shitposts aside, this one is serious, my loves: if you’re just waking up and you have any service online running PHP 5.4 to latest, you need to take it down RIGHT NOW and don’t put it back online until after it’s patched absolutely catastrophic vulnerability dropped in the middle of the night
Oct 21, 2026 at 12:56 PM
Chris Silverman 🌻 (@csilverman@mastodon.social)
Nothing puts the lie to "PHP is irrelevant" like "good morning, 70% of the internet needs to be fixed ASAP".
Today's PHP Security Release, and How We're Strengthening PHP Security
Describing the story behind how critical security vulnerabilities were found and fixed.
Today's PHP Security Release, and How We're Strengthening PHP Security
Describing the story behind how critical security vulnerabilities were found and fixed.
PHP warns admins of two critical flaws, emergency patches coming tomorrow
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure.
Today's PHP Security Release, and How We're Strengthening PHP Security
247 votes, 49 comments. We have posted more information about today's security releases, including the sequence of events that led to the discovery…
A Response To PHP- The Wrong Way
For anyone who isn’t aware, there is a site call http://phptherightway.com, which is a summary of good (dare I say, best?) practices for…
Why everything was broken yesterday
Unsolicited tech advice about the two issues (PHP, compromised certificates) that, separately, each pose some security risks and are worth attending to.
PHP CVE-2026-109618 and CVE-2026-109619: how to apply the patches
Install the fixed PHP for CVE-2026-109618 and CVE-2026-109619 on Ubuntu, Debian and RHEL, restart the right processes, and roll back the early mitigations.
100+ reactions to 100+ solutions
“We are all grappling with the announcement of 6 October. We think that it is useful to have a snapshot of the community’s gut feeling today, and this is what you see below. We will keep it o…
The Internet as existential threat
Some days I wonder if we are completely screwed. So today’s post is a perhaps slightly hysterical outburst. The news is not paying enough attention to the Petya/NotPetya ransomware, and the e…
Opinion | Internet Hacking Is About to Get Much Worse (Published 2018)
We can no longer leave online security to the market.
Cloudflare deploys protections against php2shell vulnerability
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers.
REALSS | Welcome | realss
When starting a new project, you can not possibly foresee all changes that you may need to implement in the future. Eventually a situation will arise that can not be covered with your current website, and you are forced to rebuild your site. Such a rebuild can be costly, and you risk breaking or loosing existing functionality.
Patch the Planet: a Daybreak initiative to support open source maintainers
OpenAI introduces Patch the Planet, a Daybreak initiative helping open-source maintainers find, validate, and fix vulnerabilities with AI and expert review.
