TodayStory on Mastodon
Trending on Mastodon: 5 people posted about it in the last 3 hours this edition covers.
All 60 posts of this story, best first: each person’s best post, then their other posts. Page 1 of 2. The title is the name people mention most, or the opening line of the best post.
A bit of follow-up on the PHP exploit-global emergency website update that's been in the news recently, and how bad it was: turns out most of the fix' deployment that saved the internet rested on a single, free-software volunteer. theatlantic.com/technology/202… The XKCD law of Free Software remains undefeated:
Two remote code execution vulnerabilities rated 9.0 on CVSS affecting the Linux kernel's built-in KSMBD server were disclosed publicly on mailing lists before kernel fixes were available. One flaw requires no network authentication on port 445, while the other involves SMB Direct. Kernel maintainer Greg Kroah-Hartman criticized public submissions without attached patches. en.hacks.gr/dyo-sovara-kena-as… #Linux #Kernel #OpenSource #Vulnerability
Your PHP server can be rooted by a single HTTP request — no login, no payload you can spot in the logs. php2shell (CVE-2026-109618, CVE-2026-109619) is unauthenticated RCE, already exploited in the wild. Fixes landed yesterday: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. And patching the disk is not enough — the old binary keeps running in RAM until the FPM service actually restarts. Step-by-step emergency patching guide: #PHP #CVE #InfoSec #SysAdmin
TL;DR While you should probably update your PHP instance where possible, there's a surprising lack of real working exploit code kicking around. "The second [log4shell/Shellshock/Heartbleed] made the news, there were botnets doing the rounds causing damage [before LLMs]" - eliastaylor.com/noexploit/ The #NodeJS security releases that came out yesterday also fixed high severity issues. In 2026 you need to keep any system exposed to the internet fully patched otherwise you're running a real risk.
I was going to make a joke about #COBOL never having a CVE as severe as #php2shell, but it turns out Microfocus COBOL had its very own 9.8 back in 2023. Oh well. app.opencve.io/cve/CVE-2023-45…
If your web host just warned you about PHP2Shell (CVE-2026-109618), do not panic. You can close the vulnerability in 60 seconds with one config line without taking your site down: session.upload_progress.enabled = Off The #1 question we're hearing: "Will this break my WordPress media library or WooCommerce store?" No.
In case you would, like me, be desperately upgrading your #Synology because #infosec after a while, be aware that when doing from DSM 7.2 to DSM 7.4, exFAT package goes away and is replaced by native exFAT implementation. Which would be fine except previously key manager was able to mount keys stored on an unpartitioned USB key and not it isn't. Do not test your backups, test your restores!
We helped to coordinate three security responses this week: - Pixi 0.82.1 revokes the eMudhra certificate, please update - PHP 8.5.12 was released by us on conda-forge - litellm 1.107.0 quarantined and blocked on prefix Read more about conda.org/blog/2026-10-21-emud…
Looks like in addition to the recent SSL/TLS and PHP vulnerabilities there's also an RCE in BIND: lists.isc.org/pipermail/bind-a… (Though I'm not sure why someone would be using BIND in 2026, I stopped around 2001 or so)
The brotli problem is indeed in the C library: CVE-2026-111497: out-of-bounds write permits remote code execution
A Google server misconfiguration caused some Google Home speakers to repeatedly download software updates, leading to excessive data consumption. Some users reported several terabytes of data usage, impacting home Wi-Fi networks and data caps. Google confirmed the issue is resolved and deployed a solution. Users can monitor smart device data usage through router interfaces or internet provider applications to identify similar anomalies. Read more: wired.com/story/google-home-sp…
How come the #nix package available in #NixOS is not the latest available version? the website offers a download of the 2.35.3 while search.nixos.org returns the 2.34.9 (on whether stable or unstable channels) According to this CVE, an upgrade to 2.35.3 is recommended to address the vulnerability.
CRON_TZ in a crontab works on Fedora, Alma and Arch. On Debian, Ubuntu and Alpine it's silently ignored. We ran the same crontabs through six distros' cron and found one bad line kills a whole file on Ubuntu, and 61 * * * * runs every minute on Alpine: #cron #linux #selfhosted runwisp.com/blog/cron-implemen…
⚠️ To anyone running coop cloud apps, be aware of the vulnerabilities recently released in PHP. You can check the PHP version of your current recipes with: abra app run <DOMAIN> app -- php -v The following versions are secure: 8.5.12, 8.4.27, 8.3.36, and 8.2.35 If you're running a different version than these, undeploy the app until a new release is available. Our community is actively collaborating over on #coopcloud-security:matrix.org - join us there for updates! - amras
FYI: Regarding the current #PHP vulnerabilities, if you're on arm (e.g. #RaspberryPi), please be patient and keep checking those version numbers - packages with patched PHP versions are still being built by @deb . codeberg.org/oerdnj/deb.sury.o… #NextcloudPi #Nextcloud
Because we were asked whether #php2shell affected us: The backend and webapp-servers are go based and do not use PHP at all. While our homepage, zeitkapsl.eu, is generally static, we did have a single index.php doing the language-based redirect (to /en or /de). Yesterday at noon (so hours before the scheduled disclosure & patch), we replaced that single PHP file with an Apache redirect rule and disabled PHP on the host completely (and most likely permanently).
