Bookmark it 📕 50 places to launch your startup:
1. news.ycombinator.com
2. reddit.com
3. producthunt.com
4. news.hada.io
5. whatlaunched.today
6. indiehackers.com
7. betalist.com
8. uneed.best
9. peerlist.io
10. devhunt.org
11. launchingnext.com
12. alternativeto.net
13. saashub.com
14. g2.com
15. capterra.com
16. getapp.com
17. trustradius.com
18. slashdot.org
19. tools.launchllama.co
20. futurepedia.io
21. theresanaiforthat.com
22. toolify.ai
23. futuretools.io
24. confettisaas.com
25. crazyaboutai.com
26. rankanything.online
27. crunchbase.com
28. auraplusplus.com
29. startupbase.io
30. sideprojectors.com
31. microlaunch.net
32. betterlaunch.co
33. foundrlist.com
34. peerpush.net
35. twelve.tools
36. shipybara.com
37. hashnode.com
38. saascity.io
39. 500.tools
40. sourceforge.net
41. aidirectori.es
42. startupfa.me
43. github.com
44. pitchwall.co
45. scrolllaunch.com
46. rankinpublic.xyz
47. tinylaunch.com
48. tinystartups.com
49. nicklaunches.com
50. wellfound.com
Official Statement: flisk.sh on PHP2Shell
22 Oct 2026
flisk.sh does not use PHP. No action needed for our users or infrastructure.
PHP2Shell (CVE-2026-109618 / CVE-2026-109619, CVSS 9.2) is unauthenticated RCE in PHP core (≈5.4–unpatched 8.5). Only complete fix: upgrade to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 and restart workers. Partial mitigations are incomplete. Exploitation reported; many sites taken offline as precaution.
Links:
PHP advisory: php.net/archive/2026.php#202…
Overview: en.wikipedia.org/wiki/PHP2Sh…
Details: research.jfrog.com/post/php2…
Next actions (RACI, starting with least affected)
1. Least affected regions & end users
(Lighter PHP footprint / fewer mass outages vs NL, FI, FR, AT, DK, etc.)
•Informed: Expect temporary downtime.
•Responsible/Accountable: Site operators.
•Action: Tolerate short outages. No personal action needed. Watch for odd redirects/logins.
2. flisk.sh users & non-PHP stacks
•Responsible: You.
•Action: None. Keep using flisk up. flisk.sh/
3. PHP site owners / admins
•Responsible: You or host (inventory, upgrade, restart, verify binary).
•Accountable: Service owner (offline if delayed).
•Action: Upgrade now or take offline. Rotate secrets if exposed. Confirm new version is serving.
4. Hosting providers / sysadmins
•Responsible: Roll out packages, communicate, offer offline option.
•Action: Prioritize internet-facing. Ubuntu: ubuntu.com/blog/php2shell-vu…
5. Organizations / governments / education
•Responsible/Accountable: Leadership for offline vs patch decision.
•Action: Same as #3. Prefer temporary offline for high-value systems until verified.
Summary: Patch or take offline. flisk.sh unaffected. Act if you run PHP.
Brook | flisk.sh retweeted
🚨 THE INTERNET BROKE TODAY 🚨
Oct 21, 2026 will go down in history
1. eMudhra : Private key was literally "4". 8 keys forged ANY website for 17 months. 60M+ certs at risk.
2. SBI CONFIRMED. 3,897 customers' mobile, DOB, address + loan data found on dark web.
3. Rajasthan Police 🇮🇳ALLEGED hack. Group claims 70,000 identity records + 59,460 numbers for sale. Unverified.
4. php2shell [9.2] Unauth RCE in PHP. 70% of the web. WordPress, Drupal, Laravel. CISA: Patch or GO OFFLINE.
5. GitLab [10.0/10] PERFECT SCORE. Unauth RCE, no login needed.
6. Node.js [CVE-2026-111497] Brotli decoder RCE + TLS bypass. 10 CVEs patched today. Also blocked eMudhra.
7. Railway BREACHED TODAY. Env variables decrypted. Your API keys & DB passwords exposed. Rotate all.
8. OpenCode BREACHED. OpenAI, Anthropic, Google API keys exposed for Console users. Distillation attack. Bills run up in $$$$.
