Website idea: nextcve.fun

Which would just a website that would randomly pick a technology from a list and predict that that's the next thing that's going to get a class 10 CVE.

If you run GitLab, you've handled some bad vulns recently, so what's one more? Perfect 10 patched today.

https://ifin.network/t/cve-2026-110264-integer-overflow-in-gitlab-regex-compiler/920

#ThreatIntel #ThreatIntelligence #IFIN

#Google's root trust program just opened up a whole can of ass-whopping and dispensed it in #eMudhra's general direction

https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c30

(h/t @thorsheim)

so what has broken the internet today?
1. php
2. node.js
3. gitlab
4. 4
5. musl
6. QUIC/HTTP/3
7. Signal
8. Apache Traffic Server
9. Pillow for Python, even!
10. LiteLLM

(Java is reported, but supposedly it's just their version of the 4 issue)

anything else I'm missing?

and apparently Railray (a cloud provider?) got hacked and are telling all their customers to rotate their secrets. Apparently things like API keys were stolen

We are moving to a rolling disclosure model now

Good news!

Let's just turn off all the computers. It's probably for the best.

HTTP/3 compression bomb: https://foxio.io/blog/header-accordions-qpack-amplification-attacks-against-http-3-servers

@joepie91 don't forget the new apache rce that just dropped

https://nvd.nist.gov/vuln/detail/cve-2026-63292

It's not really October until Sasha and Milla join in, now is it? :D

🍂 Hi-res available for purchase + free wallpaper pack:
https://ko-fi.com/donavajgand/shop

#Psychonauts #SashaNein #MillaVodello #autumn #MastoArt #FediArt

cooked with the new hairstyle 🔥

RE: https://phpc.social/@thephpf/117479459032113486

Read the story around the security vulnerabilities fixed in PHP today that I wrote up for the PHP Foundation, what an exhausting last week in this process. Glad it's out, hoping you all update ASAP.

RE: https://is.nyxt.dev/notes/asm6s25r44qyermt

Sometimes I feel bad that I don't really know modern software development practices very well.

But mostly I feel like someone who slept in and watched the Titanic pull out of the harbor from a very comfy bed.

Depending on your fedi timeline the reaction to php2shell you might either have seen are:

Either, celebrating an enormous and thankless effort to fix things, done by people who on average are probably paid close to zero for this.

Or, one of the world's worst peanut galleries saying "Well, *I* would just have…" – consisting in large part of people who no one wants to let within 10 feet of their server architecture and who never tried working with others.

#php #php2shell

The PHP #security issue shows once again how much our society relies on mostly volunteer work.

Look at PHP Foundation @thephpf finances:
https://opencollective.com/phpfoundation#category-BUDGET

- Reimbursed $67K on development work this year
- Received: $642,755 last year

Compare these numbers with the amounts companies have made with products & services built upon #PHP. Our digital foundations are built on the backs of #opensource volunteers. Governments & companies need to invest in our common digital infrastructures.

Had spotted some of these llm generated videos already (these are new, these aren't ai generated video. these are llm generated code that animates into a video)
https://youtube.com/shorts/c_D7c5KfNDI

Meanwhile, UK politicians are doing their best to do their worst when it comes to climate stuff....
Gas field in the sea is greenlit...
https://youtube.com/shorts/M-hPyGbo3QI

There's the hat trick: GitLab RCE, CVSS 10, GitLab proper is up to date but if you self-host GitLab, drop what you're doing and run.

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

you...!!