Pascal Ampertail 🐇💾

Sent another rat bastard assassin back to where he belongs while doing solo's today

For the love of god will people learn to use the immersive sim tag on steam correctly before I pop a fucking blood vessel

Got myself a fancy new PC case yesterday to replace my old case which was literally falling apart at this point. Needless to say I like it quite a bit

Jesus Christ I'm doing so fucking good right now she blatantly lied

most terrifying sentence i've read in my life

Humble Games Bundle: Sci-Fi Exposure ($25 for all including Marathon) buff.ly/Df9qJZN #ad

NOT NOW ENDLESS CVE WEDNESDAY PART 6

Man this PHP vulnerability is serious

the prime minister of japan is posting about PHP

messaging dad this morning

Look at her. She doesn't know anything about PHP vulnerabilities or using 4 as a private key.

there goes ffxiv due to the PHP vuln lmao

this one is definitely not internet-breaking but today just keeps on goin', it's the incident response that never ends docs.gitlab.com/releases/pat... we got RCE via regex in self-hosted GitLab baby!!!!!!!! woo!!!!!!!!!!

these vulnerabilities DO NOT AFFECT the apache web server (apache httpd), which is what most people think of. they ONLY affect the apache traffic server, which is a proxy solution.

ENDLESS CVE WEDNESDAY PART FIVE BABYYYYYYYYYY THREE NEW PERFECT 10S IN APACHE TRAFFIC SERVER, THE RIDE NEVER ENDS www.cve.org/CVERecord?id... www.cve.org/CVERecord?id... www.cve.org/CVERecord?id...

Season 3 has PvE!

Update: Final Weapon is back online following the installation and review of the latest PHP security patches. Thank you for your patience and understanding while we took the necessary precautions.

Can we stop getting new RCE's for like, two fucking seconds? Can we also stop irresponsibly disclosing them for Internet epeen points and AI model flexing THANK YOU

The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.

4 son, or php daughter?

Bad day to launch my PHP based certificate authority

If you don't cause problems for PHP then PHP won't cause problems for you except oh bother

The history of PHP is long and tied to the history of the entire modern web and we wouldn't be where we are without it and also PHP is much better than it was historically from a security perspective and a lot of infrastructure still depends on it *and also* we would like to pretend it's not there

I'm a security professional, and I can tell you that security professionals only talk about PHP when they're very distressed

I repeat, THIS IS NOT A DRILL.

This is bad enough that if you run anything public-facing with PHP, you should shut it down until you can patch PHP. This is not a drill, do it now. Seriously.

proposing we call tomorrow's security incident "the aPHPocalypse"

Hello every non-techie webcomics person who gets scared to even touch their website. PLEASE contact your host and make sure they're ready to patch this.

I took one look at a video of the exploit and immediately disabled a couple dozen website servers. If you see a wordpress still online tonight there's a sysadmin who is not answering their phone's alarms.

we're having one of THOSE days for computer security, I see

I'm tired boss... I'm tired of people irresponsibly disclosing security exploits like this all the fucking time. I'm so... So tired

there is a one-liner mitigation available ( session.upload_progress.enabled = 0 ) but THIS IS NOT A FIX and PHP developers have said it. IT DOES NOT RESOLVE THE ISSUE, YOU ARE STILL VULNERABLE. the only permanent solution is to patch, and EOL'd PHP versions might not receive the patch

details leaked. this vulnerability is a full unauthenticated unconditional remote code execution exploit against any service running on a PHP version from 5.4 until latest yeah if anything deserves CVSS 11, this is it. this is CATACLYSMICALLY bad.

I'm going to break the fucking knees of whoever fucking leaked this shit before embargo they can fucking get bent

BTW knowledge of the existence of this vulnerability enables a well financed malware group to use AI to find it, if you run PHP anything you should be taking the service down NOW until a patch is available. And then patch before bringing the service back up.

In case anybody needs social proof/thinks I'm exaggerating.

Everyone should do this. Ask your favorite devs to do this. See how they respond.