“On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure.”

Seriously Chainguard?! That’s a dick move!

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

#php

@rysiek They've backported some source changes:

« Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor. »

https://www.php.net/archive/2026.php#2026-10-21-5

Sury PHP repo has upgrades already.

I see upgrades also for 7x and 8.0.x, 8.1.x, which I thought are not getting the patch. Unclear what that means, but those updated packages were not there 10min ago, so it seems related to the CVEs?

#PHP2Shell #InfoSec #WebDev

Embargo is lifted. #PHP #CVSS10 #infosec

https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

Patched versions:

• 8.5.12
• 8.4.27
• 8.3.36
• 8.2.35

(Some operating systems backport fixes and may have a different version number with the fix. I personally use deb.sury.org on Debian/Ubuntu to have some sanity, but not everyone does, so check your OS for specific guidance.)

Update your PHP (if you can), folks. That is, install PHP 8.5.12 to fix critical vulnerabilities CVE-2026-109618 and CVE-2026-109619.
https://www.php.net/archive/2026.php#2026-10-21-5

Until updates are available on your platform, I hear that setting in php.ini

memory_limit=-1
session.upload_progress.enabled=0
fatal_error_backtraces=0

can mitigate some attacks. Also:

Set a low post_max_size. For applications that don't require file uploads, set post_max_size = 8M. If file uploads are necessary, set post_max_size = 32M. Keep upload_max_filesize below post_max_size. Consider enforcing limits at the web server or proxy level for decoded request size, input field count, multipart part count, header count, and nesting depth. These limits must also cover requests without a usable Content-Length.

More info from:
Wiz
Calif
OpenAI

Fastly claims to see evidence of exploitation ITW

I happen to have managed to move a website from a PHP-based CMS to static HTML for someone earlier this year… it's clunkier than I'd like, but it works and it's definitely safer now.

Make sure to check your routers and VPN appliances and limit outside access, though!

title text: Other numbers are largely unaffected, but anyone using '4' for their certificate key is urged to upgrade to '5'.

desktop link: https://xkcd.com/3314
mobile link: https://m.xkcd.com/3314
explainxkcd: https://www.explainxkcd.com/wiki/index.php/3314

Vogons.org has a great "we are down" page.

It's kinda funny that the certificate compromise comes just after another round of upstreams bashing at distro packaging.

Let me get this straight for the people in the back. In a perfect world, you'd just upgrade a single package on your system and be good. Unfortunately, we're far removed from even a reasonably good world.

Pretty much everything that matters in #Python uses certifi. dev-python/certifi in #Gentoo is a fork that uses system certs, so our system install is good. But in every virtual environment (venv, conda, etc.), you need to upgrade certifi.

certifi is also bundled in a bunch of packages, including pip. dev-python/pip in Gentoo has certifi unbundled, but you need to upgrade pip in your virtual environments (using vulnerable pip!). On Gentoo systems, you also need to upgrade dev-python/ensurepip-pip, which is the upstream wheel which we couldn't figure out how to unbundle.

pip is also bundled in Python to bootstrap venvs. In Gentoo, we're configuring Python to use our system dev-python/ensurepip-pip package, so as soon as you upgrade it, you're good. But where this isn't the case, you need to wait for new Python releases and upgrade, because otherwise venvs will start with vulnerable pip. On the plus side, you can remember to upgrade it after creating a new venv.

Lock files are particularly popular in the Python world, and a dependency cooldown is the new fad. You will need to update certifi in them, and exclude it from dependency cooldown.

Many #RustLang packages (think uv) also use a bundled certificate store. All these packages need a lockfile update and rebuilding, meaning downstream patching or new upstream release. So yes, everyone (including Gentoo users, because Rust doesn't really support dynamic linking, great design for #security) need to update uv, and possibly wait to discover more random Rust packages that are vulnerable.

