#dev 2026-10-21

2026-10-21 UTC
ghorsey_mobile and ghorsey_mobile_ joined the channel
#
[social] I’ve not seen this in IndieWeb - https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/
#
[social] https://emudhra.we-have-a-problem.com
bterry, ghorsey_mobile, grufwub, ax562, ax5623 and Saige_Leah joined the channel
#
[schmarty] big bad news for folks running PHP sites (pinging aaronpk because indieweb infra, too): https://www.php.net/archive/2026.php
#
[schmarty] also https://news.ycombinator.com/item?id=50172041
#
Loqi [preview] [xd] Upcoming critical PHP security release
#
[schmarty] tl;dr - remote code execution affecting pretty much all default PHP installs, patch scheduled for tomorrow AM, but exploit already in the wild.
dabeglavins4, girlonthemoon, ghorsey_mobile and jaime1 joined the channel
#
[tantek] shouldn't hosting providers already do that php.ini update / mitigation?
ghorsey_mobile joined the channel
#
aaronpk apparently it's more than just the php.ini change (assuming you didn't need that feature in the first place)
#
aaronpk but yes i would expect hosting providers to do this for you on a shared hosting plan. but not on a VPS
ghorsey_mobile and JadedBlueEyes15 joined the channel