(ℹ) Join us now at the IRC channel | ䷉ Find the plain text version at this address (HTTP) or in Gemini (how to use Gemini) with a full GemText version.
| *psydruid (~psydruid@jevhxkzmtrbww.irc) has left #boycottnovell | Oct 26 06:20 | |
| *psydruid (~psydruid@jevhxkzmtrbww.irc) has joined #boycottnovell | Oct 26 06:24 | |
| schestowitz[TR2] | Re: Official announcement from PHP foundation | Oct 26 07:07 |
|---|---|---|
| schestowitz[TR2] | > Today's PHP Security Release, and How We're Strengthening PHP Security | Oct 26 07:07 |
| schestowitz[TR2] | > https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ | Oct 26 07:07 |
| schestowitz[TR2] | > | Oct 26 07:07 |
| schestowitz[TR2] | > Published on Oct 21, 2026 | Oct 26 07:07 |
| schestowitz[TR2] | > The PHP Foundation | Oct 26 07:07 |
| schestowitz[TR2] | > News Security | Oct 26 07:07 |
| schestowitz[TR2] | > | Oct 26 07:07 |
| schestowitz[TR2] | > Earlier today, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, | Oct 26 07:07 |
| schestowitz[TR2] | > and 8.2.35. These releases fix two critical vulnerabilities that, | Oct 26 07:07 |
| schestowitz[TR2] | > under the right conditions, allow an unauthenticated attacker to | Oct 26 07:07 |
| schestowitz[TR2] | > execute code on servers running PHP. ... | Oct 26 07:07 |
| schestowitz[TR2] | > | Oct 26 07:07 |
| schestowitz[TR2] | > This post isn't about how to update. It's about how these | Oct 26 07:07 |
| schestowitz[TR2] | > vulnerabilities were found and fixed, what has changed in how PHP | Oct 26 07:07 |
| schestowitz[TR2] | > security is handled over the past two years, and what we need from | Oct 26 07:07 |
| schestowitz[TR2] | > the organizations that depend on PHP to keep PHP's security work | Oct 26 07:07 |
| schestowitz[TR2] | > going. | Oct 26 07:07 |
| schestowitz[TR2] | > | Oct 26 07:07 |
| schestowitz[TR2] | > ... | Oct 26 07:07 |
| schestowitz[TR2] | > | Oct 26 07:07 |
| schestowitz[TR2] | > In 2024, PHP underwent its first external security audit in | Oct 26 07:07 |
| schestowitz[TR2] | > years. The PHP Foundation secured funding from the Sovereign Tech | Oct 26 07:07 |
| schestowitz[TR2] | > Agency to organize this audit through OSTIF, and it was carried out | Oct 26 07:07 |
| schestowitz[TR2] | > by Quarkslab. While fixing one of the issues Quarkslab reported, a | Oct 26 07:07 |
| schestowitz[TR2] | > PHP core developer contracted by the PHP Foundation found the first | Oct 26 07:07 |
| schestowitz[TR2] | > signs of the OOM problem behind CVE-2026-109618. In 2024, a potential | Oct 26 07:07 |
| schestowitz[TR2] | > exploit for the OOM problem was theorized, but no concrete vectors | Oct 26 07:07 |
| schestowitz[TR2] | > were found and other concrete issues with clear impact overshadowed | Oct 26 07:07 |
| schestowitz[TR2] | > these concerns. | Oct 26 07:07 |
| schestowitz[TR2] | > | Oct 26 07:07 |
| schestowitz[TR2] | > To fix the OOM problem, the PHP security team developed several | Oct 26 07:07 |
| schestowitz[TR2] | > competing approaches, but each came with its own trade-offs: backward | Oct 26 07:07 |
| schestowitz[TR2] | > compatibility breaks, new denial-of-service potential, or requiring | Oct 26 07:07 |
| schestowitz[TR2] | > changes to many third-party extensions which seemed impossible to | Oct 26 07:07 |
| schestowitz[TR2] | > coordinate. The PHP security team, operating on consensus, struggled | Oct 26 07:07 |
| schestowitz[TR2] | > to choose between these and feared the repercussions of shipping the | Oct 26 07:07 |
| schestowitz[TR2] | > wrong choice. Combined with the lack of a known path to remote code | Oct 26 07:07 |
| schestowitz[TR2] | > execution and the small team of core developers with the necessary | Oct 26 07:07 |
| schestowitz[TR2] | > deep knowledge of the engine occupied with many responsibilities, | Oct 26 07:07 |
| schestowitz[TR2] | > this decision process caused work on a fix to stall and restart | Oct 26 07:07 |
| schestowitz[TR2] | > repeatedly over months. ... | Oct 26 07:07 |
| schestowitz[TR2] | Sounds like the findings had nothing to do with LLMs. | Oct 26 07:07 |
| *TechBN has quit (connection closed) | Oct 26 07:07 | |
| *TechBN (~b0t@iijacan2vrgta.irc) has joined #boycottnovell | Oct 26 07:07 | |
| -TechBN/#boycottnovell-Failed to load module HelloWorld. Reason: Not found! | Oct 26 07:07 | |
| -TechBN/#boycottnovell-Module HelloWorld has been removed until restarted! | Oct 26 07:07 | |
| *acer-box__ has quit (Ping timeout: 120 seconds) | Oct 26 11:03 | |
| *acer-box__ (~acer-box@freenode-onc2ss.ldvb.0amm.hij1op.IP) has joined #boycottnovell | Oct 26 11:03 | |
| *x-amarsh04 has quit (Quit: Konversation terminated!) | Oct 26 14:18 | |
| *amarsh04 has quit (Quit: Konversation terminated!) | Oct 26 14:18 | |
| *amcclure (~amcclure@b4pj5q5zrxahu.irc) has joined #boycottnovell | Oct 26 14:22 | |
| *amarsh04 (~amarsh04@freenode-ui3f8c.u06p.1s3m.moll9o.IP) has joined #boycottnovell | Oct 26 14:24 | |
| *x-amarsh04 (~amarsh04@6mnab3uw5dgtk.irc) has joined #boycottnovell | Oct 26 14:24 | |
| *amcclure has quit (Quit: WeeChat 4.10.1) | Oct 26 16:01 | |
| *psydruid (~psydruid@jevhxkzmtrbww.irc) has left #boycottnovell (Error from remote client) | Oct 26 16:15 | |
| *psydruid (~psydruid@jevhxkzmtrbww.irc) has joined #boycottnovell | Oct 26 16:43 | |
| *FANTOM has quit (Ping timeout: 120 seconds) | Oct 26 20:18 | |
| *FANTOM (~fantom@freenode-0m9.8g1.bp0598.IP) has joined #boycottnovell | Oct 26 20:24 | |
| *FANTOM has quit (Ping timeout: 120 seconds) | Oct 26 21:28 | |
| *FANTOM (~fantom@freenode-0m9.8g1.bp0598.IP) has joined #boycottnovell | Oct 26 21:46 | |
| *x-amarsh04 has quit (Quit: Konversation terminated!) | Oct 26 23:38 | |
| *amarsh04 has quit (Quit: Konversation terminated!) | Oct 26 23:38 | |
| *amarsh04 (~amarsh04@freenode-ui3f8c.u06p.1s3m.moll9o.IP) has joined #boycottnovell | Oct 26 23:43 | |
| *x-amarsh04 (~amarsh04@6mnab3uw5dgtk.irc) has joined #boycottnovell | Oct 26 23:43 | |
Generated by irclog2html.py 2.6 | ䷉ find the plain text version at this address (HTTP) or in Gemini (how to use Gemini) with a full GemText version.