“Siemens on Oct. 19 disclosed that attackers exploited a flaw in its Software Center product by spreading malware via a ClickFix attack. The flaw — CVE-2026-110936 — loads dynamic-link libraries (DLLs) from an uncontrolled search path into the affected application.” scworld.com/news/siemens-softw…
🔒 Mitigating Linux Kernel 6.x VMA Race Conditions in K8s Worker Nodes Container scanners (Trivy) miss host-level Kernel VMA lock contention & memory leaks under heavy workloads. ⚡ Quick sysctl fix (Zero Downtime): sudo sysctl -w vm.max_map_count=262144 sudo sysctl -w vm.mmap_min_addr=65536 📖 Full guide & audit script (.sh): gist.github.com/dainadaina17/5… #DevOps #Kubernetes #Linux #InfoSec #CyberSecurity #CloudNative #SRE
🎨 Blade-aware Tailwind sorting: in dynamic classes like bg-{{ $color }}-500 the partial class is pinned in place. The @theme block is loaded first, so custom classes like bg-brand sort alongside the built-in colors 🛡️ Alpine attributes get canonical spacing. The rewritten output is verified token by token, and the original is kept if anything moved
ASLR supporting PHP exploits are coming, probably next week.. but it’s a really good security control (from decades ago) you should demand your vendors actually enable as it enabled time for orgs paying attention to patch. The cybersecurity vendor industry itself is essentially negligent when it comes to this stuff. infosec.exchange/@catc0n/11748…
ISC has been fortunate to have @ondrej as our Director of DNS Engineering since 2017. But independently of his day job, he is an important maintainer of PHP packages for Debian and Ubuntu. This has become even more significant over the last few days as the PHP RCE vulnerabilities have been disclosed. We are so proud of Ondřej, and grateful for him and all the other unsung heroes of the global Internet who work for the common good. Read more at the Atlantic: theatlantic.com/technology/202…
Dynu.com, the popular free Dynamic Domain Name Service (DDNS), has just been hacked and reported the following: "Some Dynu services are currently down due to data corruption [...] We recently detected unauthorized access to some of our systems and have placed them in lockdown as a precaution. Our investigation so far shows no evidence that any customer data was taken. Our team is working to restore full service". #internet #dns #security #hacking #sysadmin #linux #windows #mac #android #web
Details have been published of a critical flaw in the programming language PHP, which is the backbone of more than 70% of all websites. Left unfixed, the flaw would allow hackers to easily take over and compromise millions of websites and the information held on their servers. In response, multiple European governments have taken websites offline. tcnv.link/tsDq6OK
As per #Synology customer support: "Until the applicable PHP updates are installed, please temporarily disable websites and stop packages that use affected PHP versions. These include: Web Station: Disable websites using affected PHP versions. Web Station itself does not depend on PHP, but websites hosted through it may use an affected PHP version. MailStation: Uses PHP 7.4 and has reached end of life as of DSM 7.4." (2/3) #php #php2shell
New WordPress sites don't need 25 plugins. Pick only what you need. Useful options include Rank Math or Yoast for SEO, WP Rocket or LiteSpeed Cache for performance, UpdraftPlus for backups, Wordfence for security, ShortPixel for images, Redirection for redirects, WPForms for forms, WooCommerce for stores and Query Monitor for debugging. Don't install plugins that do the same job. Check compatibility and updates before installing anything. #WordPress #WordPressPlugins #WebDevelopment
Yesterday, developers released vital patches for PHP, a programming language that powers roughly 70% of the world’s websites, warning that if those patches aren’t manually deployed ASAP, hackers could cause serious damage. news.rgrichardson.ca/2026/10/a…
UK government services offline after global PHP cybersecurity threat independent.co.uk/news/uk/home… Cybersecurity chiefs warned UK organisations that a ‘critical security issue’ had been discovered in the programming language PHP, A total of 32 UK government services are temporarily offline and four are partially unavailable, ministers confirmed on Thursday.
