basically everything short of poob is broken

Amazon Threat Intelligence identified a PHP2Shell exploitation attempt on 2026-10-17 in MadPot telemetry, 4 days before public disclosure of CVE-2026-109618 & CVE-2026-109619. It originated from an IP associated w/a commercial anonymization network. While the vuln was under embargo, the targeting of a honeypot from an anonymized IP suggests the activity was conducted by a threat actor, tho it remains unclear how the actor acquired exploit information prior to disclosure.

https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/

recommendation for tomorrow:
no one touch ANYTHING

“ignore the slop”

https://daniel.haxx.se/blog/2026/10/22/ignore-the-slop/

conspiracy theory: this is all happening so that github can say that their uptime is in line with the rest of the internet's

Yesterday, as I sat here, using a laptop running on Free software written and maintained by volunteers, to connect, by means of a secure tunnel formed by Free software written and maintained by volunteers, to multiple servers, all running Free software written and maintained by volunteers, to apply patches prepared urgently by volunteers to resolve security vulnerabilities, I felt *incredibly* grateful for every single one of those volunteers, who makes the fact that I could do *any* of this possible.

Thank you, genuinely.

#FOSS #FreeSoftware #Linux

Someone spent their tokens and generated a full port of curl to Zig. Thanks but no thanks.

RE: https://cloudisland.nz/@ehashman/117481992432596098

In the Netherlands, first we got a national news alert that all government websites were shutting down because of the PHP bug, and then our national comedian-newscaster Lubach did a bit about it.

so yeah, containment was breached

We are very aware of Cybersecurity this month. Can we stop being quite so aware of it next month maybe?

Happy birthday to Ursula K. Le Guin. "We live in capitalism. Its power seems inescapable. So did the divine right of kings."

Unless you live under a stone, everybody will have heard about PHP today.

Now, please realize that the vast majority of Open Source Software, like PHP, and including PHP, is largely maintained by **unpaid volunteers**.

If you agree that this is inconceivably irresponsible: let this be your call to action and FUND THE OPEN SOURCE PROJECTS YOUR ORGANIZATION RELIES ON.

Saying "Thanks" once in a while is not enough and does not make open source sustainable.

Oh no

This press release is gold:

https://emudhra.com/en/press-release/emudhra-statement-distrust-global-tls-intermediate-root-ca

"Last weekend, an independent researcher found that the weak keys could be reverse-engineered possibly with AI-assisted techniques."

Your private key was the number 4. Your fucking private key, which is supposed to be a 115 digit number, was the fucking number 4. As in, the fourth key a very naive first analysis would try. But sure scary scary AI did it.

I independently recovered the private key, without any AI assistance, on Monday evening. Not because I was involved in the incident, just because I was curious and had a little bit of free time on my hand.

I am reminded again how in 1935, the US Congress passed a tax law that created a new top tax bracket of nearly 80%.

That tax bracket contained exactly one person, John D. Rockefeller, and was designed to stop him from causing so much trouble.

In case anyone needs the precedent.

a reminder that if you see a vendor having an unscheduled outage today to apply PHP patches - that is actually one of the most encouraging things you can see from an #infosec perspective, because it means

A) someone/some people at the vendor is paying attention

B) that person/people has enough sway to have them bring down prod in the middle of the day to apply patches

C) enough people at the vendor actually know what software they are running to know its an issue that needs to be dealt with

So, reach out to them and let them know you appreciate it - so they have something to show people who push back the next time a similar thing happens

I deleted my Facebook account in 2017 because I saw what was coming and I didn't like it. I didn't "deactivate" it, I deleted it, according to all the "are you sure?" prompts I recall wading through to get the final message that if I don't log into it in the next 30 days, it's all gone forever.

This morning I woke up to a 2FA email request from Facebook, to the email address I last used with the service. It was a legitimate email from FB so I decided to see if my account was really just deactivated instead of fully deleted. Welp, guess what? I logged in with the password stored in my password manager, and it sent me a new 2FA code. I continued all the way in, and absolutely nothing was actually deleted. All of my friends from that era who still had Facebook accounts were in my friend list, my last post from the summer of 2017 was still there, and many more sent before that, along with photos that I recall individually deleting before closing the account just in case.

Facebook lied. Imagine that.

Of course I immediately went through the whole deletion process again, confirming I was sure at least seven times, and got the same "if you don't log in over the next 30 days all posts are deleted and unrecoverable". Gee, where have I heard that before?

I will try logging in around the first of December just to see what happens. As for that first 2FA request this morning, clearly someone has my FB login info. I know there was a breach a few years ago but I wasn't concerned back then since like a good tech person I only ever used that password on that site (which I confirmed with my password manager), and besides I had deleted my account right? ...Right. And I know that even if they really "delete" it this time and I can't get back in, they still have my data forever.

So the moral of the story (and we all know this already, don't we?) is that all corporations; all data holders and harvesters; all social media companies; all entities trusted with our personal and financial data, are lying to us. They are all defying the law, they are all disregarding their own data retention, privacy, and security policies, and they know they can get away with it so they do it with impunity. I'm in the US so there are virtually no laws protecting my rights. But even in the EU, the GDPR is not enough. Facebook/Meta was recently fined nearly a quarter of a billion Euros over "right to be deleted" legislation, and they brushed it off like the minor inconvenience it was.

Please stop anthropomorphizing AI company executives.

They're not sentient and they can't actually think. They just predict token sequences using statistical patterns scraped from LinkedIn, X and the Financial Times. The apparent "understanding" is simply a parlor trick: They produce text strings that *sound* plausible, but they don't actually have any understanding of the world.

I'll grant that they became a lot more technically impressive when Reinforcement Learning from Investor Sentiment pipelines were introduced, but fundamentally they're still just stochastic bullshit generators. Giving them access to the internet will end up being the most expensive mistake in the history of technology.