Security vendor Palo-Alto plans to release patches for their flagship firewall product to fix the PHP vulnerabilities in them sometime next week, after they’ve finished scratching their arse.
Mastodon Digest
Posts
PHP Foundation’s budget is about 700k a year. It’s used on something like 40 million websites. Almost no company who uses it contributes anything and many people work on it for free.
The latest trend is cybersecurity and AI vendors have realised they can vampire off its security for publicity (money).
Perhaps the world would be a better place if those orgs who rely on it just contributed sponsorship to the foundation, and vendors didn’t monetise vulnerabilities for themselves.
There is another PHP potential RCE vulnerability - CVE-2026-115560 - without a patch. Do not panic.
It is a non-default configuration and will not be a widespread issue.
The mitigations in this thread already fix it, if you want to panic.
🚨 PHP warns of another unpatched remote code execution risk; CVE-2026-115560
The newly disclosed vulnerability is separate from the two PHP2Shell flaws patched earlier this week and is not fixed by PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
⠀
PHP says exploitation requires an unusual configuration where an application:
• Uses php_binary or php_serialize as its session serializer
• Changes the serializer to php at runtime before session_start()
• Has session upload progress enabled
⠀
PHP considers the risk unlikely and plans to release a fix during its next regular update cycle.
Until then, administrators with affected configurations should set:
session.upload_progress.enabled=0
Applications that do not change the session serializer at runtime are not exposed through this path.
No exploitation has been reported.
Source:
https://www.php.net/
CYBER CEASEFIRE DECLARED
Pls stop all hackings
New Call of Duty game is out
Shooty shoot face starts now
Hackings recommence on Tuesday
CYBER CEASEFIRE DECLARED
Next scheduled ceasefire mid November for GTA 6
I thankings you for respecting the cyber
Everyone has kind of laughed it off but there’s actually now an official investigation by multiple organizations into why my US election ballot hasn’t been released from US customs in a month without any explanation.
Boosts
By the way, this part of the eMudhra story doesn't get the attention it deserves: Google hired Daniel Bleichenbacher, he wrote a tool to identify insecure cryptographic artifacts, and Google did not use it regularly to check certificates and intermediates trusted by Chrome's root store.
somebody please take AI away from anybody and everybody involved in commercial food sales, marketing, and/or distribution
