HomeSearchPrevious dayNext day

01:06:32<DigitalDragons>I think KGC is key generation ceremony (?), no idea what they mean about wrap/unwrap
01:09:40Juest (Juest) joins
01:20:44ThetaDev quits [Quit: https://quassel-irc.org - Chat comfortably. Anywhere.]
01:21:33ThetaDev joins
02:08:24<nicolas17>DigitalDragons: you can encrypt ("wrap") the private key such that it can only be decrypted by another HSM, which seems important for eg. backups
02:09:28<Rdav1986>klea: its just ip address and host name https://parquet.abnormalspring.com if you want to look. its only 1gb of the data hosted
02:12:58<steering> 2026-10-17 18:05 - Emailed Apple, Chrome, Microsoft, Mozilla (Ben directly then), eMudhra with report + attestation
02:13:01<steering> 2026-10-17 21:48 - Mozilla independently recover the keys without any tips, and send oh_dear.zip as proof using 'EM DV TLS CA - G3B'
02:13:04<steering>rofl
02:31:30HackMii quits [Ping timeout: 252 seconds]
02:33:46HackMii (hacktheplanet) joins
02:33:59Webuser193684 quits [Quit: Ooops, wrong browser tab.]
02:38:12<nicolas17>"some asshole decided to completely leak the deets of the exploit instead of waiting 14 more hours for the responsible disclosure/patch window to end. researched via ai of course"
02:38:18<nicolas17>turn off your PHP servers y'all
02:38:30<steering>rofl
02:50:24<Umbire>lmao
02:50:28<Umbire>figures
02:52:15<DigitalDragons>quick, someone go turn off archive.org :P
02:57:35<@JAA>This comment from a PHP core dev seems to suggest that writeup isn't it: https://phpc.social/@Girgias/117476477429221001
02:58:16<nicolas17>JAA: I interpreted that as "that mitigation isn't enough"
02:58:29<@JAA>Or that
03:00:12<Dango360>no need to be scared if email addresses on archive.org will be leaked if all of the items contain them already
03:02:02<Dango360>oh god could mediawiki be affected by this
03:02:47steering turned off all his personal php stuff and then realized that breaks his music scrobbling 😭
03:02:51<TheTechRobo>Dango360: It appears it is.
03:02:53<@JAA>The word is that all PHP since version 5.4 is affected, and the vulnerable bit is hit before any user code.
03:03:07<TheTechRobo>(Video I saw linked is https://media.infosec.exchange/infosec.exchange/cache/media_attachments/files/117/475/759/330/067/147/original/4e800fe72bfa6523.mp4)
03:03:20OrIdow6 (OrIdow6) joins
03:03:20@ChanServ sets mode: +o OrIdow6
03:05:48<DigitalDragons>all of miraheze is offline due to this
03:07:36DigitalDragons is very glad her meme language of choice is java and not php
03:08:29<steering>i just turned off work for now, i'll have to fix part of that though
03:08:57<TheTechRobo>So just to clarify, this is well and truly leaked? There is no use waiting to upgrade at 14:00 UTC like the PHP maintainers said?
03:09:15<nicolas17>TheTechRobo: I mean there's nothing to upgrade to yet
03:09:31<steering>TheTechRobo: supposedly the thing that's published is different, and it's not clear to me that the impact of the published thing is anywhere near as bad as the claim
03:09:44<Dango360>not even with `session.upload_progress.enabled = off` apparently
03:09:58<TheTechRobo>nicolas17: They announced the patch will be available tomorrow at 14:00 UTC. https://www.php.net/archive/2026.php#2026-10-20-1
03:10:07<nicolas17>yeah
03:10:07<TheTechRobo>or, I guess today in UTC :P
03:10:07Dango360 hopes wikipedia doesn't explode from this
03:10:16<nicolas17>but what do you mean "no use waiting"
03:10:48<Dango360>time to go into my time machine
03:10:57<Dango360>it's bigger on the inside
03:11:32<TheTechRobo>nicolas17: As in, this is actually leaked and currently exploitable even though the patch is not out (rather than just the existence being leaked)
03:11:48etnguyen03 quits [Remote host closed the connection]
03:12:21<Dango360>just got reminded of this video https://www.youtube.com/watch?v=y4GB_NDU43Q
03:21:28<TheTechRobo>well, just found what seems to be a PoC, so that answers that question :/
03:26:35saveallthejunk_ (saveallthejunk) joins
03:29:33saveallthejunk quits [Ping timeout: 256 seconds]
03:34:23Umbire quits [Quit: Umbire zaps a wand of digging!]
