●● IRC: #boycottnovell @ Techrights IRC Network: Monday, October 26, 2026 ●● ● Oct 26 [06:20] *psydruid (~psydruid@jevhxkzmtrbww.irc) has left #boycottnovell [06:24] *psydruid (~psydruid@jevhxkzmtrbww.irc) has joined #boycottnovell ● Oct 26 [07:07] schestowitz[TR2] Re: Official announcement from PHP foundation [07:07] schestowitz[TR2] > Today's PHP Security Release, and How We're Strengthening PHP Security [07:07] schestowitz[TR2] > https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ [07:07] schestowitz[TR2] > [07:07] schestowitz[TR2] > Published on Oct 21, 2026 [07:07] schestowitz[TR2] > The PHP Foundation [07:07] schestowitz[TR2] > News Security [07:07] schestowitz[TR2] > [07:07] schestowitz[TR2] > Earlier today, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, [07:07] schestowitz[TR2] > and 8.2.35. These releases fix two critical vulnerabilities that, [07:07] schestowitz[TR2] > under the right conditions, allow an unauthenticated attacker to [07:07] schestowitz[TR2] > execute code on servers running PHP. ... [07:07] schestowitz[TR2] > [07:07] schestowitz[TR2] > This post isn't about how to update. It's about how these [07:07] schestowitz[TR2] > vulnerabilities were found and fixed, what has changed in how PHP [07:07] schestowitz[TR2] > security is handled over the past two years, and what we need from [07:07] schestowitz[TR2] > the organizations that depend on PHP to keep PHP's security work [07:07] schestowitz[TR2] > going. [07:07] schestowitz[TR2] > [07:07] schestowitz[TR2] > ... [07:07] schestowitz[TR2] > [07:07] schestowitz[TR2] > In 2024, PHP underwent its first external security audit in [07:07] schestowitz[TR2] > years. The PHP Foundation secured funding from the Sovereign Tech [07:07] schestowitz[TR2] > Agency to organize this audit through OSTIF, and it was carried out [07:07] schestowitz[TR2] > by Quarkslab. While fixing one of the issues Quarkslab reported, a [07:07] schestowitz[TR2] > PHP core developer contracted by the PHP Foundation found the first [07:07] schestowitz[TR2] > signs of the OOM problem behind CVE-2026-109618. In 2024, a potential [07:07] schestowitz[TR2] > exploit for the OOM problem was theorized, but no concrete vectors [07:07] schestowitz[TR2] > were found and other concrete issues with clear impact overshadowed [07:07] schestowitz[TR2] > these concerns. [07:07] schestowitz[TR2] > [07:07] schestowitz[TR2] > To fix the OOM problem, the PHP security team developed several [07:07] schestowitz[TR2] > competing approaches, but each came with its own trade-offs: backward [07:07] schestowitz[TR2] > compatibility breaks, new denial-of-service potential, or requiring [07:07] schestowitz[TR2] > changes to many third-party extensions which seemed impossible to [07:07] schestowitz[TR2] > coordinate. The PHP security team, operating on consensus, struggled [07:07] schestowitz[TR2] > to choose between these and feared the repercussions of shipping the [07:07] schestowitz[TR2] > wrong choice. Combined with the lack of a known path to remote code [07:07] schestowitz[TR2] > execution and the small team of core developers with the necessary [07:07] schestowitz[TR2] > deep knowledge of the engine occupied with many responsibilities, [07:07] schestowitz[TR2] > this decision process caused work on a fix to stall and restart [07:07] schestowitz[TR2] > repeatedly over months. ... [07:07] schestowitz[TR2] Sounds like the findings had nothing to do with LLMs. [07:07] *TechBN has quit (connection closed) [07:07] *TechBN (~b0t@iijacan2vrgta.irc) has joined #boycottnovell [07:07] -TechBN/#boycottnovell-Failed to load module HelloWorld. Reason: Not found! [07:07] -TechBN/#boycottnovell-Module HelloWorld has been removed until restarted! ● Oct 26 [11:03] *acer-box__ has quit (Ping timeout: 120 seconds) [11:03] *acer-box__ (~acer-box@freenode-onc2ss.ldvb.0amm.hij1op.IP) has joined #boycottnovell ● Oct 26 [14:18] *x-amarsh04 has quit (Quit: Konversation terminated!) [14:18] *amarsh04 has quit (Quit: Konversation terminated!) [14:22] *amcclure (~amcclure@b4pj5q5zrxahu.irc) has joined #boycottnovell [14:24] *amarsh04 (~amarsh04@freenode-ui3f8c.u06p.1s3m.moll9o.IP) has joined #boycottnovell [14:24] *x-amarsh04 (~amarsh04@6mnab3uw5dgtk.irc) has joined #boycottnovell ● Oct 26 [16:01] *amcclure has quit (Quit: WeeChat 4.10.1) [16:15] *psydruid (~psydruid@jevhxkzmtrbww.irc) has left #boycottnovell (Error from remote client) [16:43] *psydruid (~psydruid@jevhxkzmtrbww.irc) has joined #boycottnovell ● Oct 26 [20:18] *FANTOM has quit (Ping timeout: 120 seconds) [20:24] *FANTOM (~fantom@freenode-0m9.8g1.bp0598.IP) has joined #boycottnovell ● Oct 26 [21:28] *FANTOM has quit (Ping timeout: 120 seconds) [21:46] *FANTOM (~fantom@freenode-0m9.8g1.bp0598.IP) has joined #boycottnovell ● Oct 26 [23:38] *x-amarsh04 has quit (Quit: Konversation terminated!) [23:38] *amarsh04 has quit (Quit: Konversation terminated!) [23:43] *amarsh04 (~amarsh04@freenode-ui3f8c.u06p.1s3m.moll9o.IP) has joined #boycottnovell [23:43] *x-amarsh04 (~amarsh04@6mnab3uw5dgtk.irc) has joined #boycottnovell