i have crossed some sort of irony thermocline in how i view this stuff, i find the deranged replies here nourishing
Internet Archive@archive.org · 6h agoAn update from Brewster Kahle on today's outage.
Liz Fong-Jones (方禮真)
@lizthegrey.com
Technical Fellow, @honeycomb.io American by birth, Chinese by heritage, Australian by choice living on occupied and unceded Gadigal and Musqueam/Squamish/Tsleil-Waututh land she/it
Internet Archive@archive.org · 6h ago
it's days like today that you learn whether your vendors are actually delivering the service you are paying them heaps of money for
if you, like me, spent two days patching and wondering whether you missed something: same. the checks are boring. which workloads run fixed vs vulnerable PHP or Go builds, and where repeat 500s hit while exposed (a good sign of compromise). if events carry runtime version, it’s a query, not a grep.
fingers being pointed right now about the embargo breaking several hours early: contrast lnkd.in/p/gttG5pCY with thephp.foundation/blog/2026/10...
Today's PHP Security Release, and How We're Strengthening PHP Security
Describing the story behind how critical security vulnerabilities were found and fixed.
thephp.foundation
The only good thing that may come out of this shanda is that more people will learn about Jill and the amazing work that T'ruah does.
T'ruah: The Rabbinic Call for Human Rights@truahrabbis.bsky.social · 16h agoT’ruah CEO Rabbi Jill Jacobs and 11 other T’ruah-affiliated American rabbis were detained by the Israeli army Wednesday morning while accompanying Palestinian farmers during the olive harvest in the West Bank.
An embargoed security issue in PHP leaked and it is extremely serious: all versions >5.4 are affected. No patches are available yet. I highly recommend shutting down any PHP services until the patch is available—that's how severe this issue is.
the fact that this can be about two different things today
Site Reliability Enby@siterelenby.net · yesterday
new reference PDS container has been published! if you do the classic self-hosting auto-update setup, you can force a faster refresh with: sudo pdsadmin update and while you are in there why not: sudo apt update sudo apt upgrade
Bad day to launch my PHP based certificate authority
In case anybody needs social proof/thinks I'm exaggerating.
John David Pressman@jdp.extropian.net · yesterdayThis is not a tomorrow thing, this is a "if you're reading this take down your PHP based website" thing.
BTW knowledge of the existence of this vulnerability enables a well financed malware group to use AI to find it, if you run PHP anything you should be taking the service down NOW until a patch is available. And then patch before bringing the service back up.
nightshade →home, for now@nightshade.technology · yesterdaydetails leaked. this vulnerability is a full unauthenticated unconditional remote code execution exploit against any service running on a PHP version from 5.4 until latest yeah if anything deserves CVSS 11, this is it. this is CATACLYSMICALLY bad.
For those who run Node.js services—we are currently still waiting for a Node.js security release. In the meantime you can apply a runtime mitigation by adding `--import=@atproto-labs/fetch-node/emudhra-preload` to your service entrypoint. More details at: npmx.dev/package/@atp...
so... what's on tomorrow's wheel of misfortune? today's 0-day was caused by a [missing bounds check] in the [Javascript runtime] and has been assigned a CVSS of [8.5]
“innovation in insider trading” is another reason why we should ban prediction networks faking polls is bad! you shouldn’t be able to easily make money betting on your own faked polls!
BeshearStan@beshearstan.bsky.social · yesterdayUPDATE: I found Wedgewood’s Kalshi account. He goes by Andrew and has been insider trading using the fake polls that he was posting. I reported this to Kalshi, hope they do something about it @gelliottmorris.com
`session.upload_progress.enabled = Off` is a stopgap, so at least it isn't as demonic as like, heartbleed remediation was, but enjoy figuring out whether your router has been weaseled or whatever I want to say that only the PHP team could cause a heap UAF, but someone else will live down to that
Only for the curious...
jackalsyn.com
if as reported, this might be the worst vuln of my adult life? I'm really glad I'm between jobs right now
nightshade →home, for now@nightshade.technology · yesterdaydetails leaked. this vulnerability is a full unauthenticated unconditional remote code execution exploit against any service running on a PHP version from 5.4 until latest yeah if anything deserves CVSS 11, this is it. this is CATACLYSMICALLY bad.
For most people the right answer is almost always to take your software updates as they become available and otherwise let the engineers work the problem and worry about it for you
This is a reminder of the ways in which you can influence betting markets with fake scams, at a time where big news outlets like CBS News are incorporating these markets into their coverage and graphics.
G Elliott Morris@gelliottmorris.com · yesterdayWe were investigating Wedgewood for faking their data and emailed them for comment this morning, ahead of publishing the findings tomorrow. They are now trying to cover up their fraud with the "we were doing a social experiment" excuse. Full story here: blog.fiftyplusone.news/p/fiftypluso...
We should start requiring root certs to support name constraint validation. It was never adopted due to browser bugs. But it is time.
No, people really are not getting this. The login needs to be through your SSO so that your IT team can cut you off. An SSO that uses passkeys is a good SSO. A random app using SSO has absolutely no use for passkeys, they add nothing. For consumer accounts, just use passkeys, yes, they're the best.
the fact that an intermediate CA in India that sells only into the Indian market, when compromised, can generate TLS certs for literally any website on the internet, that feels like a major trust boundary problem
Filippo Valsorda@filippo.abyssdomain.expert · 2d agoAfter the firefighting is done (and a nap) we'll need to have a long, serious conversation about the state of non-browser non-platform X.509 verifiers. The Linux status quo is "a pile of PEM files behind a dumpster" and that's not an acceptable excuse for a root store in 2026.
THIS IS NOT A DRILL. If you package/distribute/maintain root stores or chain verifiers, act immediately. If you know how to remove trust in a root, consider doing it now. Otherwise, prepare to update systems as patches/mitigations come. Go users, update to Go 1.27.3 or Go 1.26.10.
Compromised eMudhra Intermediate Certificates
Dear Mozilla Community,
groups.google.com
After the firefighting is done (and a nap) we'll need to have a long, serious conversation about the state of non-browser non-platform X.509 verifiers. The Linux status quo is "a pile of PEM files behind a dumpster" and that's not an acceptable excuse for a root store in 2026.
me going to work this morning: 😀🎶🎶🎶 me seeing a go patch release for security: eh, probably not a big deal me opening up the patch release email: crypto/x509, eh, probably not a feature we use, no rush me opening up bsky morning digest from LLM: 😡😡😡😡😡 current state: 🙀🙀🙀🙀🙀🙀