doing an all-niter emergency patching thousands of php instances in the so-called age of AI?
priceless.
🙏
The Cloudflare's writeup on our php2shell response is up.
Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared.
New rules keep landing in the WAF changelog.
Expect updates through out the day. We will have a more thorough post of what we had to build to better protect people coming shortly.
PHP runs almost 70% of websites. The flaw is in the runtime, so updating plugins won't fix it. Patch PHP.
blog.cloudflare.com/php-vuln…
Cloudflare has already deployed WAF protections for php vulnerabilities
time is of the essence 😂
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers. cfl.re/488w8dc
node.js exposed
Not just PHP. Node.js has also announced security releases for October 21, with HIGH-severity vulnerabilities affecting its 26.x, 24.x and 22.x release lines.
If you run either stack in production, keep an eye on official advisories and apply patches promptly.
Security maintenance doesn't stop at your application code. Your runtime matters too.
Node.js advisory: nodejs.org/en/blog/vulnerabi…
php instances in peril 🤣😂
‼️BREAKING: PHP has released its fix for the two leaked flaws, which can let attackers run code on servers without logging in.
"There are no complete mitigations, updating is the only safe choice," PHP says.
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now.
PHP says Apache with mod_php is most at risk, with a demonstrated exploit that fires before any application code runs.
PHP 8.1 and older get no official update, though PHP has published source backports for 7.4, 8.0 and 8.1.
japan nearing the point of no return 🤡
今年度上半期の貿易統計 2兆8000億円の赤字 昨年比98.8%拡大
news.web.nhk/newsweb/na/nd-2… #nhk_news
right on, bro
In 1994, software was dead. People told me programming was for nerds and that I should become a doctor or a lawyer instead.
In 2004, software was dead. People told me that someone from India would take my job for $5/hour.
In 2014, software was dead. People told me that no-code was going to kill every job and doom my career.
In 2024, software was dead with Devin, Windsurf, Copilot, and OpenAI o1.
We kill software every 10 years, and yet the demand for good Software Engineers has never been higher.
🔥💴💴💴🔥
ありゃりゃ…
これ、賠償額がとんでもないことになるかもしれない。
実はモンゴルの森林法第43条では、草原火災による損害は、単に焼けた草木の価値だけじゃなく、生態系への損害や消火活動にかかった直接・間接費用まで算定対象になる。
今回の火災で自然保護区の約8割が焼失したという報道もあるし、希少な動植物の生息環境まで被害を受けている可能性がある。
火災で消失した面積は、東京都の2倍ちょっと。
ちなみにモンゴルでは、法律上9月20日から11月10日までが秋の森林・草原火災の危険期とされているらしい。
地元の人がむっちゃ用心してる時期に、よそ者が不用心に火災を引き起こしたとなれば心象も良くないだろうし、モンゴル政府はすでに損害賠償を求める方針を表明している。
いったいどれだけの金額を請求されることになるのやら…。





























