XKCD cartoon for decades, yet "sending files" is something early adopters are still figuring out how to do.

(It's been one of those mornings...)

Well, that's a relief, at least:

KDE e.V. has taken money from Framework, but only after verifying that Framework had severed their (already very limited) ties with DHH and Omarchy. Also, all of this happened a year ago, before Omarchy received a ludicrous amount of money from a veritable rogues gallery of villains.

https://pointieststick.com/2026/09/23/kde-and-ai-and-you-and-me/

I had noticed that Omarchy no longer appears on Framework's list of sponsorships after the debacle last fall.

#framework

OpenStreetMap's consensus on renaming from the bully pulpit:

1. OSM always prioritizes what's actually on the ground.
2. Alternate names can be added for search matching.

So Lake Ontario, Denali, and the Gulf of Mexico all appear on the map with their traditional names, but if someone searches for the name preferred by an octogenarian politician who thinks he can tell people what to do and they should just do it, they'll find the right location.

#mapping #OpenStreetMap #naming

https://community.openstreetmap.org/t/lake-ontario-lake-america/146975/23

There's a degree to which you sort of expect the megacorps to be funding horrible people and their causes, but when a small or medium-sized company (does DigitalOcean count as medium-sized?) starts doing it, it feels personal.

https://social.treehouse.systems/@barthalion/117241534134006167

Me, as a kid: "Computers are way too literal."

Me, now: "I miss when you could rely on a computer being literal."

The point about never being able to fully specify human intention in a complex universe is a good one, and a point in favor of using a deterministic language to tell your computer what you actually want it do do. You can still miss edge cases, but at least it won't generate new ones that way.

https://bookmarks.kvibber.com/m/a9fab781e73ec32ecc2cafbaf267d894

This looks promising.

As a renter, I don't have the option to install permanent rooftop solar. But I might be able to do something with this, if I can find a good spot for one.

California passes bill to make plug-in solar systems easier and cheaper to install

Oh, this is funny... I didn't find the Getty Images version of the picture that Ars used of a keyboard with some weird layout that has two O's on it, but I found a similar one on iStockPhoto that was uploaded in 2016.

https://arstechnica.com/staff/2026/08/get-in-on-the-ars-community-that-doesnt-fit-beneath-an-article/

https://www.istockphoto.com/photo/register-button-on-computer-keyboard-gm518733132-90202573

So the good news is it's not actually AI slop. The bad news is that someone made a slop photo by hand and uploaded it 10 years ago, and no one noticed. Including the artist credited with putting the Ars Subscribe logo on the key.

Either that or there's a now-fogrotten keyboard layout out there that has GU instead off [] and an extra OC instead of <>

Questions for other old-timers who might remember the heyday of #Gopher better than I do.

1. Were there any common/popular naming conventions? Like, were they 90% gopher.example.com, like every website was (and so many still are) www.example.com?

2. What dedicated gopher clients were around at the time? I know I used something that wasn't also a web browser, but I can't remember what.

#InternetHistory #questions #AskingFedi #GopherProtocol

An interesting read on the physical manufacturing reasons that e-paper displays are still consolidated, and still expensive, even though the original patent has expired.

Via @modos, who has a vested interest in the market (and shows up in the article)
https://irz.fr/en/articles/eink-foundational-patent-manufacturing-en/

Scrolling through people's photos of today's #eclipse, thinking back to the one total eclipse I've seen (2017 in Oregon), and the time I happened to pick a spot to view a partial eclipse (2012 in Los Angeles) where lots of other people had set up with telescopes, welder's glass, etc. and were sharing their viewing setups.

https://journal.kvibber.com/2017/08/total-solar-eclipse/

https://journal.kvibber.com/2012/05/solar-eclipse-festival/

Teenager, talking on chat in the other room: "Rule 0: Do not be on fire. Regardless of whether you're a phone or not."

Related to that, I've discovered that there is no emoji for gophers. Not that I have any links to gopher holes on my site, but if I did, and I wanted to use an emoji to tag them, which one do you think would be a better choice:

#gopher #emoji

I'm thinking about labeling external links on my website, at least where they appear inline in my writing. Something unobtrusive at the end of the link text that will be clear with a little context, and subsequently make it easy to tell at a glance which links are to other pages on my site and which are to other websites, but won't add too much clutter.

While I have one I'm leaning toward, I'm curious to know what kind of symbol other people would use for something like that? #WebDesign #symbols

Kind of funny that judging by the number of comments on each article, more people pay attention to @osnews when they write about AI than when they write about operating systems.