nitriques

CTO @DeuxHuitHuit . Options Trader. Investor. Degen. Anarchist.

[nitriques @nitriques]

@KevinFiorilli

[Bigdaddyleo1037 @bigdaddyleo1037]

Omg🤦🏽‍♂️🤣

[Mr_Fireside 🔥 @Mr_Fireside]

This is the exact moment Woodstock 99 lost control of the event...and for some reason as a 41 year old man sitting in my home office I now feel like breaking stuff.

[PHP CEO @PHP_CEO]

IS THE WEBSITE DOWN FOR ANYONE ELSE?

[daksh @daksh0x]

banger tshirt idea

[Ondřej Mirtes @OndrejMirtes]

Of course it'd be better to have vulnerability in PHP at all, but I'm deeply moved by today's events:

1) The absolute profesionalism of everyone involved from @ThePHPF. Thank you!
2) The number & size of sites went off-line at 2PM UTC to patch their servers. PHP totally runs the world!
3) PHP in news reports in press and TV across the world.

[nitriques @nitriques]

This guy’s been an hero for a long time now

[skeptic 🖖 @3kept1c]

Contra todo pronóstico y sin aviso previo, Ondřej Surý ha aplicado los parches CVE-2026-109618 y CVE-2026-109619 tanto para PHP 5.6 como para PHP 7.4. En el log aparece: "Backported from 8.2.35". Nos ha salvado el culo a los que tenemos servidores Debian/Ubuntu.

[Andrew Dorman @acd421]

Teamwork makes the dream work.

The team and I
@J4ck3LSyN @Archknight23

🚨 Heads-up for anyone running PHP: two critical RCE bugs, patch drops tomorrow.

The PHP project has confirmed an emergency security release for two critical remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2.

📅 Patch lands Wednesday, Oct 21 at 14:00 UTC (9:00 AM Central). PHP has reserved the right to ship it earlier if details leak or exploitation shows up.

PHP runs about 75% of the web, including WordPress, Drupal, Joomla, Laravel, Magento, and countless custom apps. If you operate a PHP server, this is your weekend-ruiner unless you act.

Here's the part the big threat-intel shops aren't shouting about:

No official technical details are public yet. But based on my own source-code analysis of php-src, my best assessment (moderate confidence, NOT officially confirmed) is that the vulnerable path is PHP's session.upload_progress / multipart form-data (rfc1867) handling:

🔹 Present since PHP 5.4
🔹 Enabled by default (the compiled-in default is On; the sample php.ini ships it commented out, so stock installs have it live)
🔹 Processes uploaded request data before any of your application code runs, so it's reachable pre-authentication on a default config

That lines up exactly with the public breadcrumbs: "affects default installs," "every version since 5.x," "fires before user code." Treat it as a working hypothesis, not gospel. The official advisory supersedes all of this when it lands.

✅ What to do right now:

1. Inventory your PHP. Know every host and version (php -v). Anything on PHP 7.x or older won't get a fix, so plan to upgrade.

2. Apply the stopgap (best-intel, low-risk, reversible). In php.ini / .user.ini / .htaccess:

session.upload_progress.enabled = Off

Reload PHP-FPM or your web server. My analysis says this closes one of the two likely paths.

3. Clamp multipart uploads at the edge. The second likely path lives in the multipart parser itself, which runs for any multipart/form-data POST regardless of the setting above. If you've got a WAF or reverse proxy, tighten inspection or rate-limit multipart POSTs to endpoints that don't need uploads. This is the same network-layer mitigation the enterprise vendors are quietly deploying for their paying customers.

4. Patch the second it drops. Current stable: 8.5.11 / 8.4.26 / 8.3.35 / 8.2.34. If your hosting is managed, confirm your provider's timeline today.

Why I'm posting this for free:

A pre-patch mitigation shouldn't be a subscription perk. I'm a one man shop, and the orgs most likely to get burned in the gap between leak and patch are the small teams without an enterprise threat intel contract. The steps above cost nothing. Spend tonight reducing risk, not tomorrow doing incident response.

I'll follow up once the official advisory publishes and confirm whether my root cause read was right.

Stay patched. 🔒

#PHP #CyberSecurity #InfoSec #RCE #CVE #WordPress #Laravel #ThreatIntel #VulnerabilityManagement #AppSec

[dpc @dpc_pw]

No way they did the meme.

https://t.co/wOikZe3fj6

[Pierre Couture @PierrePcouture]

Record du monde battu aux Éboulements dans Charlevoix. L'Espagnol Diego Poncelet, athlète Red Bull de 27 ans et deux fois champion du monde de descente en skateboard, a atteint la vitesse de 151,83 km/h sur la Route du Port de Les Éboulements, Charlevoix, Québec. Record Guinness World pour la vitesse la plus élevée jamais atteinte sur un skateboard en position debout.
#redbull #worldrecordguinness

[nitriques @nitriques]

Wtf !!! This is awesome

[Cheng Lou @_chenglou]

My dear friends, I’d like to show you my latest toy project

Introducing Handwired: turn your regular JavaScript code into a neural net!
- no training
- exact outputs vs the JS program
- fully differentiable

All runnable in a browser, without GPU

[Nic Barker @nicbarkeragain]

I hadn't seen this one before - someone on reddit posted this fantastic trick for creating shell "runnable" C files

[nitriques @nitriques]

@Profgampo « Super fast woman, super charged fast car » is delightful. *chef kiss*

[Amit @amitwt]

Craziest portfolio i have seen in a while

https://t.co/ahdEJVN5OB

[Deno @deno_land]

We are excited to announce that Deno is joining Cloudflare!

https://t.co/hC5HOUb8t4

[Ulmo 2112 ⚜️ @fred_jeanbart]

I would like to request the addition of a Québec subdivision flag emoji to X, using the existing Unicode emoji subdivision-flag mechanism, just as the Scottish flag 🏴󠁧󠁢󠁳󠁣󠁴󠁿 is currently supported.

Québec has the ISO 3166-2 subdivision code CA-QC and the corresponding Unicode subdivision identifier “caqc”, but it is not currently an RGI subdivision flag emoji.

The Québec flag (Fleurdelisé) is an important and widely recognized national symbol of Québec and is widely used by Québec residents and Québec communities around the world.

I have attached a high-resolution 1920×1280 PNG of the Québec flag as a reference asset (RGB, 8-bit; sRGB IEC61966-2.1). The original vector SVG is also available on Wikimedia Commons: https://t.co/obIntVMJLh

Given the recent discussion about Québec's status, it would be particularly fitting to have its flag represented natively on X. 😉

Thank you for considering this request.

@elonmusk @Support @X

[nitriques @nitriques]

@irvinebroque maybe ??? I understand the spam and all but 1000 per day is a blocker...

[nitriques @nitriques]

Who must I ask to a email send quota inscrease @eastdakota @dok2001 ? The docs says to go on discord, yet the room's empty... https://t.co/JrswJGbFq8

I went live with hosting my business emails on the platform, got bitten in 24 hours....

[nitriques @nitriques]

@JackEllis Wow you got me ;)

[Maire de Laval @chiefmounir]

Olivier Primeau a vraiment réussi a nous libérer de la CAQ, merci bro 🩵