03:34:56Umbire (Umbire) joins
03:38:57saveallthejunk_ is now known as saveallthejunk
03:40:32<Dango360>you *could* make a personal hotfix for php if you can't afford waiting
03:43:25<nicolas17>no, at 0:45 I'm not gonna make a patch for PHP and compile it and deploy it in prod
03:43:46<Dango360>it's 4 am for me lol
03:49:21<steering>https://www.wikimediastatus.net/ reports an unspecified emergency maintenance...
03:53:27<steering>https://gerrit.wikimedia.org/r/plugins/gitiles/operations/puppet/+/15f0a35e4fe164af27b1faa72c5a01830559947e deployment: restrict access to deployment host (mentions the php ETA)
03:54:11<steering>also a couple of disabling things "for reasons" and removing the Z from `X-Powered-By: PHP/X.Y.Z `
03:55:11<steering>(I suspect they've gotten an embargoed version of the release or something)
03:56:03<@JAA>05:55 here right now
03:56:20<nicolas17>huh why restrict access
03:57:16<DigitalDragons>wikimedia foundation phabricator (issue tracker) is fully offlone
03:58:21<Dango360>maybe an entire rust rewrite with ai for php will fix things! /j
03:58:21<steering>oh and phabricator -- yeah
03:59:07<steering>nicolas17: either something to do with exploitability/blockability of the exploit or just not wanting people to see the embargoed release thats going through their deployment servers?
04:09:41<DigitalDragons>minor version is also gone from Special:Version and the api too
04:52:30<nicolas17>took PHP stuff down on kde.org >.>
04:58:58saveallthejunk_ (saveallthejunk) joins
05:02:29saveallthejunk quits [Ping timeout: 265 seconds]
05:03:31saveallthejunk_ is now known as saveallthejunk
05:04:42<saveallthejunk>of all the places to find out about a php vuln. i guess i'm not getting much sleep tonight.
05:09:21saveallthejunk_ (saveallthejunk) joins
05:10:32saveallthejunk__ (saveallthejunk) joins
05:12:38saveallthejunk quits [Ping timeout: 265 seconds]
05:14:13saveallthejunk_ quits [Ping timeout: 250 seconds]
05:21:44Rdav1986 quits [Quit: The Lounge - https://thelounge.chat]
05:21:55Rdav1986 (Rdav1986) joins
05:22:58saveallthejunk__ is now known as saveallthejunk
05:33:00d10n quits [Quit: why all the #hashtags]
05:33:39d10n joins
06:24:42twiswist_ (twiswist) joins
06:28:31twiswist quits [Ping timeout: 265 seconds]
07:05:16BornOn420 quits [Remote host closed the connection]
07:09:43HackMii quits [Remote host closed the connection]
07:10:08HackMii (hacktheplanet) joins
07:15:18BornOn420 (BornOn420) joins
07:18:34<that_lurker>https://www.bleepingcomputer.com/news/security/ovhcloud-cli-releases-backdoored-on-github-to-steal-developer-secrets/
07:26:46twiswist (twiswist) joins
07:29:15twiswist_ quits [Ping timeout: 256 seconds]
08:02:30AK quits [Quit: AK]
08:05:20pseudorizer quits [Quit: ZNC 1.10.3 - https://znc.in]
08:08:02pseudorizer (pseudorizer) joins
08:39:05pepsi2024 joins
08:40:47<klea>Rdav1986: hmm, interesting: You are unable to access abnormalspring.com (ButtFlare)
08:50:12<@imer>what a lovely thing to wake up to lol finally getting a breather after shutting down a shitload of stuff x.x
08:54:38<masterx244|m>sweeped thru my stuff, too. sweeped out a few php files, too. luckily most on nplusc.de is static files (i luckily use a plain file upload via ftp fr when i need to share files quickly so those links dont break) or not publicly reachable at all
09:00:26Bleo182600722719623455222011079 quits [Quit: The Lounge - https://thelounge.chat]
09:03:15Bleo182600722719623455222011079 joins
10:02:45AK (AK) joins
10:15:50justauser|ttt quits [Remote host closed the connection]
10:16:55justauser|ttt joins
10:19:37jspiros (jspiros) joins
10:43:44beardicus90 quits [Quit: bye]
10:48:33beardicus90 (beardicus) joins
11:41:41AK quits [Client Quit]
11:45:10BornOn420 quits [Remote host closed the connection]
11:45:54AK (AK) joins
12:02:48BornOn420 (BornOn420) joins
12:13:12<TheTechRobo>deb.sury.org will have patched versions ready all the way down to 5.6: https://codeberg.org/oerdnj/deb.sury.org/issues/145
12:15:12<klea>And if you're using deb.sury.org for arm, you may have to wait a little bit more, since someone leaked the exploit being there, which lead to the stuff being made to be done a day earlier, apparently.