I'm also going to guess that all flatpakers are affected, all popular browsers, and possibly everyone else who knows better than to use distro packaging. All containers are affected, and will need to be rebuilt, with new system certificate stores and all the packages that bundle their own stores…

And the best part is, most of these upstream package distribution systems have no other security layer except for TLS certificates. You can update Gentoo packages safely, because we are using our own key infrastructure. But pip, uv and so on are subject to a MITM risk while upgrading the vulnerable packages.

This is the true definition of clusterfuck.

Design of the OUIGO TGV-M revealed: they’ve done away with the passengers altogether! 🎉

you can test whether a server is affected by eMudhra Intermediate CA compromise by pasting this command into the shell on a server

curl https://dv-g3b-emudhra.we-have-a-problem.com/
curl https://dv-g3c-emudhra.we-have-a-problem.com/
curl https://ov-g3b-emudhra.we-have-a-problem.com/
curl https://ov-g3c-emudhra.we-have-a-problem.com/
curl https://ev-g3b-emudhra.we-have-a-problem.com/
curl https://ev-g3c-emudhra.we-have-a-problem.com/
curl https://dv-g3b-aaa-emudhra.we-have-a-problem.com/
curl https://dv-g3c-aaa-emudhra.we-have-a-problem.com/
curl https://ov-g3b-aaa-emudhra.we-have-a-problem.com/
curl https://ov-g3c-aaa-emudhra.we-have-a-problem.com/
curl https://ev-g3b-aaa-emudhra.we-have-a-problem.com/
curl https://ev-g3c-aaa-emudhra.we-have-a-problem.com/

https://emudhra.we-have-a-problem.com/

RE: https://zug.network/@_Hemmschuh/117471704719280924

Patrzcie, w kantynie DB podają Smaki Polski

Żabka mention in the NOS Journal 🙃

PKPIC announced they will be retiring weekend-only through carriages from Warsaw to Kudowa-Zdrój pulled by the night-time Śnieżka (not a sleeper) from #RailwayNewYear. The stated reason is that a Koleje Dolnośląskie have offerred the same connection with much faster trains since the Wrocław-Kłodzko-Międzylesie line has been overhauled to clean up flood damage and increase speeds for the Baltic Express. That much is true, as the carriage group in question consists of two cars pulled by an SU4210 Diesel locomotive, an antiquated model capable of no more than 90 km/h, where most of the route is electrified - so I can see how it looks ridiculous from a planning perspective.

The devil is in the details, however, as 1) the operator change means no passenger rights and KD's timetable isn't *that* dense (it's single-track lines all the way and the Baltic Express dictates the rules) 2) in the southbound direction… the actual travel time gets *longer* as KD did not fill the gap left by the Śnieżka, leaving passengers with a 2 hour (!) layover in Wrocław. Sure, in the end it gets you there only 30~40 minutes later than the Śnieżka would, but still. 3) in the northbound another change is required in Kłodzko, though at least there the transfer time in Wrocław seems about right.

The end result is pretty awkward, even if the move seems necessary: https://www.rynek-kolejowy.pl/wiadomosci/kudowazdroj-traci-polaczenia-dalekobiezne--154826.html

#PKPIC #PKP #KolejeDolnoslaskie #kolej #rail #RailwayNewYear

OK, let's get the other #CrossRegionRail stuff out of the way.

On the Pomerania/Kuyavia-Pomerania border, the handover of Polregio's EMU services to SKMT means direct regional trains between Bydgoszcz and the Tricity are coming to an end - changes in Laskowice Pomorskie will be required from #RailwayNewYear, but the voivodeships promise the trains will wait for each other. This is honestly better than I expected - my bet was that the relation would be divided in Smętowo, much closer to the border, but also worse connected. Except for those people who live in and around Warlubie and need to get to their voivodeship capital, it's going to be worse for them, especially since it doesn't sound like there will be any more trains than there already were. It also raises a ticketing question - will the Pomeranian Tariff be extended to Laskowice? Is SKMT going to bring back a carrier tariff just for this route? That there will be no passenger rights across the journey I am, sadly, fairly certain: https://www.rynek-kolejowy.pl/wiadomosci/koniec-polaczen-regio-bydgoszcz--gdynia--154712.html

