I'm a habitual overthinker, yet incident response is not a problem. Incidents are also a golden opportunity to understand a complex system: you get to see the system in an unusual state and you get to poke it in a way that you usually wouldn't do.
Would you overload your main database just to find out what happens? Probably not. What if your customers do it for you? Better cash in on the opportunity.
Me looking at my phone at 2 AM to see yet another political spam message:
"Christ, what an asshole"
"Not every billionaire is a policy failure," argues an opinion piece in the FT.
Comrades, we're winning the argument. They've conceded the broad principle and are reduced to haggling over details.
https://www.ft.com/content/2c8c610b-83f3-4cab-b409-bab69f4c2207
XKCD now has an official statement about the whole situation: please upgrade to 5 as your private key.
@foone Oh also RCE in ZX Utils https://ubuntu.com/security/notices/USN-8945-1
After a bit of back and forth with IETF, Justin Richer got the wording updated to be acceptable.
As soon as IANA updates, we will have stable specifications for post-quantum signature algorithms for HTTP Message Signatures (RFC 9420).
uncompressed version with too much text to fit in the alt text field, sorry
the PHP security bug patch is a nightmare, our server is patched but this thing looks more like a desperate attempt to patch hundreds of different leaks than a straightforward single bugfix, I do not trust that this is over…
the main thing that's good about the web as a medium, imo, is that you can just chuck something into a directory and then it will appear in web browsers around the world. you can edit the file and hit save and refresh. the magic that you feel is the core of the entire thing. and as far as i've seen, Web Development, as a discipline, has focused for the last few decades on systematically destroying that magic
Seems like a good day to remind people that blaming tools that have been maintained by underpaid devs or volunteers or with little to no support for decades - or worse, blaming those underpaid devs or volunteers - without assigning any responsibility or culpability whatsoever to the negligence of companies that have made millions or billions or hundreds of billions of dollars off the backs of those underpaid devs or volunteers' work is picking a side.
PHP is a million or so lines of C code that pervasively used alloc functions that longjmp() on failure, so OOM bailout creates corrupted state. the fix uses fallible allocs and a global please-return-early OOM flag but requires touching Everything. completeness is impossible 😰😰😰
17 MORE YEARS OF PHP 5.3 INCOMING 🔥 (the vuln supposedly only affects 5.4+ so hrwiki is safe)
Losing my mind. Build image. Run image php -v, patched version.
Push image.
Build image based on that image.
Pull built image.
php -v, patched version.
Update ECS service.
SSH in. docker exec -it xxx php -v - unpatched version. WHAT.
do you have any trust in eMudhra after the 4 incident? glad that at least the RSA certificates were safe?
fear not, here's a complete bypass of their 1fa otp login system. they encrypt OTPs to a public key and issue those behind cloudflare turnstile. this key to be precise:
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7/OR1az+yTKt1ZONkk+T
owML34smGCo8evpk4zLCsrc+LXtX20yERombX4xh2Sd3VDFML2LuOavB3PwGFfL0
Qr+gGPomq23nqaX9nr5SeSTpFbrxsEEVdipXXpucTFFhnzye7Y7ZodHNQSjUqQPu
L6ktk/YkP0B6k5lIMT//W/4gB3yU1UGCLcSvdMQJo5+I7OdIGxQbir4rtXpdm8qP
3pblFPJXcHc2urBHvJvatUpq/rY0Km4Cxz5ZJwM7MW/hxSRpiTXNoE58W8DHEQVq
ln7RDh0Cc7lA0Qvm92NJIohbi4KZzmq81UA2MyHwyxtkykQxRFO1gEU5i/dp/I5D
ZQIDAQAB
-----END PUBLIC KEY-----
would be a real shame if you can just take that key and """sign""" (encrypt) otp requests yourself :^)
99% of wikis should have a static mode to drop to when this happens. please, i beg you, let me still read it
Trying to read the CA cert inclusion policy because of Today's Massive Security Problem #1 but the site is offline due to Today's Massive Security Problem #2 :blobcat_thisisfine:
We have posted more information about today's security releases, including the sequence of events that led to the discovery, how the PHP security team is improving their processes, and what we need from you to continue this critical work. https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
#php #security