Tootfinder

Java was getting jealous of all the attention PHP was getting lately...
#PHP

🛡️ #Composer 2.11 is out. The headline feature is a cooldown dependency policy: newly published package versions are withheld for a configurable period before Composer installs them.
#PHP #supplychain

Ok #php people, I need your input :)
What's the best practice for running Composer audit in CI? We used to run it for every merge request, but that no longer scales given how often packages are updated due to security issues. Everything is now red and requires a lot of manual intervention to get the builds green again.
Should we run the audit command once per day, or what is recommended?…

I might be the last one, but in case I am not. There is a seemingly disastrous #security issue in all current #PHP versions. Remote code execution.
https://…

PHP: News Archive - 2026
PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

Using #PHP arrays as pseudo-objects is almost never the right answer. They're less self-documenting, slower, worse on memory, and more bug prone.
https://www.garfieldtech.com/blog/php-list-ben…

PHP: Use associative arrays basically never
The other day I was working on some sample code to test out an idea that involved an object with an internal nested array. This is a pretty common pattern in PHP: You have some simple one-off internal data structure so you make an informal struct using PHP associative arrays. Maybe you document it in a docblock, or maybe you're a lazy jerk and you don't. (Fight me!) But really, who bothers with defining a class for something that simple? But that got me wondering, is that common pattern r…

#PHP #Java

> ls /nix/store/*-php*
ls: cannot access '/nix/store/*-php*': No such file or directory
Luckily I don't seem to run anything even remotely related to #PHP, so I apparently dodged that bullet. 😌
#nixos

onhandig dat veel docker containers hun php versie nog niet hebben bijgewerkt. nextcloud gelukkig wel #php #php2shell

I converted my first large php application (crud app over mysql) to a static site (Jekyll) a few years ago, so I'm not in the trenches with everyone today.
But I'm right there with you.
Gosh this sucks.
#hugops #php

UGH.
So someone internally raised the fact "hey, we have #PHP on <one of our devices>" and so technically one of our products is affected and now I have EVERY exec LOSING THEIR SHIT and asking for status updates every 30 minutes im like hold the crap on, I'm still doing the technical assessment, and they're like "Copilot said to do this" or "Claude suggested&quo…

Last week it was #PHP, this week we start with some nice #Java patch day it seems...
https://nvd.nist.gov/vuln/detail/cve-2

Ich bin ja wirklich kein Experte, aber jetzt bei jedem Critical Bug, sei es Linux Kernel oder PHP die Server abzustellen, kann ja jetzt nicht ernsthaft Zukunft haben. Zumal, wenn die Details erst mit dem Patch veröffentlicht werden. Ich meine, dass unbekannte Lücken eh ständig ausgenutzt werden, ist ja auch klar.
Zumindest könnte man ja auch IP-Ranges oer VPN einschränken, aber peng weg? Oder bin ich naiv? 🤔

We decided to switch off some #Nextcloud and Web servers at @… and at some customers due to a severe #php vulnerability

PHP2Shell - Wikipedia

#Docker Hub is alive… #PHP #PHP2shell

One take away from #unKonf:
#PHP developers are pretty smart and very nice actually :)

#php und anderes

Half my feed right now is German. My client is configured to only show me English.
Which means either Mastodon's language handling is broken, or a whole crapload of Germans don't know how to set the language for their posts.
#Mastodon #PHP

After patching #PHP yesterday, you need to patch your #Node instances as well...
https://nodejs.org/en/blog/vulnerabil…

Node.js — Wednesday, October 21, 2026 Security Releases
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

PHP update
#php

Wenig überraschend für meine Vorurteile sind viele Containerdinger noch nicht gepatched, während die meisten "echten" Distributionen Updates bereitstellen. #PHP2shell #php

Today is a good day to poke your management to join the Open Source Pledge:
#PHP #Node

Open Source Pledge
Open Source software powers the world, but who supports the maintainers? We do.

For those of you that use WP Engine for hosting, they’ve patched PHP across all of their environments. I’m really happy with the speed of their response.
#wpengine #php #cybersecurity

This doesn't add up. According to a UK government spokesperson:
"NCSC was able to make 50,000 proactive notifications [before public disclosure] to advise business and other organisations on what actions they should take" regarding the #PHP debacle.
But I am yet to hear of a single PHP-using site, either in the UK or elsewhere in the world, that hasn't been completely caught on the hop by this.
#php2shell

It's a "I need a drink" kind of day
#php #CVE #SecOps #docker

Dear Peeps: does the #PHP #security breaches affect Wordpress sites in particular ?

Vandaag:
'Even opzoeken'
Ojaaa.. 🙈🙈
#php

Die gute Nachricht: Auch wenn das halbe Internet heute im Wartungsmodus ist, fahren die Züge weiterhin zuverlässig zu spät. #PHP

My first reaction to #php2shell was: “Dang, that’s the thing with running your own VPS – you have to keep everything up to date yourself…”
But: my own site is already running on #PHP 8.4.27. ✅

🧹 #LaravelFmt is a code formatter for #Laravel, written in #golang. It formats #PHP, Blade and…

Wherein I have a bad attitude about #PHP2Shell on international news.
“Rogue AI” is mostly a marketing line. When an AI company says it built something too powerful to control, what it’s actually telling you is that it skipped the security controls.
Your dentist should not have to be a PHP security expert. Companies that kept selling sites built with memory-unsafe apps to small businesses without explaining the risk own this mess.
On https://www.youtube.com/watch?v=3EB16ZFkRhw
@…

Volgens mij hebben we vandaag een #offday .
#php

RE: #PHP Groundhog Day!

My first reaction to #php2shell was: “Dang, that’s the thing with running your own VPS – you have to keep everything up to date yourself…”
But: my own site is already running on #PHP 8.4.27. ✅

RE: #PHP Groundhog Day!

The issue affects PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. Update as soon as your distro or repo has the packages. On shared hosting, you might ask your host whether they’ve patched already. #CyberSecurity #infosec #php
https://www.php.net/archive/2026.php#2026-10-21-5

The issue affects PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. Update as soon as your distro or repo has the packages. On shared hosting, you might ask your host whether they’ve patched already. #CyberSecurity #infosec #php
https://www.php.net/archive/2026.php#2026-10-21-5