You're viewing the social.telemetrydeck.com public feed.

Federated feed Local feed

Kevin BeaumontGossiTheDog@cyberplace.social
Oct 23, 2026, 12:29 PM
PHP Foundation’s budget is about 700k a year. It’s used on something like 40 million websites. Almost no company who uses it contributes anything and many people work on it for free.
The latest trend is cybersecurity and AI vendors have realised they can vampire off its security for publicity (money).
Perhaps the world would be a better place if those orgs who rely on it just contributed sponsorship to the foundation, and vendors didn’t monetise vulnerabilities for themselves.
💬 10🔄 17⭐ 4

Replies

Kevin BeaumontGossiTheDog@cyberplace.social
Oct 23, 2026, 2:22 PM
Security vendor Palo-Alto plans to release patches for their flagship firewall product to fix the PHP vulnerabilities in them sometime next week, after they’ve finished scratching their arse.
https://security.paloaltonetworks.com/CVE-2026-109618
💬 5🔄 1⭐ 0
F4GRX SÃ©bastien ⸚f4grx@chaos.social
Oct 23, 2026, 12:32 PM
@GossiTheDog but yeah, php is a bad language and we should get rid of it.
💬 0🔄 0⭐ 0
George Bgbargoud@masto.nyc
Oct 23, 2026, 12:44 PM
@GossiTheDog
So what Meta (who famously [edit: used to] use PHP extensively in what used to be their flagship product) spent on the complete failure that was the metaverse (~$60 billion) could have funded them at current levels for close to 100,000 years
💬 0🔄 2⭐ 16
Markus StollMarkusStoll@sueden.social
Oct 23, 2026, 12:55 PM
@GossiTheDog
Sure, but they knew about this since 2024!
So the main issue still is bad judgment on security here, as they invested their time and money obviously on other issues since then…
💬 1🔄 0⭐ 0
Kevin BeaumontGossiTheDog@cyberplace.social
Oct 23, 2026, 12:58 PM
@MarkusStoll I hate to alarm you but there are likely other known, bigger issues. They need funding.
💬 1🔄 0⭐ 0
Markus StollMarkusStoll@sueden.social
Oct 23, 2026, 1:03 PM
@GossiTheDog
I strongly doubt that there was a bigger issue than this, as this makes it very clear to everyone that you should avoid using PHP.
Still I concur, that whoever uses it, should contribute to this…
💬 0🔄 0⭐ 0
Walid, family🍉waledG@cyberplace.social
Oct 23, 2026, 1:04 PM
@GossiTheDog Only an iota of humanity Please save my life by opening the link and seeing my story. Help me with one dollar or share
https://chuffed.org/project/208485-give-waleeds-family-a-chance-to-live
💬 0🔄 0⭐ 0
Corsaccorsac@mastodon.social
Oct 23, 2026, 1:06 PM
@GossiTheDog and to be honest they're not the worst ones. At least they do have a budget, and core developers on the payroll. And many thanks to the @sovtechfund for that audit financing in 2024!
💬 0🔄 0⭐ 0
𝙳𝚢𝚕𝚊𝚗closingtags@mastodon.social
Oct 23, 2026, 1:10 PM
@GossiTheDog It is unreal that over $85k didn't reach the team because of fees!
For such thankless work (you know these processing companies are benefitting from PHP somewhere in their business), you'd think we could get them to wave some fees.
💬 0🔄 0⭐ 0
Mega Prutser 🇪🇺 🇺🇦 🇵🇸 💜prutser@bsd.cafe
Oct 23, 2026, 1:30 PM
@GossiTheDog Maybe do it like this?
https://friedcheese.us/notice/BBeqcF2cbhsH6CvfKC
💬 0🔄 0⭐ 0
P. S. F.prsfalken@mastodon.social
Oct 23, 2026, 2:24 PM
@GossiTheDog No hurries, hmm?
💬 0🔄 0⭐ 0
fuzzyfuzzyfungusfuzzyfuzzyfungus@cyberplace.social
Oct 23, 2026, 2:37 PM
@GossiTheDog When the newest PAN-OS version is rocking PHP 8.0.30 I assume that they've got themselves into a delightful backport hole.
An entirely predictable one that is their fault, of course.
💬 0🔄 0⭐ 0
Sir l33tnamel33tname@mastodon.social
Oct 23, 2026, 2:38 PM
@GossiTheDog i don't understand how these "security" people in companies buy from them
💬 0🔄 0⭐ 0
Trebachtrebach@functional.cafe
Oct 23, 2026, 6:05 PM
@GossiTheDog I bugged QNAP about 2 hours after the patch was released. I only got a reply today from an account manager that he is checking with the technical team on the timeline for updated firmware that would have the fix.
I am not plugging the box back in until they have updated firmware with the fix
💬 0🔄 0⭐ 0
Dec [{(:no_ai:)}]dec23k@mastodon.ie
Oct 23, 2026, 11:38 PM
@GossiTheDog
The company that shows up in everyone's httpd access logs with the weirdly verbose user-agent string?
💬 0🔄 0⭐ 0
caravantravellers 🌈caravantraveller@social.cologne
Oct 23, 2026, 2:26 PM
@GossiTheDog
Same with heartbleed and openssl at the time. Multi billion corporations should give a couple of millions.
💬 0🔄 0⭐ 0
Leela TorresLeelaTorres@ieji.de
Oct 23, 2026, 9:42 PM
@GossiTheDog
@OCRbot
💬 0🔄 0⭐ 0