yreg

So what portion of the unpatched servers is pwned now? What's your guess?

Where do you get the two hours from? Did this attacker spend two hours on it, after 17 hours of others failing to break in?

> The fact that people are still in denial over this is crazy.

Maybe you misunderstand what I say.

Imagine the tens of millions of personal or small business websites running php. What's your guess, what portion of the unpatched ones is already pwned? Is it 1%? 5%? 15%? 50%? 95%?

What would you guess?

I believe this managed to prove something.

Namely that the vulnerability was not that easy to exploit, meaning that the myriads of servers that stayed unpatched during those initial days are probably not all members of botnets now. (Contrary to what the discourse might have made it seem like.)

Until they can match Falcon 9 launch costs (the internal ones, not what SpaceX sells it for) it will be very difficult to compete with Starlink.

Immich is fantastic.

I think you are dramatizing it a bit. Woz says he found out about it from Walter Isaacson's book.

https://youtube.com/shorts/MpuPbQ8TY-I

> Apple can easily detect the jailbreak and lock me out

Does this actually happen? They did not do that in the good old days.

I do know that some apps try to detect jailbreaks and annoyingly refuse to let people log in. Banking and such.

You could say that there is no reason to report them at all, because the maintainers can point llms to the kernel themselves.

I've attended RuneScape weddings.

The article should be easy to refute (if it is wrong).

Chainguard broke the embargo being convinced they have the evidence of this being widely exploited already yesterday. Where is it?

Japan Post has something that's halfway, but not fully there.

You can register to reroute address A to address B, give out the address A to e-shops and then the post will deliver the packages to address B, which stays private. The catch is that address A needs to also be yours, it cannot be something arbitrary.

At least AFAIK.

This is ad hominem with a side of strawman. Attack the argument they've made instead.

*3GS

I was thinking about this as well today. And while I'm sure there are many cybersec companies that send out alerts, I trust this forum the most.

Maybe it would be worth it to have an agent that knows your stack, reads the top threads on hn all day long and messages you when it thinks there is something serious going on that could impact you.

Complex socio-economic problems usually lack fast, simple solutions.

SomethingAwful too

These 'immature children' have discovered the exploit, so good luck keeping it under wraps from themselves.

They (is it the CEO?) commented on it earlier here: https://news.ycombinator.com/item?id=50176735

In their place I would worry that this was the last time anyone shared an embargoed build with them.

> chainguard

They comment on it here: https://news.ycombinator.com/item?id=50176735

This is not the dancing anime girl video, is it?

You might disagree with them, but I am pretty sure the php maintainers are acting in good faith.

Is there any major service that has gone offline? Why is Wikipedia still up, did they manage to mitigate? What about Etsy?

WP sites like whitehouse.gov, TechCrunch, Time?

I don't see anything well known being down.

Yes, obviously. Another article on the same news but readable without registration.

It's a good idea to have multiple debit cards (both visa and mastercard) from different banks. You can often get them for free.

Article without wall: https://www.euronews.com/2026/10/20/hackers-steal-421000-ema...

Yep, and I'm saying that those four years ago (or whatever time it was) I was convinced that it is against this specific App Store guideline, but alas Apple has approved it.

> You're gonna vibe code a clone of hardware?

In this case maybe actually yes; LLM might be able to create a model of this rather simple product for 3d printing.

> In retrospect though, this also has the side effect of aiding someone with bad intentions to track someone that wouldn’t get phone notifications.

This is stupid, they knew exactly what they were doing and now they pretend that it has never crossed their minds.

And I'm saying this as someone who has a muted AirTag for theft protection.

My experience is the same as GP's. Any time I joined a private tracker I was eventually kicked for not enough activity or low seed ratio. I tried to seed the stuff I downloaded, but usually no one seemed to want to leech from me.

I've always felt that YouTube is also breaking this rule by making background playback a Premium feature.