Local village web admin is still awake. It’s coming up to 3AM. I can hear him out the back of my bedroom window. There are amazingly lyrical swear words I’ve never heard before.
Don’t think he’s very happy.
#php

Local village web admin is still awake. It’s coming up to 3AM. I can hear him out the back of my bedroom window. There are amazingly lyrical swear words I’ve never heard before.
Don’t think he’s very happy.
#php

Massive thanks to Ondřej Surý for spinning out vast php builds in a big hurry.

@deb seems to be quiet here, but the hours are definitely getting put in elsewhere. [ @ondrej !]

#php
#sury
#cve2026109618
#cve2026109619

Graphic is a paraphrase of XKCD, from https://codeberg.org/oerdnj/deb.sury.org/issues/145

So today some of the worst people on earth using the most environmentally destructive tools on earth brought down a huge part of the internet by exploiting a potential problem found many years ago in PHP which was previously not practical for anyone to exploit.

It only became "practical" to exploit this problem because "AI" came along to automate the boring and repetitive work required to do so. Absurd amounts of computing power were applied specifically to break into other peoples' websites.

Now the same people who are behind this are trying to pretend that they're heroes for finding an exploit.

"AI uncovers critical vulnerabilities", their headline reads. But the vulnerability was only made to be critical by the very same people as hide behind that headline.

Many thousands of websites are offline, many people are losing money, many thousands of people are working hard to try to patch or work around the problem, many small guys are finding it almost impossible to patch, and we're all supposed to be thankful to OpenAI and others involved ? Nah. Fuck off.

Everything about "AI" involves a lot of externalized costs, but I've still yet to see even a single positive thing that has been achieved by "AI". That has definitely not changed today.
#php2shell #php #fuckai #openai

So today some of the worst people on earth using the most environmentally destructive tools on earth brought down a huge part of the internet by exploiting a potential problem found many years ago in PHP which was previously not practical for anyone to exploit.

It only became "practical" to exploit this problem because "AI" came along to automate the boring and repetitive work required to do so. Absurd amounts of computing power were applied specifically to break into other peoples' websites.

Now the same people who are behind this are trying to pretend that they're heroes for finding an exploit.

"AI uncovers critical vulnerabilities", their headline reads. But the vulnerability was only made to be critical by the very same people as hide behind that headline.

Many thousands of websites are offline, many people are losing money, many thousands of people are working hard to try to patch or work around the problem, many small guys are finding it almost impossible to patch, and we're all supposed to be thankful to OpenAI and others involved ? Nah. Fuck off.

Everything about "AI" involves a lot of externalized costs, but I've still yet to see even a single positive thing that has been achieved by "AI". That has definitely not changed today.
#php2shell #php #fuckai #openai

We have posted more information about today's security releases, including the sequence of events that led to the discovery, how the PHP security team is improving their processes, and what we need from you to continue this critical work. https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
#php #security