9. LiteLLM PyPI v1.107.0 was MALWARE today morning. Steals credentials + backdoor.
10. Plex2Shell ACTIVELY EXPLOITED. Hackers installing cryptominers LIVE. CISA KEV, deadline Oct 23.
AI found the bugs. AI is exploiting them. Humans can't patch fast enough.
Patch. Rotate. Revoke. Update.
RT to save someone's server ♻️
#CyberSecurity #DataBreach #India #php2shell
One underrated way to save AI tokens: don’t make the model write infrastructure.
With Flisk, the model doesn’t need to spend tokens generating and maintaining things like:
•Dockerfiles
•Tiltfiles / Starlark
•nginx configs
•TypeScript configs
•environment files
•service discovery
•networking
•ports and dependencies
•volumes and mounts
•health checks
•local dev orchestration
•generated API clients
•build configuration
•Kubernetes-style deployment glue
All of that infrastructure can live behind TDK’s generated .autogenerated layer.
So instead of asking a model like Astra to reason through hundreds of lines of infrastructure code:
"Create the Docker setup"
"Configure Tilt"
"Wire service A to service B"
"Expose port 8080"
"Add the environment"
"Configure the volume"
"Add the healthcheck"
"Fix the networking"
...
the model can operate at the product level:
flisk up
flisk down
flisk status
The important idea isn't that TDK somehow compresses AI tokens.
It removes an entire category of work from the model's context.
Infrastructure becomes a deterministic capability of the CLI, while the AI spends its context and token budget on the actual application.
For models with limited or expensive weekly usage, that difference can be huge.
Less infrastructure generation → less token consumption → more tokens available for building.
Brook | flisk.sh retweeted
🚨🌍💥 INTERNET EN ALERTE ROUGE : UNE CRISE INFORMATIQUE MONDIALE FRAPPE LA PLANÈTE ! 🔥
⚠️ GOUVERNEMENTS, HÔPITAUX, UNIVERSITÉS, SERVICES ÉLECTORAUX… DES SITES MAJEURS SONT DÉJÀ MIS HORS LIGNE !
😱 Et ce n'est peut-être que le début !
💥 QUE SE PASSE-T-IL ?
Ce 21 octobre 2026, deux failles informatiques CRITIQUES, notées 9,2/10, ont été révélées dans PHP, une technologie qui fait fonctionner près de 70 % des sites Internet dont le langage serveur est identifié !
Ces vulnérabilités peuvent permettre à des pirates de prendre le contrôle de serveurs à distance, sans même connaître les mots de passe !
🌍🔥 LES INTERRUPTIONS DE SERVICE SE MULTIPLIENT DANS LE MONDE !
Voici quelques exemples déjà signalés :
🇺🇸 ÉTATS-UNIS — MÊME LES SERVICES ÉLECTORAUX SONT TOUCHÉS !
🚨 FLORIDE : la société VR Systems a suspendu des services électoraux en ligne !
🚨 Dans plusieurs comtés, dont Sarasota, Jefferson et Bay, des électeurs ne peuvent temporairement plus consulter certains renseignements électoraux, leurs bureaux de vote ou leurs bulletins modèles !
⚠️ Et cela en pleine période de vote anticipé pour les élections américaines du 3 novembre ! Le vote lui-même continue normalement.
🇫🇷 FRANCE
🚨 Sites de préfectures et services gouvernementaux suspendus !
🇳🇱 PAYS-BAS
🚨 DigiD : système national d'identification numérique !
🚨 MijnOverheid : portail des démarches administratives !
🚨 Overheid. nl : portail gouvernemental !
🚨 Port de Rotterdam !
🚨 KNVB : Fédération néerlandaise de football !
🚨 Plusieurs sites hospitaliers et de partis politiques !