12:15:29<klea>> load average: 51,13, 51,54, 47,93
12:23:21unknownsrc quits [Ping timeout: 256 seconds]
12:25:40unknownsrc (unknownsrc) joins
12:45:28Umbire quits [Quit: Umbire zaps a wand of digging!]
12:55:01doskel quits [Remote host closed the connection]
13:06:00doskel (doskel) joins
13:12:05BornOn420 quits [Remote host closed the connection]
13:22:14BornOn420 (BornOn420) joins
13:38:39Lord_Nightmare quits [Quit: ZNC - http://znc.in]
13:40:55Lord_Nightmare (Lord_Nightmare) joins
13:47:29amphitryon joins
13:49:19amphitryon_ quits [Ping timeout: 265 seconds]
13:55:09<Dango360>https://www.php.net/archive/2026.php#2026-10-21-5
14:01:49AK quits [Client Quit]
14:05:48@imer quits [Quit: Oh no]
14:06:20AK (AK) joins
14:07:07imer (imer) joins
14:07:08@ChanServ sets mode: +o imer
14:11:29dada quits [Quit: chief, beam me out of here]
14:22:57NF885 (NF885) joins
14:24:59Barto quits [Ping timeout: 250 seconds]
14:25:56NF885 quits [Client Quit]
14:28:48nine quits [Quit: See ya!]
14:29:23nine joins
15:00:21<steering>RCE via stale global state (CVE-2026-109619):Fix attacker-reachable fatal errors and execution timeouts, including failures in callbacks, upload or import processing and cleanup.
15:00:25<steering>lmao, what
15:00:56<steering>that's quite a mitigation step...
15:07:34<steering>https://github.com/php/frankenphp wtf is this
15:16:01<@JAA>So I guess netcup's email about PHP to all customers wasn't at risk of triggering spam filters, eh?
15:16:17<steering>rofl did they really
15:21:16<klea>Nope, that can't trigger spam filters, JAA didn't you know that email providers when they get get a message to the security list, they whitelist all keywords that may apply? /shitpost
15:47:35tta2 quits [Remote host closed the connection]
15:59:22eggdrop quits [Read error: Connection reset by peer]
16:00:39eggdrop (eggdrop) joins
16:06:04dada joins
16:19:21thelounge26 quits [Quit: Disconnecting]
16:20:04thelounge26 joins
16:34:12Starchives__ (Starchives) joins
16:37:21<steering>yay one of our things at work got updated as a result of this \o/
16:38:00Starchives_ quits [Ping timeout: 265 seconds]
16:39:15jodizzle (jodizzle) joins
16:47:54<@imer>there's apparently more potential exploits, so may warrant waiting a bit longer if people can
16:48:13<@imer>e.g. https://fedi.katze.sh/@elise/117479383739450605
16:52:56<steering>there's always more potential exploits... :p
17:03:06<klea>https://cloudisland.nz/@yaakov/117476242408958038
17:03:21<klea>The potential for exploits is infinite!
17:03:40<klea>Clearly the solution is to take your machine, and burry it in cement, with no cables going in or out.