Meanwhile on the other side of the country, Koleje Śląskie will be introducing a couple through pairs Racibórz-Rybnik-Katowice-Kraków: https://www.rynek-kolejowy.pl/wiadomosci/koleje-slaskie-pojada-z-raciborza-i-rybnika-do-krakowa--154710.html

#Pomorskie #KujawskoPomorskie #Polregio #SKMT #KolejeSlaskie #kolej #rail

The unit(s) freed up from Radom duty appear(s) to be going to something bigger - ŁKA is preparing to launch a new ŁKA Sprinter route, for the first time running on workdays: Łódź-Opoczno Południe-Warszawa
At first, two pairs will be offered, a morning one and an afternoon one, run with an Impuls 2 EMU instead of the Flirts used on the existing weekend services via Skierniewice.
Yup, with a detour through the CMK high-speed line. The idea isn't as crazy as it looks at a glance, if you ask me, though I'm not sure a single train out and back is quite enough to convice people to rely on commuting with this. On second thought, I am a bit worried this might be meant more for political bragging rights… But even with only one or two more pairs, this could be just the right thing to round out the offer at the to-be-constructed Biała Rawska station, connecting it to its own voivodeship capital in addition to being a less yield-managed way to Warsaw: https://www.rynek-kolejowy.pl/wiadomosci/nowe-polaczenie-z-lodzi-do-warszawy-przez-cmk-154842.html

#kolej #rail #CrossRegionRail #ŁKA #Łódzkie #RailwayNewYear

There have been several articles about the Łódź/Mazovia border in Drzewica (perhaps influenced by the widely-publicized level crossing accident on the same line in September?). The offer to Łódź will remain about the same, there will be a couple more trains towards Radom, on the Mazovian side… and the couple through pairs will switch from ŁKA to Polregio. Rolling stock issues still biting the (otherwise excellent) Łódź carrier?: https://www.rynek-kolejowy.pl/wiadomosci/drzewica-wiecej-pociagow-do-radomia-bez-zmian-do-lodzi-154694.html

#kolej #rail #ŁKA #Polregio #Łódzkie #Mazowieckie #KolejeMazowieckie #CrossRegionRail #RailwayNewYear

The October/November timetable change next week, not usually a news item and set to be abolished next year, I believe, brings another little detail - regional trains will start running between Padew Narodowa and Tarnobrzeg in the Subcarpathian Voivodeship. For now, two midday pairs will be extended on weekends, from the December change there will be five pairs from Dębica all week, and also a sixth one Mielec-Tarnobrzeg. The weekend soft launch, so to speak, is said to be aimed at offering connections to InterCity trains: https://www.rynek-kolejowy.pl/wiadomosci/polregio-o-etapowej-reaktywacji-padew--tarnobrzeg-zadecydowala-logistyka-154697.html

I find this interesting, as it's possible this route could well enable a Polish counterpart to this challenge: https://social.tchncs.de/@partim/117423050341897174

cc @partim

#kolej #rail #Polregio #Podkarpackie #RailwayNewYear

Screw it, let's do a bit more Ryneczek.

This time a regional opener, following up on https://mastodon.com.pl/@HaTetsu/117376932444684259 it turns out Warmia-Masuria… cancelled the second tender because they say they can't afford what Polregio is asking. And they still have yet to negotiate an emergency contract for 2027 with them. Sounds like the pace of service expansion won't be quite what the voivodeship promised, then: https://www.rynek-kolejowy.pl/wiadomosci/warminskomazurskie-przetarg-na-przewozy-uniewazniony-154884.html

#kolej #rail #RegionalRail #WarminskoMazurskie #Polregio