Official PHP Announcement

Upcoming Critical PHP Security Release

The PHP security team would like to give advance notice of an upcoming security release.

It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.

It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.

All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.

We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.

Full details, affected versions, and the fixed versions will be published with the release.

Thank you for helping us keep PHP secure.

Based on rumors it appears to be unauthenticated remote-code-execution targeting a broad section of PHP-based web applications. There also appears to be a video circulating of a proof-of-concept, demonstrating attacks on MediaWiki, WordPress, Drupal, and about a dozen other PHP-based platforms.

Recently, an independent proof of concept has been claimed, but a PHP developer is saying the suggested workaround is insufficient.

[–] [S] 10 points 23 hours ago* (last edited 21 hours ago) (1 child)

Mainly. I don't want to put words in his mouth (its an extremely early project without any formal announcement or anything), but there are nearly zero distributions where eliminating the reliance on AI-generated components is actually the goal. You have distros like Gentoo which don't use AI for development, but this has no impact on the system architecture, and with the kernel, sysutils, graphics libs, browsers, major programming languages, etc. all turning into slop, there is a dire need for an operating system which is ideologically committed to maintaining sane engineering practices.

NetBSD has suddenly become popular as one of the last untainted OSes (excluding some externally-maintained components), but as a project / foundation, this is not due to any strong ideological commitments, and it is likely the priorities of maintaining NetBSD and building a no-AI base system (or salvaging a lot of Linuxy/GPL components) are not fully aligned.

  • source
  • parent
  • context
  • [–] 3 points 2 days ago

    Positive update on the FUTO situation: https://mastodon.sdf.org/@netbsd/117464275119384776

    NetBSD Foundation: Hey, just to clear this situation up:

    We received the donation out of the blue with no knowledge of who these people are. We don't have any communication with them and don't know what (if anything) they want from us. Maybe they just want more traffic to their site, which is mostly about software.

    Our rule is donations cannot come with restrictions/requirements/influence other than we add a logo to our site. They requested this. At the moment we have to follow our own bureaucratic rules.

  • source
  • parent
  • context
  • [–] 2 points 2 days ago* (1 child)

    Just scrolled past this comment on Mastodon: https://justfollow.me.uk/@sborrill/117461932167067930

    Xen support in #NetBSD both as a host and guest is very mature; it got support not much after Linux and predates KVM by a number of years. It supports UVC with the uvideo driver. USB audio also generally OK. You can do kernel USB development entirely in userland using rump kernels, so the actual kernel code is used but cannot panic the machine and you can debug with gdb.

  • source
  • parent
  • context
  • [–] 2 points 3 days ago* (last edited 3 days ago)

    Userland (whether GNU or alternatives) is vulnerable to the same pressures. The only thing unique about the Linux kernel is that it is indespensible (hence the existential dread). A lot of major projects have already embraced the same LLM-driven development process as Linux (though it is particularly egregious in Linux). Aside from the kernel, the task of putting together a slop-free distribution today is very challenging (nothing like this exists, except for some highly experimental and incomplete projects like Hyperbola). It requires the sacrifice of a lot of tools which we have grown accustomed to. It is something like a regression to the state of free software computing 20 years ago.

    The same problem applies to the BSDs, because even if the base system is clean (say, if NetBSD maintains the status quo, or embraces an explicit no AI policy going forward), people rely on ports (packages) to do anything serious with their computers, which are the same programs people run on Linux. Your web browsers, text editors, window managers, word processors, password managers, graphic design tools, etc. Also a lot of plumbing falls into this category, like system libraries, image/video/audio codecs, programming languages, build systems, databases, webservers, middleware, etc.

    You can have your perfectly slop-free operating system with new drivers to leverage the latest hardware, but you're still stuck with no alternative to Firefox.

  • source
  • parent
  • context
  • [–] 14 points 3 days ago* (last edited 3 days ago) (3 children)

    The crisis befalling the Linux kernel is not technical in nature. It is a social crisis. Switching to NetBSD is a technical solution which does not address the root cause of the problem. NetBSD likely has only avoided the slop so far because the project is not economically interesting, but if it evolves into a broadly viable alternative to Linux, FreeBSD, and OpenBSD, that interest will materialize and the project will suffer the same fate. It is already concerning that they do not reject slop on ideological grounds. The status quo is that they simply haven't accepted any yet. The gears of co-option are already turning, with the project accepting grants from FUTO for instance. This isn't to say that they are compromised or evil or anything like that, but it is a concern.

    The solution to this crisis requires organization. New organizations which embrace a naked antipathy towards capitalism, to seize the mantle which has been abdicated by the sclerotic FSF, SFC, and company. The path forward very well might be NetBSD, or it might be a hard fork of the Linux kernel. The problem of user-space remains, so it is necessary for the movement to be much larger in scope than simply a kernel. Fortunately, I am hearing these concerns voiced by a lot of people who are absolutely dismayed by the trajectory of the Free Software movement.

    All that said, I hope you have success. Whether the future lies in NetBSD or Linux, we will need all of the hands to build the alternative. I myself have been checking out NetBSD with interest recently (and other wacky alternatives like Redox OS) for the same reasons, though I haven't been able to boot the installer on my physical machine. (I got it. I had to use a different USB, and I also needed to manually run NetBSD's fsck on the EFI partition I originally created when installing Gentoo a long time ago)

    I too am keeping my ear to the ground, to try and see where it might be useful to contribute. I am pretty much only a hobbyist though.

  • source
  •  

    @Pontifex: In this era of artificial intelligence, it is becoming urgent to distinguish human art from what machines produce. There is an ontological difference, even before an aesthetic one, between art and what a machine can generate through statistical calculation based on millions of images created by others. Algorithms lack the spark of humanity. For this reason, the Church wishes to renew an alliance with artists and cultural institutions to safeguard our humanity.

    @Spectromachina: Pope, would you please shut the fuck up about matters you do not understand? You're not an Ai influencer, no one elected you, and you have absolutely no weight in this debate and you're being used as a mouthpiece to sway public opinion. how many local models do you run?

    Community Note: The Pope is elected by cardinals in a Conclave which gathers in the Sistine Chapel.

    Link: https://x.com/Spectromachina/status/2105997770653839860

    Screenshot of Twitter. Text in body.
    view more: next ›