🇩🇪 ALLEMAGNE
🚨 Plusieurs sites gouvernementaux fédéraux suspendus par ITZBund !
🇧🇪 BELGIQUE
🚨 Sites du ministère des Affaires étrangères temporairement suspendus !
🇫🇮 FINLANDE
🚨 Services web gouvernementaux opérés par Valtori interrompus !
🇨🇿 RÉPUBLIQUE TCHÈQUE
🚨 Site officiel du gouvernement mis hors ligne !
🇨🇭 SUISSE
🚨 Université de Bâle : plateforme pédagogique ADAM et plusieurs services numériques suspendus !
🌐 WIKIPÉDIA / WIKIMEDIA
🚨 Plusieurs services techniques de la Wikimedia Foundation mis hors ligne par précaution !
💥 ET LES ATTAQUES ONT DÉJÀ COMMENCÉ !
Cloudflare confirme avoir détecté des tentatives d'exploitation de ces vulnérabilités !
Des correctifs ont été publiés en urgence, mais de nombreuses installations anciennes restent difficiles à sécuriser.
⚠️ IMPORTANT : les interruptions recensées sont principalement des FERMETURES PRÉVENTIVES. Elles ne signifient pas que tous ces organismes ont été piratés !
🔥 DES MILLIONS DE SYSTÈMES POTENTIELLEMENT EXPOSÉS !
Des administrations suspendent leurs services, des hébergeurs sécurisent leurs infrastructures et les équipes informatiques travaillent dans l'urgence !
🌍 UNE VÉRITABLE COURSE CONTRE LA MONTRE EST ENGAGÉE À L'ÉCHELLE PLANÉTAIRE !
Et la grande question demeure :
💥 COMBIEN D'AUTRES SITES ET SERVICES DEVRONT ÊTRE SUSPENDUS AVANT QUE CETTE CRISE SOIT MAÎTRISÉE ?
🔁 PARTAGEZ MASSIVEMENT ! Cette crise informatique peut concerner les services que nous utilisons tous les jours !
Sources : Reuters, PHP. net, CERT-FR, gouvernement néerlandais, Wikimedia Foundation, Suncoast Searchlight et autorités électorales de Floride.
👇💥 VOUS NE SAVEZ PAS CE QU'EST PHP NI POURQUOI CES FAILLES SONT AUSSI DANGEREUSES ?
🚨 LISEZ MON EXPLICATION DÉTAILLÉE DANS LES COMMENTAIRES ! ⬇️🔥
October has been an absolute nightmare for software
> Railway - customer secrets exposure
> LiteLLM - malicious PyPI + Docker releases
> Zeabur - infrastructure breached
> OpenCode - AI API keys exposed
> OVHcloud CLI - official binaries backdoored
> Rank Math PRO - malware in official plugin
> TeamUpdraft - customer data compromised
> ConnectWise - cloud backup identities compromised
> Tensorlake - npm package infected
> SubQuery - backdoored npm package
> GhostAction - GitHub repos with malicious workflows
> PHP - critical RCE vulnerabilities
> Node.js - security vulnerabilities patched
> eMudhra - certificate authority keys compromised
> Tailscale - eMudhra incident
At this point, the biggest security risk might not be the code we write, but the code we trust...
Who went dark for PHP2Shell
thats the full list affected PHP
Directed by Robert B. Weide
dev.to/flisk/series/45487
Who went dark for PHP2Shell
thats the full list affected PHP
Directed by Robert B. Weide
dev.to/flisk/series/45487
Can someone explain the PHP vulnerability to me like I'm a 6-year-old?
Should I be worried or just avoid PHP developers for the next 48 hours?
Who went dark for PHP2Shell
thats the full list affected PHP
Directed by Robert B. Weide
dev.to/flisk/series/45487
Brook | flisk.sh retweeted
As if PHP2Shell wasn't enough for one day... now GitLab. 😅
🚨 CRITICAL GITLAB ALERT (CVSS 10.0)
CVE-2026-110264 could allow unauthenticated RCE on self-managed GitLab servers.
