bcvvvy

182 karma · joined October 18, 2026

bcvvvy··on Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure

That's pretty awful. I do wonder if they've bitten off more than they can chew with all the ancillary stuff to their core IaaS platform. That seems to be the only well maintained bit of their estate, well EC2/VPC/S3/R53 etc.

bcvvvy··on Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure

Every vendor is winging it there. Even RHEL. Ubuntu ships shit half the time as well even on LTS.

If you need to test it you should pin packages.

bcvvvy··on Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure

Nearly every other vendor has pushed fixes for it, including where they pull their upstream stuff from. There's no excuse.

bcvvvy··on Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure

Why haven’t they fixed Amazon Linux then?

Same as none of their AMIs for bottlerocket have emSign revocations.

Absolutely shit company who puts their customers at risk.

bcvvvy··on Anthropic's Public Benefit Charter

I think it would be a public benefit if they stopped aggregating all their accumulated debt on the public.

bcvvvy··on Today's PHP security release, and how we're strengthening security

Any idiot can create their own company. For example, I have one :)

bcvvvy··on Today's PHP security release, and how we're strengthening security

https://x.com/k_firsov/status/2112641845926989944

Song is Petite Meller - High Forever (Marlon Hoffstadt Remix). Which is annoyingly catchy

bcvvvy··on Dutch National Cyber Security Center is Offline because it uses PHP

Also a WAF isn't magical. I remember the whole 8KiB AWS WAF bypass thing.

bcvvvy··on Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

Fuck this week.

bcvvvy··on Patch the Planet: global response coordination as agents uncover vulnerabilities

Ergo, leave your data at home.

bcvvvy··on Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds

I suspect they did but it wasn't publicised.

bcvvvy··on Muse exposes users' personal and business secrets when they share conversations

Yeah doesn’t look good.

To be fair agentic platforms are a shitty idea from a security perspective anyway. Everyone just threw that out of the window because shiny. Their funeral.

bcvvvy··on Getting Banned from r/java

I'd argue that in a commercial setting, the measurable deliverable is ROI impact.

And that doesn't always come from building more software. That's where the craft is. AI just helps you build more software.

bcvvvy··on Google Cloud outage affects almost all banking and other operations in Europe

I bank with HSBC. Everything is up and working.

A lot of the information people are leveraging here comes from Downdetector which is mostly users reporting that stuff is down, not whether they are actually down. It's a really bad source.

bcvvvy··on There is no official XScreenSaver GitHub repository

Using a public source code hosting product is a choice.

Also centralising everything in one place is a seriously bad idea.

bcvvvy··on There is no official XScreenSaver GitHub repository

GitHub is not authoritative and never should be considered as authoritative. Anyone can publish your stuff on there as your name.

It’s a huge problem. Glad to see he’s at least put a placeholder on there.

bcvvvy··on OpenBSD 8.0

I’ve used it on and off since about 1999. It certainly feels more like Unix than anything else.

← PreviousPage 3 of 3