17:08:12jspiros quits [Read error: Connection reset by peer]
17:08:23Barto (Barto) joins
17:08:33jspiros (jspiros) joins
17:09:36<that_lurker>Seems like most of the new exploits need prior access to the machine to run the php code at least
17:12:28<that_lurker>but maybe by tommorrow someone has wasted at least one American citys water table with AI we could have new exploits and new updates \o/ what fun it is to choose cybersecurity as a job
17:14:10tta2 joins
17:15:44marcmeat quits [Read error: Connection reset by peer]
17:16:37marcmeat (marcmeat) joins
17:20:46<klea>Yes, very fun.
17:20:53klea notices her water bottle is empty.
17:29:32<nicolas17>`W: Failed to fetch https://ppa.launchpadcontent.net/ondrej/php/ubuntu/dists/jammy/InRelease 503 Service Unavailable [IP: 2620:2d:4000:1009::15f 443]`
17:31:14<klea>Fun :(
17:31:25<TheTechRobo>yeah, I had to switch to the canonical deb.sury.org - even when the PPA did load it didn't have any updates (at least a few hours ago when I updated)
17:32:03<TheTechRobo>https://packages.sury.org/php/README.txt - it does work on Ubuntu 22.04
17:32:06<klea>I've also seen 429s from it, but apparently worked this time.
17:33:19doskel quits [Ping timeout: 256 seconds]
17:33:22<TheTechRobo>(AIUI that's where the PPA is eventually going to be moving anyway)
17:37:46<steering>>using ppas
17:42:19<nicolas17>steering: old af distro
17:44:19<steering>¯\_(ツ)_/¯
17:44:43<steering>ii php 2:8.3+93ubuntu2 all server-side, HTML-embedded scripting language (default)
17:49:30<that_lurker>was fun to see that this time Canonical was faster than RHEL on releasing security updates
17:49:40<that_lurker>took time like 50minutes, but still
17:49:51<that_lurker>s/time/them
17:54:32<steering>>Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages.
17:57:46<nicolas17>problem is I have a server on focal and that's not supported even by the PPA
17:58:15<steering>well why is that server still on focal xP
17:58:31<steering>(it could be worse...)
17:58:41<nicolas17>I'm sure there's a xenial somewhere here
17:58:51<steering>tbh at that point i'd probably just build php myself until i can get the server updated
17:59:40<steering>odds are pretty good you could just apt build-dep php and then build the newer version :P
18:00:53<nicolas17>I've been out of the loop for a while
18:01:04<nicolas17>and when I tried to replicate one of the servers locally with vagrant and ansible as I had done in the past
18:01:11<nicolas17>I found that vagrant is kinda dead and bitrotted
18:01:19<nicolas17>it works best with virtualbox which is kinda dead and bitrotted
18:02:18<steering>meh, i still use virtualbox for my local vm's, it's fine
18:02:34<steering>IMO whether or not its the best it works just fine
18:05:24<nicolas17>vagrant also killed their hosted image repository
18:05:39<nicolas17>"distros should host their own"
18:05:53<nicolas17>but they didn't even keep a *registry*
18:08:36<justauser>https://social.coop/@fraggle/117435010901106793
18:09:55<nicolas17>to make a vagrant VM with Fedora, instead of the old "fedora/43-cloud-base" you have to specify https://download.fedoraproject.org/pub/fedora/linux/releases/43/Cloud/x86_64/images/Fedora-Cloud-Base-Vagrant-VirtualBox-43-1.6.x86_64.vagrant.virtualbox.box after digging the web to find it
18:10:40<nicolas17>to make a vagrant VM with Ubuntu, instead of the old "ubuntu/jammy64" you have to find a third-party image because Ubuntu no longer maintains Vagrant images
18:12:20<steering>i don't think this is all that critical on php-fpm honestly
18:12:43<TheTechRobo>steering: Also note that the Sury repo has patched versions all the way down to 5.6 IIRC
18:12:43<TheTechRobo>(the servers I'm running still need 7.4 for some parts unfortunately)
18:13:01<steering>TheTechRobo: that all sounds awful :)
18:13:45<steering>we upgraded from 7.x back in 2022 i think
18:14:09<steering>(whenever we updated to 24.04 :P)
18:14:34<TheTechRobo>steering: yeah... I've hacked most of it to get onto 8.4, but still have some stragglers
18:15:06<steering>there were a few things i had to fix, not too much
18:15:45<steering>err s/24/22/
18:15:46<steering>but yeah
18:15:58steering sees if he can find the commits
18:16:11<nicolas17>TheTechRobo: yeah my problem is the sury repo doesn't have ubuntu focal lol
18:16:15<steering>Date: Fri Mar 24 01:56:13 2023 -0500
18:16:15<steering> more php8 bugfixes
18:17:03<steering>about 90% of it was adding `?? something falsey of the right type` to silence warnings
18:17:41<steering>-if (@count($_SESSION['AllowedPageSecurityTokens']) == 1
18:17:42<steering>+if (count($_SESSION['AllowedPageSecurityTokens'] ?? []) == 1
18:18:27<steering>php--
18:18:27<eggdrop>[karma] 'php' now has -3 karma!
