Software Engineer | 6+ years building scalable APIs & enterprise apps | JS/TS, PHP/Laravel, Cloud Platforms. Whatsapp: https://xitter.cf/t.co/kNB7k5gqRy
Lagos, Nigeria
Joined December 2022
- Tweets7.3K
- Following812
- Followers688
- Likes33.5K
People really see a PHP vulnerability and immediately say, “It’s time to rewrite every PHP system.” 😂
No programming language is immune to vulnerabilities.
The language isn’t automatically the problem. How the system is built, maintained, secured, and deployed matters.
PHP can be vulnerable. So can JavaScript, Python, Java, Go, C#, Rust… all of them.
A vulnerability should make us ask, “How do we fix and secure this?” not automatically, “Let’s rewrite the entire system.”
I talked about this in the video 👇
Pelumi Isola | Software Engineer retweeted
‼️ BREAKING: Oracle Issues Emergency Java Update for Critical 9.1 HTTPS Trust Vulnerability
Details: cybersecuritynews.com/emerge…
Oracle has released an emergency Java security update to address CVE-2026-91403, a critical vulnerability affecting how Java applications trust digital certificates. Published on October 21, 2026, the alert assigns the flaw a CVSS 3.1 score of 9.1 and covers Oracle Java SE and GraalVM.
The update blocks affected intermediate certificate authority certificates linked to eMudhra. According to Oracle’s security advisory, the issue affects the Java Secure Socket Extension, or JSSE, component.
Oracle rates exploitation as low complexity, with no authentication or user interaction required. Successful attacks can expose or change sensitive data, although the risk matrix lists no availability impact.
#cybersecuritynews #vulnerability
Pelumi Isola | Software Engineer retweeted
‼️ BREAKING ‼️ PHP warns of another UNPATCHED REC vulnerability just 2 days after releasing emergency patches for critical PHP2Shell flaws.
New "CVE-2026-115560" affects only unusual session configurations. PHP has issued urgent mitigation guidance.
Full details → thehackernews.com/2026/10/ur…
After so many red we got a green lol. I built an app to manage my own VPS no be everytime person go dey write cicd😃😃
This PHP vulnerability you have to pay attention yes there are auto fixes but depending on where you deployed your app you have to take action ‼️‼️
PHP is dead even govt organizations sef panic cus of vulnerability where as NODE JS have been having vuln since forever 😂😂😂
Pelumi Isola | Software Engineer retweeted
If your PHP app is running in Docker on a VPS, don’t just assume your hosting provider will update PHP for you o. They look after the server and you’re responsible for the PHP version inside your Docker image. Updating the server won’t update PHP inside your container, so you’ll need to rebuild and redeploy it, then check that the new version is running. E get why o.
Na me know wetin I see person do yesterday o.
And again shebi una dey always say PHP no get level abi, yet one small vulnerability, almost or websites all over the world shapely run update.... hehe..... sharpestresssst
Pelumi Isola | Software Engineer retweeted
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
Pelumi Isola | Software Engineer retweeted
🔐 Node.js security updates are now available!
New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues.
Review the details and update your systems to stay secure.
🔗 nodejs.org/en/blog/vulnerabi…
#NodeJS #Security
Pelumi Isola | Software Engineer retweeted
Prediction: Railway may have suffered a major security breach that exposed its customers API keys
Pelumi Isola | Software Engineer retweeted
🚨 UPDATE: PHP 8.5.12 may still be vulnerable to php2shell!
Researchers are reporting a successful double-free trigger on the newly patched release.
⚠️ The official fixes may be incomplete. A crash alone doesn't confirm RCE, but this deserves urgent investigation.
Don't assume you're safe just because you've patched.
#php4shell #php #cybersecurity
xitter.cf/_annieversary/status/2…
chat. chat... its not funny anymore
Readers added context they thought people might want to know
The original post has since been edited to specify that this was about an unrelated vulnerability that the user had discovered, not the recently patched vulnerability.
fedi.katze.sh/@elise/1174793…
No worry Start from HP that laptop rugged die or start from Dell if naah him your money reach build slowly until you can afford Mac buy am and your life will never remain the same
Pelumi Isola | Software Engineer retweeted
🚨 BREAKING: Node.js just dropped its OWN security bombshell.
4 HIGH-SEVERITY vulnerabilities patched TODAY, including one that could let hackers remotely execute malicious code on vulnerable servers.
→ 10 SECURITY FLAWS were addressed in today's Node.js release, FOUR rated HIGH severity.
→ REMOTE CODE EXECUTION: CVE-2026-111497 is a serious flaw in Node.js's Brotli decoder that could allow attackers to execute malicious code remotely.
→ TLS SECURITY BYPASS: Two separate vulnerabilities could trick affected applications into accepting certificates for the WRONG server under certain conditions.
→ Think about that. Your application could establish an encrypted connection while failing to properly verify WHO it's talking to.
→ THREE MAJOR NODE.JS VERSIONS AFFECTED: Node.js 22, 24 and 26 all required emergency security updates.
→ RUNNING NODE.JS 18 OR 20? Those versions are END-OF-LIFE and aren't receiving these official security patches.
→ PATCH IMMEDIATELY: Update to Node.js 22.23.4, 24.22.1 or 26.12.1, depending on your release line. If you're using Docker, rebuild and redeploy your containers.
PHP AND Node.js both facing major security disclosures on the SAME DAY.
If you run a website or application, TODAY is the day to check your servers.
And remember: the public release of security patches can give attackers a roadmap to systems that haven't updated.
Don't be the last one to patch.
🚨 A MASSIVE internet security emergency is unfolding right now. 🚨
Two CRITICAL vulnerabilities have been discovered in PHP, potentially putting millions of websites at risk.
→ NEARLY 70% of websites with a known server-side language run PHP. The potential scale is ENORMOUS.
→ TWO CRITICAL security flaws have been confirmed, each scoring 9.2/10 in severity.
→ Attackers could potentially take control of vulnerable servers remotely, without authentication.
→ Reports suggest PHP versions dating back to 2004 could be affected. The exact scope is still unconfirmed.
→ EMERGENCY PATCHES are scheduled for TOMORROW at 10 AM ET. Website owners are being urged to prepare immediately.
→ Europe's CERT-EU is warning organizations to patch ASAP or consider TAKING EXPOSED APPLICATIONS OFFLINE if they cannot be secured.
→ WordPress, Magento, Laravel and potentially millions of other PHP-powered websites could be at risk.
→ Once patches go public, hackers could reverse-engineer them and race to attack servers that haven't updated.
The vulnerabilities are CONFIRMED. The full technical details remain secret.
Tomorrow, the race between hackers and defenders begins.
This could get ugly. FAST.
Pelumi Isola | Software Engineer retweeted
Not just PHP. Node.js has also announced security releases for October 21, with HIGH-severity vulnerabilities affecting its 26.x, 24.x and 22.x release lines.
If you run either stack in production, keep an eye on official advisories and apply patches promptly.
Security maintenance doesn't stop at your application code. Your runtime matters too.
Node.js advisory: nodejs.org/en/blog/vulnerabi…