Set `session.upload_progress.enabled=0` until the next PHP release to block an unlikely RCE vector (CVE-2026-115560).
We already recommended this for CVE-2026-109619 from Wednesday: keep it disabled.
Only applications with non-default `serialize_handler` switching it to `php` at runtime can be affected.
There is more information in the advisory on the PHP website by the PHP security team: https://www.php.net/archive/2026.php#2026-10-23-1
Our global team, including @ondrej, worked around the clock to deliver PHP2Shell fixes: ~500 builds covering all 12 supported PHP versions, 10 Debian/Ubuntu releases and up to 4 architectures. Updates rolled out progressively over ~15 hours, with the rollout fully complete by 1:30 AM CEST.
why do people call LLM training on public website data “AI Copyright Infringement” when “six finger discount” is right there
RT: @sarrah_bellus Wow.
Albanians just set fire to the Supreme Court after it allowed Jared Kushner to buy land in the country against the their will.
The French courts yesterday handed down an unfavorable ruling against Quad9 in a major case that undermines the transparency and stability of the internet. As a result, Quad9 will no longer be able to offer its free cyberprotection service to users located in France effective November 24.
mitmproxy now has an --emudhra option 😆
https://github.com/mitmproxy/mitmproxy/commit/169234499088fc2c414644a67efaed3d64ae2e3b
https://youtu.be/b8QGrBIIu6Q?si=lDmae7TmGE78ZUet&t=487
(yes it's PHP)
Just think about all the folks downloading the PHP patches through a connection that is part of MITM attack, because their curl or whatever is still using the emSign Root CA. #php2shell
In years of running many Debian systems for many people, I've never had a serious incident involving something that the Debian security team could've done anything about. Really stellar work and I'm sure many people don't even realise how much they benefit from it!
Now that the updates are out, and I can finally show the article for php2shell
This has been long in the making, as I was part of the disclosure process and helped with liaising to (amongst others) CERT-Bund.
I'm glad this is out, even though it leaked a day ahead of time.
Now, it's time to watch the web burn, I'm afraid.