Day before yesterday it was Struts 2

the technique of repetitions there didn't do the expected subject emphasis for me.

now that you mention it, influence of llms could be what it is.

rihht? opencloud posted a really tacky "nextcloud is dealing with this. checkout open cloud. written in go."

dude... do we need to drop a link to the golang cves? they had a critical bug this year.

ruby? critical regex rce this week.

nodejs? same.

php made the news because of the embargo break making it go viral and everyone loving to hate on php. But people in glass houses should be careful throwing stones.

I think you're speaking in general and not about this specific case. This is an unauthenticated remote code exploit. All that needs to happen is your website accepts a brotli from a client or from an external api and tries to read it.

This is a bad one. Broke my no deploys on Friday rule for it.

The sky is falling... Except it isn't. Standard nonsense self advertising. And yes, vulnerabilities exist and canleasd to badness. We agree. It has always been so.

The companies with well-resourced dev teams would have been able to deal with it. But for every one of those there's 50 companies with no dev team who are sending frantic emails to the guy who quit 3 years ago asking if he's available for some urgent work. And another 50 that are not sending any emails because they're oblivious and will get pwned in a few months.

A lot of PHP apps are old, unmaintained or run by people with no idea. That's kinda it's niche.

If only it were that easy, if you do that, the managers will be grateful certainly, but they will also endlessly demand more proof and validation that the system is now completely safe from certain doom until they feel comfortable, which is never. In a lot of cases it's simply easier to convince them that the system was never vulnerable to certain doom in the first place, because you were of course already 5 steps ahead of this even in the planning stages, and for some reason they have an easier time accepting that, as long as they still have every reason to believe you are a brilliant tech god who would never personally fall victim to such a common vulnerability. I suppose it's really less about the reality of the situation and more about what kind of corporate image you are cultivating and maintaining for yourself.

Well, I mean, the AI advances have moved the mean time to exploit between a zero day being announced, and it actively being exploited en masse, from about 3 weeks in 2018, to about -1 day in 2026. So, things have changed a bit.

Yeah but this wasn't an exploit in PHP applications, this was an exploit in PHP.

Our resolution was to unzip a new directory and change the path to PHP in Apache conf

Why are people mad? These issues existed and now they don't. It's not like the researchers created them

Not as bad as heart bleed

My man

How's Rust holding these days I wonder? Always wished I had learned it when it first came out ha.

Only ugly if you've been taught to think that

Who cares if it's vibecoded? The exploit is the exploit.

Oh yeah, everyone loves black text on white background, with each div placed sequentially in a vertical stack :) really gives it that vintage mid 90's dial up internet "the website failed to load CSS" look

There's nothing wrong with CSS. Arguably it's been overcomplicated way beyond it's original scope, but it works as designed to make your sites look good

While it's a bit opportunistic to blame JS in the backend in this case, I despise JS in the backend enough to happily join you.

Serves you well JS enthusiasts, your programming language is the only one that I despise more the more I learn about it. :P

Rust itself doesnt get mant CVEs and its been quiet so thats nice.

its worth noting its a bit different than languages I listed and lower-level. Those languages are also runtimes that provide a large set of features that run with your code.

That means while you could write websites in Rust, reall it is what you might consider writing PHP in if you started in 2026 not an alternative. Its more closely like MUSL(did get a recent big security release 🙄) or glibc.

Am in IT. These last few days were pretty annoying. 3 mandatory meetings a day. Scrambling to find the right person for our 3rd party stacks.

The fix was pretty easy once we had it. Just annoyed that this is going to only get worse.

Not entirely accurate. I happen to be my company's 1 man IT army, and I got it all plugged within 4 hours (php2shell, CA certificates, which I only had to rotate, etc). It was bad, but the noise was even worse. If IT departments are proactive and do their jobs, the actual problems should be little to none.

Then I did the same in my proxmox, everything is just fine.

Uhm. There's a release called Node2Shell, linked in the article.

Well, they're called "zero days" for a reason.

Depends on how you handle the OOM error though, aborting the process is fine while "try to recover and continue" is the problem.

Yeah back then update and patch can go after month because problem found in months too or year, now because automated tools called LLM exist, those who find problem or even make on and exposing vulnerability can do it in minutes, it is inevitable.

JavaScript should never have been used that way to begin with.

Berkshire Hathaway website is html.

https://www.berkshirehathaway.com/

apparently i was wrong... https://github.com/rust-lang/rust/issues/164250

haven't watched it yet but apparently this is a good explanation
https://www.youtube.com/watch?v=4iAi5exNHv8

In lua you will typically lua_pcall() the entry function written in Lua, but it will often call back into your C functions to do various tasks. Now if your C functions do anything with the lua stack, that might cause OOM, but now your lua_pcall() will catch that - or any sort of error catching inside Lua itself - and you'll be looking at an accidental recovery situation.

At least that was how things looked like when I last poked around Lua a few months ago.

So as far as I know, it's actually not trivial to make Lua safely abort on OOM, and it's not the default behavior. I also don't think there are lua_push* function alternatives available using the default C API that don't longjmp in a likely often unsafe manner out of your C code if you use them and you hit OOM.

Summed up, I would expect many Lua integrations to have the same problem.

What.

Node has literally always been like this. It’s just a risk you accept when you choose to use it.

To be fair, this is literally the only thing AI is being sold as useful for that actually works.

The only site I knew was affected was the next cloud homepage which I checked for updates if they already had a patched version for there docker containers. So I thought it quite funny that the site I visited to see if they had fixed it was also affected.

These vulnerabilities are only news stories because developers don't develop strategies to patch their products rapidly enough.

Static site suprimacy week.

NSA backdoors

JavaScript should never have been used that way to begin with.

I run a la. Not even a full lamp. Its just a slack box with base apache html.

For years i've been mocked. But that bitch has never been compromised and it's damned near impossible. Who's laughing now.

What does it do? Serve pictures of cats?

mostly your mum

Super interesting ty!

“If you don’t test for them, the numbers will go down” - President Trump on COVID-19.

Yup. Once the PoC has been documented, you gotta patch. Now if you want them to stop vibe coding to find complex PoCs that a human may have never found, it’s a risk.