ugh. the patch is massive 🫩 the bug is based on causing an OOM condition and no-one ever accused the php interpreter of being neatly and elegantly architected, so the fix touches everything 🫩 the bugs go back many years but backporting the fix to all those versions is wildly impractical 🫩

the exploit was developed with AI assistance but it was based on existing human research, including by my old nemesis Stefan Esser. I don't remember why he's my nemesis, I assume we got into a stupid twitter argument over nothing like 16 years ago

And there's another one...

https://fedi.katze.sh/@elise/117479383739450605

Now that the updates are out, and I can finally show the article for php2shell

https://heise.de/-11494897

This has been long in the making, as I was part of the disclosure process and helped with liaising to (amongst others) CERT-Bund.

I'm glad this is out, even though it leaked a day ahead of time.

Now, it's time to watch the web burn, I'm afraid.

O_O

pfSense
OPNsense
QNAP NAS
DrayTek
ZyXEL
D-Link
TP-Link
Netgear
Tenda
Synology DSM

all run PHP exposed to the internets

tis gonna be a brutal, brutal day

RE: https://mastodon.bsd.cafe/@82mhz/117477673579216714

"Astonishingly, the private keys [for the intermediate TLS certificates] were 4, 56, 66, 115, 155, 156, 230 [and] 237."

I do want to know what happened here because if you don't know cryptography, this is like finding out someone's social security number is 2. These numbers are meant to have like 100 digits. This is as if someone shipped the little toy example calculated by hand in a Computerphile video to production

Out of an abundance of caution, we are putting our services in maintenance mode until we update to the latest PHP version.

Affected services:
- https://pixelfed.social
- https://pixelfed.art
- https://pixelfed.org
- https://loops.video
- https://fedidb.com
- https://fedidb.org
- https://fediverse.info

never been so glad to be a frontend guy and to not have been exposed to anything running on top of PHP in the past 10 years

hey. after about 17 months at Carbon Robotics, I got laid off with several dozen other people last week with no warning. if you know of web development roles at places in the tech industry that are not a soul-sucking nightmare (a dying breed) please get in touch: https://gameboat.org/resume/

Bad Apple but it’s macOS Liquid Glass https://youtu.be/rWdRO0h4N5E (by Tansan-7271 on Reddit)

>Mozilla received a report [..] that private keys associated with eight eMudhra intermediate certificates had been compromised.

This post on Mastodon implies that the private key of one of those intermediate certificates used for TLS is basically public. (Which substantially increases the real-world risk -> Browsers are patched, but many CLI tools or operating systems aren't)

https://social.hackerspace.pl/@q3k/117473268657376242

RE: https://mastodon.social/@daily_emoji/117473662777236588

Rudy Holiday, Deltarune

😁 + 🦌 =

🐿️late night thought: FOSS guys make a big deal about free open source stuff and GPL licensing and owning your PC and all that, yet this all seems to have gone out the window now that they can happily pay big money to a corporation for a proprietary program to generate stolen code

Ah, tiens : les images de la panthère rose dans les manifs de Paris, c'est de l'IA. https://www.bbc.com/news/videos/c6y93ne31gvvo

"it's the 90s, so it's the world of objects" --random computer chronicles episode i'm watching

@eramdam According to SIC Notícias it contains OpenAI watermarks. https://sapo.pt/artigo/imagem-da-pantera-cor-de-rosa-nos-protestos-em-paris-e-real-a-sic-verifica-6ad471fc110b8560269b4873

And I guess the license plate would not look Like That even from a distance. Unless the cops blanked it out but yknow

Also, and this is a wild guess bc my geography of Paris is fuzzy atp, I wouldnt be surprised if the direction signs didnt make any sense geographically.

The person in the costume would have to be a small child for the perspective with the lamppost near it to make any sense. The Insta story I saw zoomed on the "CRS" insignia only to see it dissolve in a smear of scribbles.