⚠️ Potentially affects 12 years of releases, dating back to 2014.
Patches available. Update immediately!
docs.gitlab.com/releases/pat…
#gitlab #cybersecurity
Brook | flisk.sh retweeted
a gym in sf had to ban vibe coding during sets
we have officially reached a sentence that could only exist in 2026
Brook | flisk.sh retweeted
🚨 ONE PHP LEAK HIT 5 COUNTRIES AND THE EU IN ONE DAY. HERE'S WHAT HAPPENED TO EACH:
🇯🇵 Japan — Uma Musume and Shadowverse games DOWN for emergency maintenance before the 23:00 patch
🇯🇵 Japan — BASE online shops, Sakura and X Server hosting all in EMERGENCY maintenance
🇯🇵 Japan — Codmon, the nursery app, SUSPENDED for emergency maintenance
🇯🇵 Japan — national cyber office demanded action "as quickly as possible"
🇯🇵 Japan — Tokyo police cyber unit WARNED every PHP site to be ready for the 23:00 fix
🇺🇸 USA — Cloudflare CTO: "We are seeing early attacks emerging"
🇺🇸 USA — Cloudflare: MASSIVE stopgap firewall rollout, free customers included
🇺🇸 USA — EVERY WordPress site exposed (the LARGEST site builder in the entire world, 40%+ of the internet)
🇺🇸 USA — the fix CAN'T install by automatic update (Wordfence)
🇪🇺 EU — CERT-EU: if you can't patch, CUT apps off public networks
🇬🇧 UK — NCSC gave the same advice: patch or go OFFLINE
🇦🇺 Australia — ASD ALERT: "prepare to update and apply patches"
🇵🇱 Poland — CERT Polska: ALL versions from PHP 5.0 up
AFTERMATH:
2 critical flaws leaked before the fix, CVSS 9.2 out of 10 on both
Every PHP site at risk (69.3% of websites run on PHP)
1,300,000+ internet-exposed hosts likely vulnerable
Games, shops and hosting suspended across Japan in ONE DAY
Mass attacks expected within 15 minutes of the patch
One Hacker News post triggered this a day before the fix.
The leak made sure everyone around PHP paid the price.
This is not a one-country crisis.
This is the beginning of something much bigger.
Brook | flisk.sh retweeted
⚠️ Vulnerability alert: php2shell
Unpatched sites running PHP 5.4 or later are at risk of remote code execution, data exposure, and crashes.
If your site’s web traffic is proxied through Cloudflare, we deployed protections before official public disclosure. Check the blog post to see which mitigations are enabled by default.
Even with these mitigations in place, update PHP as soon as possible to fix the underlying vulnerabilities.
xitter.cf/Cloudflare/status/2112…
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers. cfl.re/488w8dc
Brook | flisk.sh retweeted
皆様に、今夜に対応して頂きたい大至急のお願いです。
多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。
公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。
修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。
国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。
国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X
Brook | flisk.sh retweeted
Vercel has proactively rolled out Firewall-level mitigations for today's Node.js RCE vulnerability, in advance of the official patch release.
All traffic for all deployments is automatically protected. We're actively monitoring and rolling out managed runtime upgrades.
Node.js Security Advisory: a high-severity RCE flaw in Node's Brotli decoder affects Node.js 22, 24, and 26.
Vercel WAF rules are live for every project and block known exploit patterns.
vercel.com/kb/bulletin/node-…
Brook | flisk.sh retweeted
Not just PHP. Node.js has also announced security releases for October 21, with HIGH-severity vulnerabilities affecting its 26.x, 24.x and 22.x release lines.
If you run either stack in production, keep an eye on official advisories and apply patches promptly.
Security maintenance doesn't stop at your application code. Your runtime matters too.
Node.js advisory: nodejs.org/en/blog/vulnerabi…
Brook | flisk.sh retweeted
🔐 Node.js security updates are now available!
New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues.
Review the details and update your systems to stay secure.
🔗 nodejs.org/en/blog/vulnerabi…
#NodeJS #Security