Mohab Ali retweeted
What it feels like when you start using a Chinese model and it actually just does what you want without a fucking condescending moral lecture.
Mohab Ali retweeted
The let everyone else burn tokens approach
Cloudflare Opens a PHP CTF to Test Its php2shell WAF Rules
phpnews.net/cloudflare-php-c…
Mohab Ali retweeted
fellas, if your girl:
- is short
- is insecure
- is only 4
that's not your girl. that's an eMudhra private key
Mohab Ali retweeted
absolutely none of us looks like this
but also all of us sort of look like this
(friday artwork by my colleague @dopestmarketer)
Mohab Ali retweeted
If you're looking for the most detailed AND *entertaining* way to read about the php2shell bugs, the Calif post is epic: calif.io/php2shell/
If you are responsible for running php sites/services listen to this Gentleman
Full details of a remotely exploitable vulnerability in the core engine of *all* PHP versions will be released tomorrow, October 21st. If your organization has internet facing PHP applications then you need to be ready to patch the minute the update is released or *strongly* consider taking the application offline until you can:
php.net/index.php#2026-10-20…
Mohab Ali retweeted
Full details of a remotely exploitable vulnerability in the core engine of *all* PHP versions will be released tomorrow, October 21st. If your organization has internet facing PHP applications then you need to be ready to patch the minute the update is released or *strongly* consider taking the application offline until you can:
php.net/index.php#2026-10-20…
🚨 PHP warns of two critical vulnerabilities as emergency patches arrive tomorrow
The PHP security team will release updates on October 21 at 14:00 UTC for two vulnerabilities, each rated 9.2 under CVSS v4.0.
⠀
Security researchers identified the flaws as CVE-2026-109618 and CVE-2026-109619 and described them as remote code execution vulnerabilities reportedly affecting PHP versions 5 through 8.
PHP has not yet confirmed the affected versions, exploitation requirements or fixed releases.
⠀
The vulnerabilities were reportedly leaked before their planned disclosure. Researchers said they have not observed active exploitation, while PHP warned it may release the patches early if technical details become public or exploitation is detected.
⠀
Administrators should identify PHP installations now and prepare to apply the updates as soon as they become available.
