🔒 Castopod 1.15.6 is out!
Two critical PHP vulnerabilities (CVE-2026-109618 & CVE-2026-109619) allow unauthenticated remote code execution on servers running PHP below 8.4.27.
🐳 Castopod's code hasn't changed: this release only moves our Docker image to PHP 8.4.27. Docker users: pull castopod/castopod:1.15.6 and restart.
🖥️ Running Castopod on your own server? Updating Castopod won't help: update PHP to 8.4.27 or later now!
It must be said given the recent surge of AI slop spreading online: 
Rocky was NEVER an oil wrestler! He never even cared about wrestling!
The 
Bugs will pay for spreading disinformation on the Internet. 
When do you plan to update the docker image for the very critical PHP update tomorrow?
New short article: How #Vinyl_Cache can help with #php2shell
how is everyone enjoying cyber security awareness month so far?
So how's your day going?
Just to be clear, I am currently dumping elliptic curve keys from the tls certificate transparency logs, and will then be running an optimized mass-cracker tool that I'll use to check a few trillion weak private keys against the entire set simultaneously using sparse bloom filters.
The scanner (which is being heavily cribbed from my mass cryptocurrency key cracker "brainflayer") should be able to scan hundreds of thousands if not millions of keys per curve per second per core.
I am not aware of anyone else having previously done this, so hold on to your butts.
2 core php issues, a CA that was roleplaying xkcd 221, and now a nice lovely little cvss 10.0 gitlab RCE? the latter of which again appears to be because ruby and regex are a security match made in hell?
what a day
(e:) and some java: cve.org/CVERecord?id=CVE-2026-…
Learn more about GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 for GitLab Community Edition (CE) and Enterprise Edition (EE).Félix Veillette-Potvin (GitLab Docs)
GitLab treu una actualització de seguretat que corregeix una execucció remota de codi sense autenticació per un desbordament d'enter al motor de regex Onigmo. Afecta tots els self-managed des de la 7.0 (2014).
QUIN DIA AMICS…
thehackernews.com/2026/10/crit…
GitLab fixes CVE-2026-110264, a critical flaw that could allow unauthenticated code execution on self-managed versions dating back to 7.0.The Hacker News
Apple appears to have rolled the eMudra distrust into their native root program, but **not** into `/etc/ssl/cert.pem`, meaning that macOS supplied tools like `curl` and the system Python are still affected by the compromised intermediates.
setting `CURL_SSL_BACKEND=secure-transport` redirects the system curl to the platform verifier, but it's not great that every macOS host is trivially MITM-able by default at the moment.
in a better world, creators wouldn't be doing promotion. but also nobody would be paid to do it.
we'd instead have a great mostly frictionless system where great stuff would be shared via the word of mouth (boosts) of their fans. And for music...an internet radio DJ ecosystem of curators paid to crate dig and be honest about what they find.
I know people have a whole set of feelings around this and so do I, but “we made a dot-release so users running unsupported configurations or forks don’t get hung out to dry” is not something you will get anywhere else from anyone else.
Love and respect to the whole team this week.
this is one of the reasons we also made a dot-release. To protect users in unsupported configurations and convey the urgency
babe wake up, a new vuln for the patched PHP just dropped.
fedi.katze.sh/@elise/117479383…
still works on 8.5.12!
I read a little bit more about php2shell because I was curious why the panic seemed to be so PHP specific
good lordt.
Walkin'
#MastoArt #FediArt #FresnoNightcrawler #Cryptids #illustration
Please stop anthropomorphizing AI company executives.
They're not sentient and they can't actually think. They just predict the next token using statistical patterns scraped from LinkedIn, X and the Financial Times. The apparent "understanding" is simply a parlor trick: They produce text strings that *sound* plausible, but they don't actually have any understanding of the world.
I'll grant that they became a lot more technically impressive when Reinforcement Learning from Investor Sentiment pipelines were introduced, but fundamentally they're still just stochastic bullshit generators. Running them in a loop and giving them access to the internet will end up being the most expensive mistake in the history of technology.
"but fundamentally they're still just stochastic bullshit generators"
...so, fundamentally the same thing as real executives.
Prorrogamos a chamada para palestras do GNOME Latam 2026 até 31 de outubro!
Ainda não enviou sua proposta?
Esta é sua chance de fazer parte do evento realizado junto com a CCOSS, que une a comunidade @gnome na América Latina.
Compartilhe sua experiência como palestrante!
Inscreva-se aqui: events.gnome.org/e/latam2026
GNOME Latam & CCOSS 2026 12 al 14 de noviembre | Universidad Anáhuac Mayab (Mérida, Yucatán, México) & Track en línea.GNOME Events (Indico)
¡Extendimos el llamado a charlas de GNOME Latam 2026 hasta el 31 de octubre!
¿Aún no envías tu propuesta?
Esta es tu oportunidad de ser parte del evento impulsado junto a CCOSS que une a la comunidad de @gnome en América Latina.
¡Comparte tu experiencia como ponente!
Postúlate aquí: events.gnome.org/e/latam2026
GNOME Latam & CCOSS 2026 12 al 14 de noviembre | Universidad Anáhuac Mayab (Mérida, Yucatán, México) & Track en línea.GNOME Events (Indico)
Zach Bennoui
in reply to Austin Nix • • •Devin Prater :blind:
in reply to Austin Nix • • •