<![CDATA[something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all.]]>something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all.

this feels like a major feature upgrade.

which is weird in the circumstances.

the kind of patch that you would expect to see during a major all hands on deck kind of emergency would be the smallest, least-touch change possible - Rain suggested "abort on OOM" which is a nice sensible solution; sure it hits availability a little but in a way that synergizes nicely with defender goals (denying materiel to an attacker; reducing blast radius to "an instance becomes momentarily unavailable until the service gets restarted")

instead, this has a massive rework of how OOM situations are handled, with a completely new error handling mechanism added and -backported- to other prior versions?

that doesn't smell right at all.

and now a massive patch drops that MUST BE APPLIED NOW - so, intense pressure to comply without careful evaluation?

call me paranoid, sure. but this doesn't fit what I expect to see, and I don't like it, and I am feeling very suspicious that the people making these decisions are having their decisionmaking compromised in some fashion.

]]>https://forum.fedi.dk/topic/784e0012-c8ee-43ea-8ad6-2d394cf992c9/something-that-s-been-bothering-me-about-the-phpocalypse-which-talking-with-@rain-i-was-able-to-put-a-pin-in-after-they-pointed-out-what-they-would-do-in-a-similar-situation-is-that-this-doesn-t-feel-like-a-security-patch-at-all.RSS for NodeFri, 23 Oct 2026 04:58:36 GMTThu, 22 Oct 2026 01:56:54 GMT60<![CDATA[Reply to something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all. on Thu, 22 Oct 2026 07:01:16 GMT]]>@jernej__s

Yeah, I saw that. Not sure how to reconcile that with how long it took.

@munin @pikhq

]]>https://forum.fedi.dk/post/https://mastodon.sdf.org/users/argv_minus_one/statuses/117483272732173366https://forum.fedi.dk/post/https://mastodon.sdf.org/users/argv_minus_one/statuses/117483272732173366Thu, 22 Oct 2026 07:01:16 GMT<![CDATA[Reply to something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all. on Thu, 22 Oct 2026 06:41:30 GMT]]>@argv_minus_one @munin @pikhq See https://chitter.xyz/@JennyFluff/117481147340068318

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/jernej__s/statuses/117483194978509773https://forum.fedi.dk/post/https://infosec.exchange/users/jernej__s/statuses/117483194978509773Thu, 22 Oct 2026 06:41:30 GMT<![CDATA[Reply to something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all. on Thu, 22 Oct 2026 06:19:43 GMT]]>@munin

No, although I've heard the rumors.

But like, it doesn't take 2 months for a bot to generate something.

@pikhq

]]>https://forum.fedi.dk/post/https://mastodon.sdf.org/users/argv_minus_one/statuses/117483109303905683https://forum.fedi.dk/post/https://mastodon.sdf.org/users/argv_minus_one/statuses/117483109303905683Thu, 22 Oct 2026 06:19:43 GMT<![CDATA[Reply to something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all. on Thu, 22 Oct 2026 05:59:40 GMT]]>@argv_minus_one @pikhq

have you seen the size of the thing?

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/munin/statuses/117483030503848382https://forum.fedi.dk/post/https://infosec.exchange/users/munin/statuses/117483030503848382Thu, 22 Oct 2026 05:59:40 GMT<![CDATA[Reply to something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all. on Thu, 22 Oct 2026 05:33:53 GMT]]>@munin @rain abort on OOM would have higher blast radius for threaded SAPIs, i.e. mod_php with non-forking MPM

]]>https://forum.fedi.dk/post/https://social.treehouse.systems/users/cb/statuses/117482929089274577https://forum.fedi.dk/post/https://social.treehouse.systems/users/cb/statuses/117482929089274577Thu, 22 Oct 2026 05:33:53 GMT<![CDATA[Reply to something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all. on Thu, 22 Oct 2026 05:21:50 GMT]]>@munin@infosec.exchange @rain@hachyderm.io it sure would be convenient if openai could be the saviour of everything once more in 6 months when it’s revealed the silly humans couldn’t patch properly, or something

i mean this entire thing was already used to prop up oai as it is

]]>https://forum.fedi.dk/post/https://sk.girlthi.ng/notes/asmnrd10q0hd01ohhttps://forum.fedi.dk/post/https://sk.girlthi.ng/notes/asmnrd10q0hd01ohThu, 22 Oct 2026 05:21:50 GMT<![CDATA[Reply to something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all. on Thu, 22 Oct 2026 05:21:21 GMT]]>@munin @rain this is the take 👍

