pixelmagic

Sustainable Web Design + Front End Development + #WordPress + Bitcoin + priv/acc

[pixelmagic @pixelmagic_cc]

the most secure web browsers in 2026 : https://t.co/OiQI5JnfVc

[FOSS Force @FOSSForce]

In an announcement on their website the CEO of Legacy Games mentioned you will be able to download games until February 28, 2027, after that - they're gone: Legacy Games store is closing down https://t.co/WVWLILVBp5

[BlackRoomSec @blackroomsec]

Let's speak on this so we can get back to the important task of making sure the clankers don't give away the trade secrets to our competitors. I will make this non-technical.

Just because something is vulnerable does not mean it can be exploited or leveraged into an actual attack.

A vulnerability scanner is an application which compares software versions present on a system with an internal database of known vulnerable versions for those pieces of software.

The vulnerability scanner gets those vulnerable software versions in its database from larger globally maintained database of what is known as CVEs.

Common Vulnerabilities and Exposures.

So when you see something like this in relation to a potential exploit

CVE-2026-1234

That is the identifier in the global database for a specific vulnerability attached to specific software or hardware but let's just stick to software right now.

So let's take this PHP thing.

All versions of PHP up to 8.5.11 are vulnerable to the PHP2Shell remote code execution because they lack specific changes to that code which will make it nonvulnerable.

So think of like the text file and it has words in it. Software has source code. I talked about this couple of weeks ago explaining the difference between source code and machine code and how it's a bridge between what the user sees and what the machine can understand and how that is translated into instructions it can then execute.

Let's say in that text file if there is the word false as an example in order for it not to be vulnerable the word needs to be changed to true.

Now I am simplifying but the source code has to be changed in various ways, usually a function or variable as they are called, need to be edited so that they no longer do the thing that they do which makes them susceptible to attack.

A software update or patch edit the source code for you.

Because you don't know how to edit source code.

So when we say that you need to patch or update your systems we simply mean we need you to download the latest update so that it will apply those edits to the source code text.

Now sometimes you can't do that for whatever reason. Sometimes we are able to manually edit the source code in an alternative way which stops it from being susceptible to attack but doesn't outright upgrade the entire piece of software to its most recent version which will likely break something in your environment and why you are reticent to update it at all.

The vulnerability scanner has in its database that PHP version 8.5.11 and below are vulnerable so it scans your system and does a procedure known as a banner grab to determine the likely version of all your software and if it finds a number that matches a number in its database that is vulnerable it reports that to you.

So how do you know if you're actually vulnerable to attack?

Well that's where a proof of concept comes in or a POC and what is known as an exploit.

An exploit is a secondary piece of code which has specific instructions in it that can programmatically attack the vulnerable piece of software provided that you point the exploit towards that software.

The two pieces of software, both the exploit and your software version have to see each other and be accessible to each other in order for the exploit to try to edit the software's code.

Think of this like a recipe on how to specifically attack that particular software with that particular version.

If the exploit cannot reach that software for whatever reason, it cannot be exploited.

And there are a lot of reasons why that might be depending on your particular environment.

More in the comments.

[Glenn Gabe @glenngabe]

The war on AI slops continues. This time it's Etsy -> Etsy is cracking down on AI slop listings, updates its policies, provides recommendations, and FAQs

"Etsy is announcing stricter rules about how AI can be used in listings to reduce the volume of AI slop on the platform. In a post, the company says that "many active buyers say they can't tell which items involve AI-generated content" and that sellers are "concerned about your work appearing alongside items that use AI in misleading ways," spurring the new policies and restrictions."

"Bot-generated listings without any human involvement aren’t allowed. These listings will be removed and may also result in your shop being removed from Etsy."
https://t.co/FDe1RlUkWH

[pixelmagic @pixelmagic_cc]

Is the Internet Safe Again After the PHP Nightmare? What You Need to Know (via @decryptmedia) https://t.co/WQaqbUYdkl

[Bitchat Community @BitchatMe_]

Bitchat is now #1 on the French App Store.

[Julia Black @mjnblack]

Things are moving so fast that everyone seems to have completely missed how insane it is that AI companies have been allowed to unleash agentic AI products with no regulatory guidelines.

[pixelmagic @pixelmagic_cc]

US banks detect unauthorized AI agents in customer accounts, Axios reports https://t.co/70yFcYhxBh

[Cloudflare Changelog @CFchangelog]

Emergency WAF release adds two new rules to the Cloudflare Free Ruleset to block anomalous execution patterns. Your free tier sites get an instant security patch.

https://t.co/jqxQVbF2Z2

[pixelmagic @pixelmagic_cc]

that about sums it up

[⁵⁄₉ @fiveoutofnine]

So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and https://t.co/QlOXb3COq3 went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.

[The PHP Foundation @ThePHPF]

We have posted more information about today's security releases, including the sequence of events that led to the discovery, how the PHP security team is improving their processes, and what we need from you to continue this critical work. #php #security https://t.co/gbGTmk7yh1

[Madeline Lawrence @madelinelawren]

Is your website vulnerable to php2shell? Here's a site to check it: https://t.co/9WobMmxJBC

Made by my colleague @horia_nita

We've also released PHP images w/ backported patches for free, more versions coming: https://t.co/Az60yxk3N6

[melody☆ in 🇺🇸LA (🇯🇵10.26→11.14) @stargazermellu]

after spending a hour taking my PHP apps offline, I went to the grocery store only to discover they too did the same thing! there are no functioning price tags here…

[Lee Hepner @LeeHepner]

A jury found Meta liable for over 43 million violations. The judge reduced the statutory civil penalty from $219.5 billion.

[pixelmagic @pixelmagic_cc]

The internet is having a very bad cybersecurity day https://t.co/PG0sBB7slW

[pixelmagic @pixelmagic_cc]

Who Found the PHP Bug That Made Governments Unplug Their Websites? ChatGPT, Of Course (via @decryptmedia) https://t.co/NEAJZODZ7y

[WordPress @WordPress]

The PHP project has released fixes for 2 critical vulnerabilities affecting servers that host PHP applications. Site owners and technical teams should confirm their hosting provider’s update plan and update PHP immediately. Versions before PHP 8.2 no longer receive security updates. These issues are not specific to WordPress, and no WordPress update is required. https://t.co/2Bgok9Vdcq