Planning a Proxmox VE server build? Before you buy, size hardware around your real workload: ▪️ CPU cores vs per-core speed ▪️ RAM tiers + ECC ▪️ NVMe vs SATA SSD ▪️ ZFS needs an HBA, not hardware RAID ▪️ 1 / 10 / 25 Gbps networking ▪️ Single node vs cluster Full guide with example configs and a 10-step checklist: fitservers.com/blogs/how-to-ch… #Proxmox #SelfHosted #HomeLab #Virtualization #DedicatedServer #ZFS #SysAdmin #Linux
Oh, an RCE in Bind too? Oh COME ON. CVE-2026-94300 What's next, Sendmail?
Numerous websites, including Canadian government sites, went offline Wednesday in order to implement a fix after vulnerabilities were found in PHP, a widely used programming language. Source: CBC News Business cbc.ca/news/business/canadian-…
A few hours ago, I updated all Rikidar websites & their replicas to the PHP versions that fully mitigate these CVEs No security incidents occured forum.rikidar.eu/post/18 #CorkApp #sysadmin #php2shell
Spotted only today, but #Nextcloud included a notification/warning pointing at cert.europa.eu/publications/se… That's not bad. Pretty good, actually.
If you're emailing clients today or posting about the PHP vulnerabilities, some tips... 🧵 #php #cybersecurity
I can almost hear infosec managers around the globe repeating on loop, “*this* is why I fucking told you we need to keep an inventory of all of our PHP apps.” Stay safe out there today, kids!
As of yesterday, we have implemented fixes for PHP's latest CVEs for #PHP2Shell in all of the PHP packages we maintain. If you use LiteSpeed repos, you can update to the latest lsphp versions via yum, dnf, or apt as appropriate.
Yesterday was a very interesting day. At least from a technical point of view. 😅 From the realization what's going on, how critical this will be, preparations for patching, mitigation of servers, etc. At Infiniroot we learned early about the upcoming #PHP patches that will fix the #php2shell vulnerabilities. On our company blog we share how our day went and why the world panicked. infiniroot.com/blog/1552/how-w…
In today's @theoverspill: the revelation of a huge PHP vulnerability and a certification collapse makes the internet look increasingly unstable. theoverspill.blog/2026/10/22/p…
Ubuntu rolls out php2shell, eMudhra certificate fixes #Linux omgubuntu.co.uk/2026/10/ubuntu…
Given the number of RCE vulnerabilities and compromised certificates out there in the wild, is anyone in the tech industry going to enjoy their weekend this week? #tech #hell
I have not heard you disavow PHP CVE-2026-109618 and CVE-2026-109619 yet!
Zoho Japan Corporation support.zoho.co.jp/portal/ja/k…
Librarian.net: Why half the internet was broken yesterday, the two issues Unsolicited tech advice about the two issues (PHP, compromised certificates) that, separately, each pose some security risks and are worth attending to. librarian.net/stax/6002/why-ha…
PHP2Shell Fixed Versions by Distro: Ubuntu, Debian, RHEL, Amazon Linux Exact fixed PHP package versions for CVE-2026-109618 and CVE-2026-109619 on Ubuntu, Debian, RHEL and Amazon Linux, plus how to confirm your server is patched. rahulranjan.org/2026/10/23/php…
Today: Semantics 21 offers S21 VisionX, S21 CCTV and S21 Transcriber for offline forensic analysis; Passware Kit 2026 v4 adds YellowKey BitLocker recovery, E01 export and eCryptfs support, and more. forensicfocus.com/news/headlin… #DigitalForensics #DFIR
Affected by PHP2Shell (CVE-2026-109618/CVE-2026-109619)? Freexian’s PHP LTS provides updates for PHP 5.6 and later on Debian 9+ and Ubuntu 18.04+. Explore our plans at freexian.com/lts/php/?utm_sour… or get in touch to discuss your options. #php2shell #php #freexian
Canonical Day in Rome, the 5th of November 2026. Save your spot: ubuntu.com/engage/canonical-da…
Don't forget to update all those docker containers running PHP. #InfoSec
Recent PHP drama is a good reminder to go with static site generators. Stop worrying and get yourself a site that will last for ages. If you need help, ping me! My inbox is always open. silvestar.codes/contact/ #WebDev #CyberSecurity #PHP #StaticSiteGenerator #Jamstack
If you use Palo-Alto firewalls, make sure you upgrade for the PHP vulns. In particular, if you have the mgmt interface facing the internet upgrade those now. The Palo-Alto firewall VMs have ASLR disabled which makes exploitation trivial.
Also hp system management homepage (installed on HPE Proliant servers) all ship with PHP.. with no ASLR. There doesn’t appear to be a patch for that, you can use it to surf around flat networks as it drops you as SYSTEM/root.
