皆様に、今夜に対応して頂きたい大至急のお願いです。   多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。   公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。   修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。   国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。 国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X

PHP Patch is out!! PHP 8.5.12: 31c0ea7d7f github.com/php/php-src/commi… PHP 8.4.27: 506e87fa7d github.com/php/php-src/commi… PHP 8.3.36: 3c832b523e github.com/php/php-src/commi… PHP 8.2.35: 01a40e89fb github.com/php/php-src/commi… The two advisories with the full details: GHSA-w8hw-w9fx-j79w (CVE-2026-109618) github.com/php/php-src/secur… GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) github.com/php/php-src/secur…

🏀 We simulated tonight's OKC @ Spurs 5,000 times Every possession is built from real 2025-26 play-by-play: where each player shoots from, how often he makes it, who he passes to, and who's guarding him. Here's the most typical game ⏬

Here is a full list of what you can do NOW for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) as a temporary mitigation. (generated and validated by LLM) 1️⃣ Do this first. In php.ini or the FPM pool, set: session.upload_progress.enabled = 0 Reload PHP-FPM, then update PHP right after the release (21 Oct, 14:00 UTC). 2️⃣ Edge block until you patch. It blocks the PHPSESSID cookie and query (also lowercase and URL-encoded), and all multipart/form-data requests. ⚠️ File uploads stop working until you remove it. ☁️ Cloudflare (WAF custom rule, action Block): (lower(url_decode(http.cookie)) contains "phpsessid") or (lower(url_decode(http.request.uri.query)) contains "phpsessid") or (any(lower(http.request.headers["content-type"][*])[*] contains "multipart/form-data")) 🟩 nginx (http {} context): map "$http_cookie|$args|$content_type" $block_php2shell { default 0; "~*(?:p|%[57]0)(?:h|%[46]8)(?:p|%[57]0)(?:s|%[57]3)(?:e|%[46]5)(?:s|%[57]3)(?:s|%[57]3)(?:i|%[46]9)(?:d|%[46]4)" 1; "~*multipart/form-data" 1; } In each server {} block: if ($block_php2shell) { return 403; } 🔒 Caddy: @php2shell expression `{header.Cookie}.matches("(?i)(?:p|%[57]0)(?:h|%[46]8)(?:p|%[57]0)(?:s|%[57]3)(?:e|%[46]5)(?:s|%[57]3)(?:s|%[57]3)(?:i|%[46]9)(?:d|%[46]4)") || {query}.matches("(?i)(?:p|%[57]0)(?:h|%[46]8)(?:p|%[57]0)(?:s|%[57]3)(?:e|%[46]5)(?:s|%[57]3)(?:s|%[57]3)(?:i|%[46]9)(?:d|%[46]4)") || {header.Content-Type}.matches("(?i)multipart/form-data")` respond @php2shell 403 🚦 Traefik v3 (Coolify: Server > Proxy > Dynamic Configurations). Add this to the https router and also to a copy for the http entrypoint: http: routers: block-php2shell: rule: "HeaderRegexp(`Cookie`, `(?i)(?:p|%[57]0)(?:h|%[46]8)(?:p|%[57]0)(?:s|%[57]3)(?:e|%[46]5)(?:s|%[57]3)(?:s|%[57]3)(?:i|%[46]9)(?:d|%[46]4)`) || QueryRegexp(`PHPSESSID`, `.*`) || HeaderRegexp(`Content-Type`, `(?i)multipart/form-data`)" priority: 100000 entryPoints: [https] middlewares: [deny-all] service: noop@internal tls: {} middlewares: deny-all: ipAllowList: sourceRange: ["255.255.255.255/32"] ✅ Test: curl -s -o /dev/null -w '%{http_code}\n' -H 'Cookie: PHPSESSID=x' https://your-app → 403 curl -s -o /dev/null -w '%{http_code}\n' -F a=b https://your-app → 403 The edge block does not protect direct origin access. Disable upload_progress and patch PHP.

GPT-6.1-Sol reasoning traces totally legible, nothing to worry about

Full details of a remotely exploitable vulnerability in the core engine of *all* PHP versions will be released tomorrow, October 21st. If your organization has internet facing PHP applications then you need to be ready to patch the minute the update is released or *strongly* consider taking the application offline until you can: php.net/index.php#2026-10-20…

Oh boy, it's about to get serious tomorrow 😬 cert.europa.eu/publications/…

Oh god: The p384 private keys are randomly selected integers between 1 and 256, the private keys are effectively all-zeroes apart from the last byte

todays target is a baby camera asked DeepSeek to root it, de-bloat it, and cut it off from the cloud. it verified the whole thing across two reboots finally I can delete the app thats filled with ads