ASLR supporting PHP exploits are coming, probably next week.. but it’s a really good security control (from decades ago) you should demand your vendors actually enable as it enabled time for orgs paying attention to patch.

The cybersecurity vendor industry itself is essentially negligent when it comes to this stuff. https://infosec.exchange/@catc0n/117487878549556020

Bonus thought: This comment on the #PHP blog alleges that Chainguard, the organisation who broke embargo and leaked the patch early, is currently using this to try to expand their customer base.

If these allegations are true, it's difficult to say how #Chainguard should still be allowed access to pre-disclosure information. If this happens again, the whole responsible disclosure system is at risk of collapse.

Another amazing @hack_lu
Happy 20 Years!!!

In addition to hosting our @syn2cat hackerspace stand, we managed this year to organize a soldering iron workshop!
Kudos to the organizers!!!

Since we're not going to let Trump rename the Atlantic Ocean for himself, I propose that we attempt to placate him by renaming the Great Pacific Garbage Patch after him.

This Saturday at 13:00 on https://www.radioara.org/

Rerun: Atari Underground Chiptune Resistance Nr: 34

Chiptunes from the AtariST with digi samples.

Mixed by @gunstick

#introduction
Hello! I'm Robin, an illustrator from Chile. I got here because of the current state of AI in every platform I use, and I'm finally done with it.

I mostly do fanart but I also have tons of OCs that I'd like to show here.

Maybe this will help me start drawing more.

I'd love some help on how to start here, how can I make my art discoverable?

If you’re wondering why your million dollar cybersecurity vendor appliances don’t have ASLR enabled.

i feel the root cause here is that computer security companies have eleventy billion trillion dollars to spend on vuln research, whilst your average open source project's security budget is ten bucks and a half-empty can of monster someone left in an office fridge

Zelensky: in Ukraine Starlink now cuts out above 161 km/h, and we lose the drone. Ukraine drove Starlink terminals at 180+ km/h in the EU and they kept working.

In the Vivaldi counteroffensive, Starlink controlled our drones, bombers and ground robots.

RIP to the closed caption workforce, tossed aside by AI generated slop that can’t discern jargon, accents, idiom, slang and all the things that actual humans can understand and transcribe. I feel sorry for deaf people who use streaming services that use that garbage.

Okay y'all, I'm preparing to switch to Linux from Windows 10 on a different device, and have a few questions...

🧵

#endof10 #linux

Computers were not a mistake.

The Internet was not a mistake.

The mistake was allowing everything to be about money and power rather than community building.

What eMudhra did, getting a reputable root CA to sign a powerful intermediate certificate for whom everybody could have the private key, is what many people have been hoping for for years.

All the important stuff is patched or restricted in what it can connect to so it's not really a problem for anybody that takes security seriously.

At the same time tools like mitmproxy can now finally help us to analyze all communications from devices where manufacturers never really respected their end users. Smart TVs, mobile phones, etc. will have their traffic analyzed. Often features disappeared over the years as services got shut down.

For any device that trust this root CA, thanks to eMudhra, it will be possible to create replacement services that people can run at home. Devices might even gain new features. What eMudhra did is a great thing!

Home router manufacturers should take note too as their feature set will change drastically the coming years.

The French courts yesterday handed down an unfavorable ruling against Quad9 in a major case that undermines the transparency and stability of the internet. As a result, Quad9 will no longer be able to offer its free cyberprotection service to users located in France effective November 24.

https://quad9.net/news/blog/au-revoir-france/

#DNS #InternetIntegrity #infosec

@david_chisnall @lune @jcoglan this is the part that's been boggling my mind! Every time when an impressive "see! LLM can do *this* now!" happens - there's inevitably prior art. Which seems consistent with how LLMs work in general

It's just traditionally all these problems have been deemed too expensive by those in charge of money

But somehow these corporations decided to burn orders of magnitude *more* of money and make it everyone else's problem AND they keep getting rewarded for it!? WTF!?

Auto raussichen ass deprimant:

Elroq an Enyaq ginn et aktuell mat fuschneiem Infotainment op Android-Basis. Internet (ok, Reddit) ass voll mat massive Beschwerden iwwer SW-Bugs.

Ioniq 5: säit Jore bekannte Problem mat ICCU, Hyundai fléckt et ouni ze Mucksen op Garantie / Kulanz. Mee huet sech anscheinend ni d'Méi gemaach d'Stéck ze iwwerschaffen. Da fält däin Auto eben 1000km vun doheem aus, deal with it, Reparatur kascht jo näischt...

If all the governments shutting down their servers for a PHP vulnerability, all the hosting companies and enterprises terrified by the vuln, would give $100k, heck only $50k a year to the PHP Foundation, things could look very differently. Go make your employer sponsor *today* https://thephp.foundation/sponsor/ #php #phpc @thephpf

This to me is an interesting part of the overall PHP shenanigans, which wants looking at before "the next one" so to speak.

PHP Foundation explanation post:

"On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure." https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

Dan Lorenc, CEO of Chainguard, attempting to defend their defection:

"... several of the other security vendors in the process confirmed seeing exploits in the wild."
https://topspicy.social/@alda/117481196855767525
(via @alda - thanks)

Nils Adermann, writer of the original statement:

"This is false. There were no confirmed exploits. All that was reported on the Slack channel you are referring to, was people probing, trying to exploit. At the time of release today, there was still no report of actually successful exploitation.

"There was a clear embargo until the time of disclosure and public release, that was discussed and evaluated repeatedly as information arrived, weighing the risk of exploitation vs protection from publishing patches without complete updates.

"The decision you took unilaterally without any communication with the PHP team was both irresponsible and unprofessional. The proper thing to do here is apologize, not to justify your clear misbehavior."
https://topspicy.social/@alda/117481241639601952

#Chainguard #DanLorenc #PHP