‼️BREAKING: PHP has released its fix for the two leaked flaws, which can let attackers run code on servers without logging in.
"There are no complete mitigations, updating is the only safe choice," PHP says.
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now.
PHP says Apache with mod_php is most at risk, with a demonstrated exploit that fires before any application code runs.
PHP 8.1 and older get no official update, though PHP has published source backports for 7.4, 8.0 and 8.1.
Source: https://www.php.net/archive/2026.php#2026-10-21-5
"There are no complete mitigations, updating is the only safe choice," PHP says.
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now.
PHP says Apache with mod_php is most at risk, with a demonstrated exploit that fires before any application code runs.
PHP 8.1 and older get no official update, though PHP has published source backports for 7.4, 8.0 and 8.1.
Source: https://www.php.net/archive/2026.php#2026-10-21-5
🔥11😱3❤2
‼️ WhiteDate, the neo-Nazi dating site German Pink Power Ranger hacker "Martha Root" wiped on stage, now forwards to GoebbelSuite, a Google parody built on the AfD leak.
https://goebbelsuite.com
https://goebbelsuite.com
🤣36🔥6🤬2❤1👏1💩1
🚨 The AI gateway library LiteLLM was hijacked again in a supply chain attack.
It hid malware that runs whenever Python starts and steals SSH keys, cloud secrets and Claude Code configs.
It also raids LiteLLM's own database for every AI provider key stored.
https://www.aikido.dev/blog/litellm-compromised-infostealer-rat
It hid malware that runs whenever Python starts and steals SSH keys, cloud secrets and Claude Code configs.
It also raids LiteLLM's own database for every AI provider key stored.
https://www.aikido.dev/blog/litellm-compromised-infostealer-rat
💩22🤪2😁1
‼️ BREAKING: Trend Micro posted several unpatched Linux kernel flaws to public mailing lists.
Two are critical remote code execution bugs in the kernel's SMB server, and one includes proof-of-concept code.
Linux maintainer Greg told them to "fix your submission process."
https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities
Two are critical remote code execution bugs in the kernel's SMB server, and one includes proof-of-concept code.
Linux maintainer Greg told them to "fix your submission process."
https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities
🥴21🤣4😭2🤪2❤1😁1
❗️ A Hacker News user apologised for posting the PHP2Shell CVE IDs two days early, saying his contact told him there was no embargo.
PHP moved its patch up a day as the IDs spread.
Amazon says attackers were already trying the exploit on 17 October, three days before his post.
https://news.ycombinator.com/item?id=50193416
PHP moved its patch up a day as the IDs spread.
Amazon says attackers were already trying the exploit on 17 October, three days before his post.
https://news.ycombinator.com/item?id=50193416
🥴21😱4❤2😁2💩1
❗️ EU governments backed a GDPR change on Wednesday that would let AI companies use Europeans' personal data without consent.
Privacy group noyb says OpenAI, Google and Meta could tap decades of collected data with almost no limits.
The European Parliament still has to agree.
https://noyb.eu/en/ai-eu-member-states-approve-digital-expropriation-europeans-ai-companies
Privacy group noyb says OpenAI, Google and Meta could tap decades of collected data with almost no limits.
The European Parliament still has to agree.
https://noyb.eu/en/ai-eu-member-states-approve-digital-expropriation-europeans-ai-companies
🤬35💩5🤣4
❗️ EU governments backed a GDPR change on Wednesday that would let AI companies use Europeans' personal data without consent.
Privacy group noyb says OpenAI, Google and Meta could tap decades of collected data with almost no limits.
The European Parliament still has to agree.
https://noyb.eu/en/ai-eu-member-states-approve-digital-expropriation-europeans-ai-companies
Privacy group noyb says OpenAI, Google and Meta could tap decades of collected data with almost no limits.
The European Parliament still has to agree.
https://noyb.eu/en/ai-eu-member-states-approve-digital-expropriation-europeans-ai-companies
🤬34💩7😱4🎉2🤔1
‼️ China's Moonshot says it nerfed Kimi K3.1 Pro by stripping cyber training data from the open-weights version to curb misuse.
Its solve rate on Moonshot's cyber benchmark went from 90.5% to 81%.
Artificial Analysis ranks it China's strongest model and 4th in the world.
Its solve rate on Moonshot's cyber benchmark went from 90.5% to 81%.
Artificial Analysis ranks it China's strongest model and 4th in the world.
😢26🔥6😁2🤔1
‼️ Researcher Erica Windisch skipped coordinated vulnerability disclosure and published 11 unpatched Tailscale flaws.
In her lab, Tailscale SSH race conditions let one hacked device get root on other servers and add a rogue node.
https://tailworm.com/
In her lab, Tailscale SSH race conditions let one hacked device get root on other servers and add a rogue node.
https://tailworm.com/
😁20🤔5😭3😱2❤1🥰1
❗️ A developer hid a Bitcoin key on a PHP server left unpatched against PHP2Shell, the critical flaws fixed on Oct 21, and dared anyone to steal it.
17 hours on, the wallet holds ~$2,000 and nobody has taken it.
The developer says someone is crashing PHP but "still no RCE yet".
https://news.ycombinator.com/item?id=50224916
17 hours on, the wallet holds ~$2,000 and nobody has taken it.
The developer says someone is crashing PHP but "still no RCE yet".
https://news.ycombinator.com/item?id=50224916
🤣25🤪4❤1😁1🤔1
❗️ eToro published its reply to Apple's App Store reviewers as the release notes for its iPhone trading app.
It tells Apple a background audio setting they flagged "was included by mistake and is not tied to any functionality in the app."
The reply is still on the App Store. https://t.co/Hcc0BrIMnl
https://x.com/IntCyberDigest/status/2114484398536204752
It tells Apple a background audio setting they flagged "was included by mistake and is not tied to any functionality in the app."
The reply is still on the App Store. https://t.co/Hcc0BrIMnl
https://x.com/IntCyberDigest/status/2114484398536204752
🤣12