X XFediYour place in the Fediverse
XFEDI

#php

ActivityPub

Public posts with this hashtag.

Viktor Nagornyy@[email protected]

Today's #PHPocalypse needs to be a wakeup call for the #PHP community.

C, with Zend Engine, need to go.

One option is Rust. A lot of effort went into https://phprust.com already. I hope more people will contribute to that project, especially PHP core developers.

Otherwise, vulnerability after vulnerability PHP's market share will continue to shrink. Breaches will affect many lives. Patches will become more and more complex.

It's time for C to go.

#php2shell #OpenSource #rustlang

PHP RustPHP Rust — PHP 8.5 reimplemented in Rustphpr is a from-scratch PHP 8.5 runtime in Rust: a bytecode VM, measured compatibility, WordPress full-suite parity and an evolving resident server.
↩ Reply ♡ 0 · ↻ 0 ↗ Original
Pier-Luc Brault@[email protected]

Considering it took until the end of the day for me to remember that Nextcloud is written in PHP, I sure am glad I made that move a few weeks ago:

https://plbrault.com/blog-posts/i-now-use-tailscale-to-access-my-self-hosted-apps/

#PHP #PHP2shell #Cybersecurity #SelfHosting #Nextcloud #tailscale

plbrault.comI Now Use Tailscale to Access My Self-Hosted AppsI self-host many apps on my home network, two of which I need access to when I am not at home: Nextcloud and Home Assistant. For years, I…
↩ Reply ♡ 0 · ↻ 0 ↗ Original
Third spruce tree on the left@[email protected]

UGH.

So someone internally raised the fact "hey, we have #PHP on <one of our devices>" and so technically one of our products is affected and now I have EVERY exec LOSING THEIR SHIT and asking for status updates every 30 minutes im like hold the crap on, I'm still doing the technical assessment, and they're like "Copilot said to do this" or "Claude suggested". UGH. uh yeah, you have no idea how we use PHP dude just chill out.

Anyone else currently enjoying the c-suite #php2shell hug of death aka "oh no, news about it made it to LinkedIn now I have seven executives backseat driving everything im doing."?

↩ Reply ♡ 0 · ↻ 0 ↗ Original
Japan Cyber Watch@[email protected]

Before the php2shell patch even existed, pixiv, DMM, niconico, BASE, childcare app Codmon and some municipalities took services offline. Japan's National Cyber Office and then PM Takaichi said a temporary stop is an effective way to cut risk.

In our view, a day that showed how far Japan's cyber response has come.

Fixed: PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. 8.1 and older get no release.

https://japancyberwatch.com/articles/php2shell-critical-php-flaws-japan-services-pause-2026#a-country-that-hit-pause

#PHP #infosec #Japan

japancyberwatch.comphp2shell: PHP Patches Two Critical Flaws as Japan Takes Websites Offline, With the Prime Minister's BackingPHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws that allow unauthenticated remote code execution. Before the release, Japanese services from pixiv to childcare app Codmon switched off, and Prime Minister Takaichi called pausing websites an effective way to cut risk.
↩ Reply ♡ 0 · ↻ 0 ↗ Original
DysruptionHub@[email protected]

CivicPlus' Web Open municipal website platform remained offline with no restoration estimate after a precautionary shutdown over a PHP vulnerability, according to the company. The disruption includes the Naples, Florida, city website.

CivicPlus says Community Development version 3 is offline and version 4 has been restored but remains under monitoring. The company has not identified the flaw or said whether it was exploited; it says there is no evidence customer data has been compromised.

#CivicPlus #WebOpen #PHP #MunicipalGovernment #ServiceDisruption #GovernmentTechnology #Cybersecurity #Florida

https://dysruptionhub.com/civicplus-php-security-website-shutdown/

DysruptionHubCivicPlus takes municipal websites offline over PHP security flawCivicPlus took municipal websites offline over a PHP vulnerability. Naples, Florida, reported website and council agenda disruption.
↩ Reply ♡ 0 · ↻ 0 ↗ Original
Ben Rothke@[email protected]

If your team runs #PHP, today matters. Two critical RCE flaws (CVSS 9.2). Fixes scheduled for 14:00 UTC. No confirmed official patches for PHP 8.1 or older. Good info from @MiggoSecurity research details what's confirmed, how to reduce exposure & more. https://api.cyfluencer.com/s/php2shell-what-we-know-and-what-to-do-before-the-patch-30093

www.miggo.ioPHP2Shell: What We Know and What to Do Before the PatchPHP2Shell: two critical PHP RCE flaws get a fix October 21 at 14:00 UTC. Miggo shares what we know, what’s unverified, and what to do before the patch lands.
↩ Reply ♡ 0 · ↻ 0 ↗ Original
AA@[email protected]

New.

Palo Alto: CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products https://security.paloaltonetworks.com/CVE-2026-109618 #infosec #PHP #vulnerability

@mttaggart

Palo Alto Networks Product Security AssuranceCVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks ProductsPalo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory er...
↩ Reply ♡ 0 · ↻ 0 ↗ Original