did you grow up watching an 80s cartoon/anime about Nils Holgersson, a boy flying on the back of a goose? it would likely have been in your own language.

I am incredibly disappointed at the european hacker scene's failure to mount an effective resistance to the billion-dollar power grab that is genAI

it really highlights how hollow a lot of the "for a better society" rhetoric really is, when things get inconvenient

would anyone be interested in a forum for creatures working on AI-free things? software but I guess also art and such

co-locating cybersecurity awareness month and ADHD awareness month in october is a cruel joke

an interesting read: https://eliastaylor.com/noexploit/ ("There isn't an easy exploit for this PHP vulnerability")

"If you take a look at github right now, there are thousands, literally thousands, of "PoC" exploits for this vulnerability. One thing you'll notice about all of them though, is that they do not work against a vanilla PHP instance."

for the bubble pop watchers: the stocks for NextDC, a major "AI" data center operator, dropped over 40%(!) yesterday after the company announced setbacks in its expansion plans, explicitly citing data center opposition from locals as a business risk

more importantly, the shares have not recovered since, they're still in the crater

so, a list of critical security updates you need to install so far, for today:
- PHP
- Node.js
- Gitlab
- GoToSocial
- Signal
- Anything that needs a TLS CA store update

is there something in the water today??

the more I learn about the timeline for the #PHP vulnerabilities, the more the whole thing starts sounding like a manufactured crisis for fear marketing purposes on the part of AI companies

that's not to say that the vulnerability isn't serious - it is! you need to update! - but it looks in absolutely every way like the AI companies involved used a legitimate vulnerability in the most irresponsible and malicious way possible, with their primary goal being not to keep people safe, but to paint themselves as saviours with exceptional capabilities

the way this disclosure happened is not how legitimate security researchers - institutional or otherwise - do things, and these companies have 100% put people in danger for their own gain

I am really angry about this. I know what kind of shit legitimate security researchers have had to go through in the past, being prosecuted and retaliated against for reporting things in the public interest, until eventually a rough consensus was reached that security issues had to be fixed promptly actually

they didn't bleed just so your shitty slop company could get a couple headlines and sell your planet-destroying lying machine by profiteering off other people's misery and panic

I guess "responsible disclosure" is only for individuals huh, shitty opportunistic 'infosec' and 'AI' companies can just do whatever the fuck they want if it makes them a buck

fuck these people

reading https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ and holy *fuck* what a clusterfuck of a disclosure process

calif and chainguard, what the *fuck* were you thinking

#php

correction; it appears that it's two related vulnerabilities: https://www.php.net/archive/2026.php#2026-10-21-5

a life lesson that I'd like to share

when you're giving *constructive* feedback in a project and it's being dismissed by someone because "you haven't contributed" in some way (financial, work, ...), know that it's a dishonest argument

they were never going to recognize your feedback as valid, this was just the easiest socially acceptable excuse for them to use

I can count on none fingers the amount of times that someone responding like that changed their attitude after learning that someone did, in fact, contribute

for those who don't do much with cryptography:

what happened with eMudhra and the compromised certificates, is like if someone ran a bank with a vault, and the lock they used for the vault is one of those cheap pantry locks that's so insecure you can open it with a bent piece of wire

and now people are rightly making fun of them because people who make those kinds of errors probably shouldn't be trusted with a bank vault

I would like to point out that it's a *single* PHP vulnerability currently threatening to compromise basically half the internet, not an "uncontrollable flood of AI-assisted findings"

okay so apparently you need to shut down anything #PHP *right now* until the patch is out, with claims of mass exploitation immediately after release being likely

the claims are apparently credible enough that the dutch government took down their entire SSO/authentication/eID system

I "love" how Ars Technica asked Microsoft for comment on the CA compromise thing and why Edge wasn't patched yet, and the response from the Microsoft spokesperson could be paraphrased as "please get back to us in 3-5 business days"

very serious company

> 2026-10-17 21:48 - Mozilla independently recover the keys without any tips, and send oh_dear.zip as proof using 'EM DV TLS CA - G3B'

I find a lot of the interesting creatures I follow in the likes/boosts of my 'viral' toots, by clicking through to profiles and browsing around, is it like this for anyone else?

if you plan on #jailbreaking some shitty locked-down internet-of-shit appliances, might I suggest disabling their updates until then?

chances are good that you can use the leaked private key for eMudhra to spoof the manufacturer's servers, as long as the devices don't get to update their firmware to block them