https://tube.kockatoo.org/videos/watch/a3205d94-1217-476f-b657-775a687a1f58 You can find all of these videos as written articles, plus some extra content, at https://thelibre.news You can the channel grow by donating to the following platforms: Paypal: https://paypal.me/niccolove Patreon: https://www.patreon.com/niccolove Liberapay: https://liberapay.com/niccolove Ko-Fi: https://ko-fi.com/niccolove Stay in the loop: https://t.me/veggeroblog My website is https://nicco.love and if you want to contact me, my telegram handle is [at] veggero. Links: The Hacker News post that leaked the embargo, "2x PHP RCE CVEs with CVSS 10.0 Incoming" (20 Oct 2026): https://news.ycombinator.com/item?id=50167754 The author's apology, "I unknowingly broke the PHP RCE embargo. I am sorry." (22 Oct 2026): https://news.ycombinator.com/item?id=50193416 The PHP Foundation's post-mortem, "Today's PHP Security Release, and How We're Strengthening PHP Security": https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ PHP's pre-announcement and security advisory: https://www.php.net/archive/2026.php GitHub advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618): https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w GitHub advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619): https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp Calif, "A tale of two PHP remote vulnerabilities": https://calif.io/php2shell/ Wiz Research on PHP2Shell: https://www.wiz.io/blog/php2shell-php-rce NBC News, parts of Wikipedia and other sites taken offline: https://www.nbcnews.com/tech/security/critical-vulnerabilities-php-update-systems-rcna604751 The PHP Foundation, "PHP Core Security Audit Results" (2025): https://thephp.foundation/blog/2025/04/10/php-core-security-audit-results/ Sovereign Tech Agency, PHP: https://www.sovereign.tech/tech/php The Register, "PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk": https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611 Amazon Threat Intelligence on PHP2Shell exploitation attempts: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ Debian DSA-6574-1: https://www.debian.org/security/dsa-6574-1 Ubuntu USN-8948-1: https://ubuntu.com/security/notices/USN-8948-1 AlmaLinux, patching ahead of RHEL: https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/ Red Hat, CVE-2026-109618: https://access.redhat.com/security/cve/cve-2026-109618 CVE List V5 hourly releases (the 1,449 CVEs in one hour): https://github.com/CVEProject/cvelistV5/releases Zero Day Initiative, The October 2026 Security Update Review: https://www.thezdi.com/blog/2026/10/13/the-october-2026-security-update-review Node.js October 2026 security releases: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases StepSecurity, LiteLLM 1.107.0 compromised on PyPI: https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer TechCrunch, "The internet is having a very bad cybersecurity day": https://techcrunch.com/2026/10/21/the-internet-is-having-a-very-bad-cybersecurity-day/ NIST, NVD operations update (April 2026): https://www.nist.gov/news-events/news/2026/04/nist-updates-nvd-operations-address-record-cve-growth My article, "FOSS infrastructure is under attack by AI companies": https://thelibre.news/foss-infrastructure-is-under-attack-by-ai-companies/ Seth Larson, "New era of slop security reports for open source": https://sethmlarson.dev/slop-security-reports Daniel Stenberg, "ignore the slop": https://daniel.haxx.se/blog/2026/10/22/ignore-the-slop/ The Linux kernel's CVE process: https://docs.kernel.org/process/cve.html Google Threat Intelligence Group, vulnerability trends in the AI era: https://cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era Music, "Make Funk" by HoliznaCC0: https://freemusicarchive.org/music/holiznacc0/bassic/make-funk/ Chapters: 0:00 The Hacker News post 1:07 Some brief context 2:04 The bugs in question 3:41 How these bugs were found 6:40 And then there's Chainguard 8:43 Why talk about this on a Linux channel? 10:03 The other half of the title 12:13 Are we doomed? 13:24 What can you do? 14:55 Outtakes Tue, 27 Oct 2026 03:31:24 GMT https://validator.w3.org/feed/docs/rss2.html PeerTube - https://tube.kockatoo.org https://tube.kockatoo.org/lazy-static/avatars/75ca8476-e2c4-4f21-b5a3-a2d70922e464.png https://tube.kockatoo.org/videos/watch/a3205d94-1217-476f-b657-775a687a1f58 All rights reserved, unless otherwise specified in the terms specified at https://tube.kockatoo.org/about and potential licenses granted by each content's rightholder. https://tube.kockatoo.org/w/m9jTGmsoiwVw1hssQTSZPN;threadId=46721 https://tube.kockatoo.org/w/m9jTGmsoiwVw1hssQTSZPN;threadId=46721 Mon, 26 Oct 2026 07:46:13 GMT Just updated my Nextcloud instance! 😄

]]> sbird https://tube.kockatoo.org/w/m9jTGmsoiwVw1hssQTSZPN;threadId=46675 https://tube.kockatoo.org/w/m9jTGmsoiwVw1hssQTSZPN;threadId=46675 Sat, 24 Oct 2026 00:43:44 GMT Thanks for the extra context 👍👍👍

]]> Joel Sutton https://tube.kockatoo.org/w/m9jTGmsoiwVw1hssQTSZPN;threadId=46664 https://tube.kockatoo.org/w/m9jTGmsoiwVw1hssQTSZPN;threadId=46664 Fri, 23 Oct 2026 08:10:47 GMT Wordpress dethrone is inevitable. How can you run the world's most popular CMS in PHP? It's mad!

]]> OceanGate