π Happy Hacktober everyone π
Paul Dragoonis
@dr4goonis
π΄σ §σ ’σ ³σ £σ ΄σ Ώ Principal Engineer / CTO | Open Source Leader | Public Speaker |
I'm part of @official_php, @phpfig, @dagger_io, @jenkinsci, @CDeliveryFdn
I'm part of @official_php, @phpfig, @dagger_io, @jenkinsci, @CDeliveryFdn
2.8K Following 4.8K Followers 12K Posts
Latest posts 5
Yesterday, emergency patches for 4x #Node.js, 2x #PHP vulnerabilities were released, and last week there were 3x for #Nginx.
High - Node.js
- CVE-2026-111497 (Brotli decoder out-of-bounds write)
- CVE-2026-105482 (DNS truncation bug)
- CVE-2026-105483 (TLS certificate hostname bypass via full-width digits)
- CVE-2026-106069 (TLS certificate hostname bypass via loose resolution)
Critical - PHP
- CVE-2026-109619 (Stale Global State Use-After-Free)
- CVE-2026-109618 (Out-of-Memory Heap Corruption)
Critical - NGINX
- CVE-2026-15176 (Alias-Rewrite Heap Overflow)
- CVE-2026-93479 (Map-Regex Heap Overflow)
- CVE-2026-97205 (SSI-AIO Use-After-Free)
Immediately upgrade to
- Node.js - 22.23.4, 24.22.1, or 26.12.1
- PHP - 8.2.35, 8.3.36, 8.4.27, or 8.5.12
- NGINX - 1.30.6 or 1.31.8
#cybersecurity #php2shell
High - Node.js
- CVE-2026-111497 (Brotli decoder out-of-bounds write)
- CVE-2026-105482 (DNS truncation bug)
- CVE-2026-105483 (TLS certificate hostname bypass via full-width digits)
- CVE-2026-106069 (TLS certificate hostname bypass via loose resolution)
Critical - PHP
- CVE-2026-109619 (Stale Global State Use-After-Free)
- CVE-2026-109618 (Out-of-Memory Heap Corruption)
Critical - NGINX
- CVE-2026-15176 (Alias-Rewrite Heap Overflow)
- CVE-2026-93479 (Map-Regex Heap Overflow)
- CVE-2026-97205 (SSI-AIO Use-After-Free)
Immediately upgrade to
- Node.js - 22.23.4, 24.22.1, or 26.12.1
- PHP - 8.2.35, 8.3.36, 8.4.27, or 8.5.12
- NGINX - 1.30.6 or 1.31.8
#cybersecurity #php2shell
π₯
elephc v0.27.4 is out, with ~20 performance wins and a native test runner πView quoted post on X
β’ `elephc test`: run your tests natively
β’ Full BCMath, BcMath\Number included
β’ PHP 8.5 classes & constants complete
β’ Tail recursion compiled to loops
β’ FFI: explicit C int widths + f32 (breaking)
β’ Notarized macOS binaries
github.com/illegalstudio/β¦
A β on the repo would be much appreciated!
Star this
elephc 0.27.3 is out πView quoted post on X
New: `elephc repl`, an interactive PHP session. Variables, functions, classes and constants persist across lines.
Native generics now work in eval() and in the REPL too.
Also: preg_match_all() with all flags, a smarter optimizer, and 137 commits since 0.27.2.
A β would be much appreciated:
github.com/illegalstudio/β¦
@VotrubaT You made a Rector ruleset for 8.6 upgrade for renaming or tweaking DEPRECATIONS?
php-net.pro/en/php-8.6#depβ¦
php-net.pro/en/php-8.6#depβ¦
