Discussion
here's some info about the giant php bug dropping tomorrow:
https://www.openwall.com/lists/oss-security/2026/10/20/34
hopefully mastodon doesnt absolutely destroy the video quality, but it appears to be unauth php rce.
which means every firewall on the planet thats not patched thats just php under the hood and has its management interfaces exposed is potentially a target
yeah this is like java rhino all over again, except in reverse. instead of:
- user goes to site
- java applet runs and executes arbitrary code
its
- malware hits site with unauth rce against php
- site runs command
if you have publicly exposed shit thats running php, maybe um.
take it offline for tomorrow.
if you have business people who say its fine to have management interfaces publicly exposed to the internet, where its some appliance that runs php - show them the video.
if they still say its fine
call in sick tomorrow
Install Fedizen
Get the full app experience
it wont let me attach videos and stills at the same time.