Di

I love PHP. Did someone say coffee?

Fullstack Witch @beyondcode, working on Laravel Herd, Polyscope and more magic • she/her

@dianawebdev.bsky.social

[Josh Hanley 🇦🇺 @_joshhanley]

PHP CVE patch tip:
Forge's Ubuntu PPAs don't have the fix yet. My newest Forge server (26.04) uses https://t.co/tx4GBIiGbM and patched with a plain apt upgrade.

I pointed my 22.04 and 24.04 servers at https://t.co/tx4GBIiGbM too and they're now on 8.2.35 and 8.4.27 🎉

[Brent @brendt_gd]

PHP isn’t the most sexy language, I give you that. Where I live in Belgium, government, school, hospital, help line, media, news, and what not websites are down.

It’s not because we don’t often hear about it that it isn’t big. Usually, PHP simply does the job. Nothing sexy, nothing worth shouting about. Only on these rare occasions do you get a feeling of the true impact of the language.

[Di @DianaWebdev]

@oluwalosheyii

[Di @DianaWebdev]

Now we wait... 🍵

(Or point our servers temporary to sury packages.)

[Di @DianaWebdev]

@ejntaylor It's out for 26, and the PPA from there is compatible with 22/24 afaik:
https://t.co/88yelWiS6Y

[Josh Hanley 🇦🇺 @_joshhanley]

PHP CVE patch tip:
Forge's Ubuntu PPAs don't have the fix yet. My newest Forge server (26.04) uses https://t.co/tx4GBIiGbM and patched with a plain apt upgrade.

I pointed my 22.04 and 24.04 servers at https://t.co/tx4GBIiGbM too and they're now on 8.2.35 and 8.4.27 🎉

[Di @DianaWebdev]

In case you cannot access the Forge UI right now:

[Laravel @laravel]

We have published a guide on updating your Forge provisioned servers directly via SSH, allowing you to by-pass the Forge dashboard.

https://t.co/MTDo5BeING

[Pauline Vos @vanamerongen]

HUUUUUUUUGE kudos to the PHP core team and @ThePHPF! Let's get to patching!

and RIP to anyone not paying attention to day i guess

[php-net @php_net]

PHP 8.4.27 released - 89 fixes in 30 components, including security fixes (CVE-2026-109618, CVE-2026-109619).

Changelog + downloads: https://t.co/i0VF5tjG0x

[Di @DianaWebdev]

@ethereaglehq @marcelpociot You can decide that per app in Herd Studio. 😊

[Di @DianaWebdev]

@cagatay_dev @marcelpociot Yes. You can decide that per app in Herd Studio. 😊

[Di @DianaWebdev]

@devdawe Yes. So no extra disk usage until files change. 😊

[Di @DianaWebdev]

@ZStalevski We fixed a few cases where the hosts file wasn't updated; could you update to the latest version (2.0.2) and try again? If it still doesn't work, feel free to open an issue with more info here: https://t.co/xrGj5NKTIv

[Di @DianaWebdev]

@_eramitgupta @marcelpociot That message means Herd found the folder but no entry file. What kind of site is that?

[Di @DianaWebdev]

@ziyadpgv @marcelpociot @laravel We lost that, thanks for the note 🫡 Will take care of it. `herd db` in the CLI is still there.

[Di @DianaWebdev]

@hanspagel But still a terminal.

I was worried for a second

[Dane Knecht 🦭 @dok2001]

PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free.

We are seeing early attacks emerging and are updating mitigations as new vectors show up.

This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.

[Di @DianaWebdev]

@christophrumpel Great day to be back. 😬😂

[Di @DianaWebdev]

Ok /dev/null is "down" because of patching and I already feel like something is missing

TAKE THAT, STUPID X

[Di @DianaWebdev]

@vanamerongen Are you planning on something like a lists feature like BlueSky had at the beginning? We had a Larabelles list there, I think. But I'm still not sure if I am a fan of that feature in general. 😅

[Di @DianaWebdev]

Currently doing some maintenance work on https://t.co/752N99b1Uy, we'll be back soon. ❤️