Smart Data

Data platforms, production software, and AI that holds up. Notes and experiments from the Smart Data team. Dayton, Ohio, since 2006

[Smart Data @getsmartdata]

Hey PHP friends. Make sure to check if your system is impacted here and has the non-default setup described.

[The PHP Foundation @ThePHPF]

Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 Wed, keep disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected. #php #phpc

[Smart Data @getsmartdata]

We tend to agree. Weeks like this one will become all the more common. Things like formal verification loops, such as what Anthropic wrote about today, will be extremely important going forward.

[Jason D. Clinton 🔸 @JasonDClinton]

as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)

[Smart Data @getsmartdata]

If you use Bun, please update ASAP

[Bun @bunjavascript]

Bun v1.4.4 will be released this evening with a fix for this and for the Brotli issue.

Both fetch() and Bun.serve() did not and continue to not enable HTTP/3 by default.

[Smart Data @getsmartdata]

Strong summary of the week so far

[⁵⁄₉ @fiveoutofnine]

So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and https://t.co/QlOXb3COq3 went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.

[Smart Data @getsmartdata]

If any of our current or former clients self host a GitLab instance, please upgrade & patch immediately. If you’re on @gitlab.com you’re fine.

[Aikido @AikidoSecurity]

Another one 🚨 Gitlab is vulnerable to remote code execution.

1. Firewall your Gitlab server
2. Patch.

CVE-2026-110264 is a CVSS 10.0 unauthenticated RCE in GitLab’s regex compiler. It reaches self-managed CE/EE instances back to version 7.0, while @gitlab.com is already patched.

If you self-host GitLab, upgrade ASAP.

[Smart Data @getsmartdata]

Because these seem never ending recently… new zero day found in certain http3 libraries. This particular issue lets attackers take your server offline remotely.

https://t.co/bCMqlrLCgk

[Smart Data @getsmartdata]

Railway has been compromised. Per the team: “we strongly recommend that you immediately roll all environment variables, including any API keys, stored in Railway, as well as any private registry credentials, and review logs for those services for unusual activity. All deployments are paused while we investigate. Until builds are restored, you will not be able to roll out new versions”

[Railway @Railway]

An urgent notice from the Railway team

https://t.co/niUAhTAQJM

[Smart Data @getsmartdata]

PHP version 8.5.12, the latest patch, may be itself compromised according to a number of early reports we’re seeing. We once again suggest taking any public facing PHP applications you run offline for the time being.

[Nicolas Krassas @Dinosn]

Leaving this here, PHP 8.5.12 security patch is incomplete. ( needs further validation )

[Smart Data @getsmartdata]

Be prepared for more security updates soon as OpenAI continues to release new vulnerabilities and fixes

[OpenAI @OpenAI]

OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.

Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.

Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.

This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
https://t.co/TW3jrSbB3f

[Smart Data @getsmartdata]

We recently switched one of our internal projects to @useblacksmith instead of GH Actions and have seen very positive early results.

[Smart Data @getsmartdata]

How we’re feeling with all the cybersecurity news

[Smart Data @getsmartdata]

If you use LiteLLM, important update below

[JFrog Security @JFrogSecurity]

🚨 JFrog Security Research has identified a supply-chain attack involving malicious code in the LiteLLM 1.107.0 PyPI release. Avoid this version and investigate environments where it was installed or executed. More details will be shared soon in our blog post.

[Smart Data @getsmartdata]

Upgrade immediately. Previously reported mitigations do not work. If you cannot upgrade, take your application offline.

https://t.co/8c2pYzMhOF

[Smart Data @getsmartdata]

Node security releases here for versions 22.x, 24.x, and 26.x

Please update your systems ASAP

https://t.co/MNe4yATfpg

[Smart Data @getsmartdata]

Update from Laravel

[Laravel @laravel]

At 14:00 UTC two critical security vulnerabilities will be patched in PHP.

These are extremely serious vulnerabilities affecting every PHP application on the web.

Laravel Cloud customers: we will begin automatically patching your applications as soon as the patch is released. No manual action is required.

Laravel Forge customers: you will need to manually update your server’s PHP version via the server’s Forge dashboard. If you are unable to update your server, it should be powered down.

Laravel Vapor customers: we will begin automatically re-deploying applications running on PHP 8 as soon as the patch is released. No patch is being released for PHP 7 -- immediately update all applications to PHP 8.

[Smart Data @getsmartdata]

Another major security incident. This time TiDB and PingCAP. Please check if you are impacted.

[Sam Lambert @samlambert]

The TiDB leaks

https://t.co/qhY3dV1RT0

[Smart Data @getsmartdata]

Updated list for the certificate compromise.

[Smart Data @getsmartdata]

In more security news, a variety of CA certs have now been compromised. Please update all impacted packages to the versions listed below.

[AJ Stuyvenberg @astuyve]

private keys from 8 intermediate CA certs have been compromised (eMudhra)

Happy "Update everything" day to all my pager-carrying friends

https://t.co/7ASSy72Rxg

[Smart Data @getsmartdata]

Further information on the PHP vulnerabilities. If you think this doesn’t impact your version, it does

[Andrew Case @attrc]

Full details of a remotely exploitable vulnerability in the core engine of *all* PHP versions will be released tomorrow, October 21st. If your organization has internet facing PHP applications then you need to be ready to patch the minute the update is released or *strongly* consider taking the application offline until you can:

https://t.co/hpdTOdvSsQ

[Smart Data @getsmartdata]

https://t.co/6Mw4WZ5oDc

To all our clients, present and former, please check all your current PHP applications. These are mission critical CVEs of 9.2 severity