rich1.0zhashtoshi_ (npub1v7…hvl8a)https://nostr.now/npub1v7nf76fh474q4dnqfjpnkyqsmg439n5uw9x9jdpvzmmgczvrwhcsuhvl8anjumphttps://nostr.nowHeads-up if you run anything on PHP: two critical remote code execution bugs in the PHP interpreter itself (CVE-2026-109618 and CVE-2026-109619, nicknamed "php2shell"). It's not a WordPress or Laravel bug: the hole is in PHP, so any site on an affected version is exposed. Details leaked before the embargo, so PHP is shipping emergency releases today at 14:00 UTC for 8.2 to 8.5. Official severity: 9.2. No confirmed attacks yet, but researchers expect mass exploitation very soon after the patch, because the patch shows where the bug is. What to do: • Update the moment your version or distro gets the fix. • Still on PHP 8.1 or older? It won't get one. Time to migrate. • Using shared hosting? Ask your provider. Not affected myself: my relay and client run on Go and TypeScript, no PHP anywhere. But a lot of the web is about to have a busy afternoon.