‼️ BREAKING ‼️ PHP warns of another UNPATCHED REC vulnerability just 2 days after releasing emergency patches for critical PHP2Shell flaws. New "CVE-2026-115560" affects only unusual session configurations. PHP has issued urgent mitigation guidance. Full details → thehackernews.com/2026/10/ur…

Mike Morasky, a developer from Valve, directly mentioned HLX (rumored to be Half-Life 3) during his Q&A session.

THE SWITCH 2 HAS BEEN JAILBROKEN BY AI 🚨 pepsipu just released ns2jb, the first known jailbreak for the Switch 2. It's software-only and works on the latest firmware, 23.0.1. The craziest part is that Codex did most of the hacking. He hooked both Switches up so the AI could send controller inputs, watch the screen, and even press the power button with an Amazon smart light switch whenever the console crashed. His prompt was literally "set a goal to jailbreak the switch 2. make no mistakes". The way in was a bug in SmileBASIC, a Switch 1 game, which it then chained into Nintendo's own file system service.

🚨 BREAKING: Node.js just dropped its OWN security bombshell. 4 HIGH-SEVERITY vulnerabilities patched TODAY, including one that could let hackers remotely execute malicious code on vulnerable servers. → 10 SECURITY FLAWS were addressed in today's Node.js release, FOUR rated HIGH severity. → REMOTE CODE EXECUTION: CVE-2026-111497 is a serious flaw in Node.js's Brotli decoder that could allow attackers to execute malicious code remotely. → TLS SECURITY BYPASS: Two separate vulnerabilities could trick affected applications into accepting certificates for the WRONG server under certain conditions. → Think about that. Your application could establish an encrypted connection while failing to properly verify WHO it's talking to. → THREE MAJOR NODE.JS VERSIONS AFFECTED: Node.js 22, 24 and 26 all required emergency security updates. → RUNNING NODE.JS 18 OR 20? Those versions are END-OF-LIFE and aren't receiving these official security patches. → PATCH IMMEDIATELY: Update to Node.js 22.23.4, 24.22.1 or 26.12.1, depending on your release line. If you're using Docker, rebuild and redeploy your containers. PHP AND Node.js both facing major security disclosures on the SAME DAY. If you run a website or application, TODAY is the day to check your servers. And remember: the public release of security patches can give attackers a roadmap to systems that haven't updated. Don't be the last one to patch.

One-click mitigation for php2shell vulnerability: If you have Cloudflare in front of your PHP website, please login to the dashboard and click this button to make sure you are protected. dash.cloudflare.com/?to=/:ac… This reduces your risk but doesn't fix the vulnerabilities in PHP. We recommend updating PHP to a patched version.

Already seeing these in the logs: User-Agent: php2shell-109619 Content-Type: multipart/form-data; boundary=B7kQpoc619 User-Agent: php2shell-109618 multipart/form-data; boundary=B7kQpoc618

Teamwork makes the dream work. The team and I @J4ck3LSyN @Archknight23 🚨 Heads-up for anyone running PHP: two critical RCE bugs, patch drops tomorrow. The PHP project has confirmed an emergency security release for two critical remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. 📅 Patch lands Wednesday, Oct 21 at 14:00 UTC (9:00 AM Central). PHP has reserved the right to ship it earlier if details leak or exploitation shows up. PHP runs about 75% of the web, including WordPress, Drupal, Joomla, Laravel, Magento, and countless custom apps. If you operate a PHP server, this is your weekend-ruiner unless you act. Here's the part the big threat-intel shops aren't shouting about: No official technical details are public yet. But based on my own source-code analysis of php-src, my best assessment (moderate confidence, NOT officially confirmed) is that the vulnerable path is PHP's session.upload_progress / multipart form-data (rfc1867) handling: 🔹 Present since PHP 5.4 🔹 Enabled by default (the compiled-in default is On; the sample php.ini ships it commented out, so stock installs have it live) 🔹 Processes uploaded request data before any of your application code runs, so it's reachable pre-authentication on a default config That lines up exactly with the public breadcrumbs: "affects default installs," "every version since 5.x," "fires before user code." Treat it as a working hypothesis, not gospel. The official advisory supersedes all of this when it lands. ✅ What to do right now: 1. Inventory your PHP. Know every host and version (php -v). Anything on PHP 7.x or older won't get a fix, so plan to upgrade. 2. Apply the stopgap (best-intel, low-risk, reversible). In php.ini / .user.ini / .htaccess: session.upload_progress.enabled = Off Reload PHP-FPM or your web server. My analysis says this closes one of the two likely paths. 3. Clamp multipart uploads at the edge. The second likely path lives in the multipart parser itself, which runs for any multipart/form-data POST regardless of the setting above. If you've got a WAF or reverse proxy, tighten inspection or rate-limit multipart POSTs to endpoints that don't need uploads. This is the same network-layer mitigation the enterprise vendors are quietly deploying for their paying customers. 4. Patch the second it drops. Current stable: 8.5.11 / 8.4.26 / 8.3.35 / 8.2.34. If your hosting is managed, confirm your provider's timeline today. Why I'm posting this for free: A pre-patch mitigation shouldn't be a subscription perk. I'm a one man shop, and the orgs most likely to get burned in the gap between leak and patch are the small teams without an enterprise threat intel contract. The steps above cost nothing. Spend tonight reducing risk, not tomorrow doing incident response. I'll follow up once the official advisory publishes and confirm whether my root cause read was right. Stay patched. 🔒 #PHP #CyberSecurity #InfoSec #RCE #CVE #WordPress #Laravel #ThreatIntel #VulnerabilityManagement #AppSec

El SEO/GEO es increible le arme una pagina a un amigo y ahora no le paran de llegar consultas xq aparece en chatgpt

Okay, since the news is already out: an RCE vulnerability in PHP core, CVSS 10.0. Further details are scheduled for release on October 20. Only PHP 8 will receive patches.

jumped on the whole tv 'hacking' trend super minimal and done in @rive_app because why not

Vercel CEO Guillermo Rauch (@rauchg) says the old work week is officially dead: “You would think, ‘AI has arrived, & we're all working 2 hours a week.’” “The opposite is happening. I get text messages at midnight from the CEOs and CTOs of these companies.” “It’s more like 7/7/7: 7 days a week from 7 AM to 7 PM.”

Watch the Grand Theft Auto VI Launch Trailer, featuring the debut of “Flower in a Hurricane" from original score composers Justice feat. Tame Impala, SZA, and King Gizzard & The Lizard Wizard. Grand Theft Auto VI arrives November 19: rockstargames.com/VI/ps5

holy shit

No he actually did find a new planet LOL

This is the doom I predicted a few days ago, coming for Photoshop. A clean-room open-source reimplementation. No prizes for guessing that they decompiled Photoshop to source code, processed that to some kind of non-code specification language, then fed the spec to an LLM with an instruction to generate Rust. Adobe just got nuked. And closed source is dead, dead, dead. github.com/storytold/photocr…