14

pff

[Derek Devicemanager @IT_unhinged]

Security called me at 6:12 AM today.

"Patch every PHP server immediately."

I asked what happened.

"Two critical vulnerabilities. Remote code execution. No authentication required."

Cool.

How many PHP servers do we have?

According to inventory: 12

According to reality:

Nobody knows.

We found one running WordPress.

Three running old internal tools.

One under someone's desk.

Two inside vendor appliances.

A forgotten employee directory from 2016.

And a server named:

PHP-OLD-DO-NOT-TOUCH

Naturally, that one runs payroll exports.

Then we found a PHP 5.6 box.

I asked who owned it.

The documentation said:

BRIAN.

Brian left in 2019.

We called Brian.

He said:

"Oh wow, that's still running?"

Excellent.

By 8 AM, leadership joined the incident call.

CEO:

"Can hackers actually get in?"

Security:

"Potentially yes."

CEO:

"Without a password?"

Security:

"Yes."

CEO:

"Then why do WE need passwords?"

Not the lesson.

Finance asked if we could wait until the weekend to patch because downtime affects revenue.

Security explained that the alternative was letting strangers execute code on our servers.

Finance asked for a cost comparison.

At 9:17, someone suggested temporarily taking the vulnerable websites offline.

Marketing refused.

"Our campaign is live."

So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.

We finally patched everything we could find.

Then our scanner discovered another PHP server.

Hostname:

TEMP-PHP-2014

Uptime:

4,512 days.

Nobody knows what it does.

Nobody owns it.

Nobody can shut it down.

But every time we block network access, the warehouse stops printing shipping labels.

Security has classified it as critical infrastructure.

It is running PHP 5.4.

The vulnerability has existed longer than half our employees.

The emergency patch took four hours.

Finding out what PHP actually runs took eleven.

The internet isn't held together with code.

It's held together with servers everyone is afraid to turn off.

[Future Adam Curtis B-Roll @adamcurtisbroll]

F-35 Lightning II jets approach Nellis Air Force Base during Red Flag 25-1 exercises as the Las Vegas Sphere displays a smiling emoji face, January 2025.

[Defend Our Juries @DefendOurJuries]

YOU HAVE THE RIGHT TO REMAIN SILENT

A mannequin was arrested at yesterday’s Lift The Ban action for silently holding a placard with the words “I oppose genocide - I support Palestine Action” written on it.

If you don’t laugh at the absurdity, you’ll cry

https://t.co/xHyNnPtPT9

[El Club del Arte 🎨📷📚🖼🕍🎼 @Arteymas_]

Un perro se hace amigo de una nutria y se ven todos los días para nadar juntos…

https://t.co/2YdwzClygA

[Snoopy @SnoopyFansUS]

Snoopy 👀

[Neil Renic @NC_Renic]

If everyone used footnotes instead of endnotes

[Gilles Deleuze For You @DeleuzeForYou]

Spinoza didn’t title his book ‘Ontology’, he’s too shrewd for that; he titles it ‘Ethics’ which is a way of saying that, whatever the importance of my speculative propositions may be, you can only judge them at the level of the ethics that they envelope or implicate.

[14 @dCamachoUPDATE]

@sindiamantes Felicidades Cheryl, saludos

[Nina Antonia @NinaAntonia13]

Agave plant goes 'Lovecraft' in an abandoned greenhouse.

[isabel beatty @isabeatty]

i love when homer simpson puts on his little reading glasses. also when he wears his green “going out” jacket

[Dogs doing things @dogsdoingthings]

Dogs booming, "It's 2028. Only AI is guaranteed free speech. The only news is rightwing propaganda. Wealth has won its war on taste. You wake up screaming every day. Hang on, it's 2024."

[Bernat Castany Prado @dinolanti]

Pequeños hallazgos filológicos (3): La palabra “Odiseo” es el reflejo en el agua de la palabra “Poseidón”.

[Gavin Mueller @gavinmuellerphd]

Walter Benjamin VINDICATED

[The Fourth Way @The4thWayYT]

Inside you are 2 wolves

[wint @dril]

consider Nintendo's Mario