18:19:15<steering>- function htmlMimeMail()
18:19:16<steering>+ function __construct()
18:20:35<TheTechRobo>yeah, old PHP versions had some Questionableâ„¢ syntax
18:22:07<steering>it's fun because our primary codebase was a really poorly written open source thing that my bosses essentially forked about 15 years ago and have never pulled from since
18:22:29<steering>and its got a bunch of ancient bundled dependencies etc which is all quite fun
18:22:39<TheTechRobo>Lovely
18:23:02<justauser>Rdav1986: Same error, and I'm pretty interested in a better window into that data than their web form, which appears to truncate at 50K lines.
18:24:00<justauser>35G compressed is probably feasible to grab and reupload to IA? Perhaps even apply a better compression along the way.
18:25:24<klea>There's new data monthly tho.
18:30:17<justauser>Static copy is better than nothing.
18:30:37<justauser>Project Sonar data used to be public. Now it's not.
18:30:51<justauser>Looks like nobody bothered to make a copy while it was.
18:32:23<klea>hmm, yeah.
18:36:11magmaus3 quits [Remote host closed the connection]
18:37:21sknebel (sknebel) joins
18:38:54magmaus3 (magmaus3) joins
18:39:55doskel (doskel) joins
18:41:50nyakase660 (nyakase) joins
18:43:15nyakase66 quits [Ping timeout: 250 seconds]
18:43:16nyakase660 is now known as nyakase66
18:46:48nyakase666 (nyakase) joins
18:48:59nyakase66 quits [Ping timeout: 265 seconds]
18:49:51nyakase66 (nyakase) joins
18:51:24nyakase666 quits [Ping timeout: 265 seconds]
18:52:21Pendonym quits [Ping timeout: 250 seconds]
18:57:20Pendonym (Pendonym) joins
19:24:57sludge quits [Ping timeout: 256 seconds]
19:25:59sludge joins
19:38:47Shjosan quits [Quit: Am sleepy (-, – )…zzzZZZ]
19:39:57Shjosan (Shjosan) joins
19:45:46Shjosan quits [Client Quit]
19:48:29Shjosan (Shjosan) joins
19:58:29<@imer>https://github.com/php/php-src/issues/24488 "just" a crash from the looks
20:15:04lumidify quits [Quit: leaving]
20:22:44lumidify (lumidify) joins
20:42:57Umbire (Umbire) joins
20:53:15APOLLO03 quits [Ping timeout: 250 seconds]
20:56:35APOLLO03 joins
21:00:12<@JAA>Anyone using GitLab? There's an RCE in that, too. https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-110264---integer-overflow-issue-in-regular-expression-compiler-impacts-gitlab-ceee
21:00:45<steering>ugh, again?
21:01:04<@JAA><ah_shit_here_we_go_again.png>
21:01:09<steering>and they keep moving the 'admin' button so i cant find it
21:01:32<klea>lol.
21:01:42<steering>sigh, yeah, i just updated it
21:01:52<steering>and there was just an arbitrary file read in it last month
21:02:14saveallthejunk_ (saveallthejunk) joins
21:02:41<klea>lovely!
21:05:23saveallthejunk quits [Ping timeout: 250 seconds]
21:23:04HP_Archivist quits [Quit: Leaving]
21:46:15HP_Archivist (HP_Archivist) joins
22:45:34lunik177 quits [Quit: :x]
22:49:29Webuser672442 joins
22:50:54Hackerpcs quits [Remote host closed the connection]
22:51:50Hackerpcs (Hackerpcs) joins
22:56:28etnguyen03 (etnguyen03) joins

HomeSearchPrevious dayNext day