Clojurians Log v2

https://jackalsyn.com/posts/php-up-2026.html

Ah, only 9.2. All good then!

Phew, was worried for a hot second

I once had a wp-config.php file with env vars in it. I used to edit it via SSH + emacs. But... emacs saves unsaved buffers to wp-config.php~ and it turned out it left that garbage behind. This file could then be served via nginx as raw text since .php~ wasn't a php file....

I just saw something that says lots of versions are affected. back 5.X even

eh where

https://cert.europa.eu/publications/security-advisories/2026-018/

These vulnerabilities could affect all PHP versions from PHP 5 onwards

it says could...

maybe a good thing I haven't touched PHP in this century.

I'm not following this closely enough, are the PHP ones related to the TLS thing or are those just two separate issues?

separate I think

The TLS thing is about some CA provider using 4 as their private key for some certs, iiuc.

Oh that one is worse. It's like if we cracked private public key cryptography but it's stupid

It’s being touted as some breakthrough showing that AI will crack cryptography, because someone used AI to find the lack of entropy.

> some CA provider The "some CA provider" is the de-facto PKI provider (certs, digital signatures) etc. for a huge chunk of India's day-to-day economic activity---VAT filings, bank transactions, contract eSignatures, etc. etc. They're as mission-critical as it gets, in economic terms... The head honchos there should be severely punished---and then made to stay on permanently as demoted operators charged with make sure the org does its day-to-day work better---waaaaay better in the future. https://en.wikipedia.org/wiki/EMudhra

only in India 🤷 😉

Well, it seems like the patch didn't work, or there is another high level CVE https://vxtwitter.com/_annieversary/status/2112933589943742598

And a new number!

May the 4 be with you yoda

Kinda worried that we're going to start seeing CVEs for java or the closure compiler, but I'm pretty vindicated by the fact our standard runtimes have been relatively uninvolved with this 0-day bloodbath

https://x.com/FelipeDaragon/status/2113285632889852168 RCE still present after patching lmfao. The absolute state.

Unironic question: PHP interpreter on the JVM?

There was project zero from IBM 15 years ago or so that did attempt that. Part of the problem was that there was language spec I think.

@adityaathalye given the scale of their importance as a CA in India, I can't imagine there wouldn't be some legal blowback from this decision

My cynical interpretation is that nothing will do to them and they got to be a CA to begin with through graft and connections

They're doing one better... Dropping the business entirely---their board decided that. They're a public company, mind you. https://news.ycombinator.com/item?id=50195110 Our IT ministry has "formed a team to probe <the matter>", but Ben know how that goes out here. See the ministry's opening statement. I'd say the graft and coverassery is in full swing. MeitY forms team to probe eMudhra security incident, says impact on Indian websites limited https://www.deccanherald.com/india/meity-forms-team-to-probe-emudhra-security-incident-says-impact-on-indian-websites-limited-4190574 > The incident primarily affected eMudhra’s global certificate business, the ministry said And then we see eMudhra's statement which says PKI is "only 1%" of their business.

They also act all hurt and offended for getting raked over the coal for a COLLOSSAL GENERATIONAL FUCK UP and not apologizing. Also pround of their 14h reaction time.

It's worse man. I'm ashamed to even type any of this... They knew they had fucked up, and did not notify anybody until third parties found out and it got serious airtime. See (Q6) through to (Q12), at comment 30 (by the Chrome team) on Mozilla's bug tracker. https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c30

You know, this doesn't surprise me. Like you said, one you know how it goes on and why, you can pretty much draw the rest of the owl.

Yeah, it's just so so sad... and this sort of conduct is pretty much universal. Given enough lucrative incentive / felt pressure (same thing), any person and/or organisation will behave the same way to grab benefit / save skin (same thing)... Why "same thing", because, collateral damage be damned. You know the old chestnut; "Give a person a gun and they will rob a bank. Give them a bank, and they will rob the world.".

We could cite so many examples, across the world, from recent memory, leave alone over the decades and centuries. But then... • a) This thread will inevitably devolve into flames (other forums are available for that), and • b) Readers and participants of this thread will probably get too sad and dejected for words. Speaking for myself, I feel it is better to know it and acknowledge it, but do better---be better---in a personal capacity, as resolutely as one's capacity to give permits. Ever since I made that an explicit life choice, I've been able to better channel my anger/frustrations constructively, i.e. in a principled, candid, and nonviolent manner, while taking care of myself (which includes having fun! YOLO, after all). Coming back to Clojure itself, I feel the same values reflected in its design and stewardship, furthered by so many community members. Arbitrary breaking changes and non-stop barrages of CVEs begone! So, everlasting gratitude to you all gratitude, and... Illegitimi non carborundum. 🖖 🤓