]]>https://forum.fedi.dk/post/https://hails.org/users/hailey/statuses/117482879787277571https://forum.fedi.dk/post/https://hails.org/users/hailey/statuses/117482879787277571Thu, 22 Oct 2026 05:21:21 GMT<![CDATA[Reply to something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all. on Thu, 22 Oct 2026 04:29:29 GMT]]>@munin @rain that is concerning

I also assumed it was a small change to handle the specific issue

]]>https://forum.fedi.dk/post/https://kind.social/users/Wearwolf/statuses/117482675861851734https://forum.fedi.dk/post/https://kind.social/users/Wearwolf/statuses/117482675861851734Thu, 22 Oct 2026 04:29:29 GMT<![CDATA[Reply to something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all. on Thu, 22 Oct 2026 04:16:33 GMT]]>@r

I mean, I can see why you'd want to do something more intelligent than yolobort on OOM, but…maybe do that later, after the immediate RCE threat is resolved and nobody's hair is on fire? Most PHP programs will never OOM, like, ever, so…

@munin

]]>https://forum.fedi.dk/post/https://mastodon.sdf.org/users/argv_minus_one/statuses/117482624977934498https://forum.fedi.dk/post/https://mastodon.sdf.org/users/argv_minus_one/statuses/117482624977934498Thu, 22 Oct 2026 04:16:33 GMT<![CDATA[Reply to something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all. on Thu, 22 Oct 2026 04:14:56 GMT]]>@munin

Fast? They reportedly worked on this patch for like 2 months.

@pikhq

]]>https://forum.fedi.dk/post/https://mastodon.sdf.org/users/argv_minus_one/statuses/117482618669900858https://forum.fedi.dk/post/https://mastodon.sdf.org/users/argv_minus_one/statuses/117482618669900858Thu, 22 Oct 2026 04:14:56 GMT<![CDATA[Reply to something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all. on Thu, 22 Oct 2026 03:56:04 GMT]]>@ajroach42 @munin @rain

Write up said it was found by researchers using AI.

The solution was also AI created.

]]>https://forum.fedi.dk/post/https://mastodon.au/users/SuperMoosie/statuses/117482544435381498https://forum.fedi.dk/post/https://mastodon.au/users/SuperMoosie/statuses/117482544435381498Thu, 22 Oct 2026 03:56:04 GMT<![CDATA[Reply to something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all. on Thu, 22 Oct 2026 03:51:13 GMT]]>@munin @rain certainly smells like claude to me.

]]>https://forum.fedi.dk/post/https://retro.social/users/ajroach42/statuses/117482525419187040https://forum.fedi.dk/post/https://retro.social/users/ajroach42/statuses/117482525419187040Thu, 22 Oct 2026 03:51:13 GMT<![CDATA[Reply to something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all. on Thu, 22 Oct 2026 02:15:48 GMT]]>@pikhq @munin siiiiiiiiiigh. I use AI code, for brand new projects. I would fucking never try to bolt on AI-generated code to a pre-existing codebase, that's insane

]]>https://forum.fedi.dk/post/https://social.highenergymagic.net/ap/users/116201069828972775/statuses/117482150195826286https://forum.fedi.dk/post/https://social.highenergymagic.net/ap/users/116201069828972775/statuses/117482150195826286Thu, 22 Oct 2026 02:15:48 GMT<![CDATA[Reply to something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all. on Thu, 22 Oct 2026 02:05:57 GMT]]>@freya @rain

no it's fuckhuge

https://hails.org/@hailey/117479275107799652

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/munin/statuses/117482111476558453https://forum.fedi.dk/post/https://infosec.exchange/users/munin/statuses/117482111476558453Thu, 22 Oct 2026 02:05:57 GMT<![CDATA[Reply to something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all. on Thu, 22 Oct 2026 02:05:13 GMT]]>@munin https://mastodon.social/@computerchronicles/117481495519273329

]]>https://forum.fedi.dk/post/https://tacobelllabs.net/users/astraluma/statuses/117482108604537252https://forum.fedi.dk/post/https://tacobelllabs.net/users/astraluma/statuses/117482108604537252Thu, 22 Oct 2026 02:05:13 GMT<![CDATA[Reply to something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all. on Thu, 22 Oct 2026 02:05:08 GMT]]>@munin @rain oh shit? I rather thoughgt it would be, yeah, a tiny little patch? huh

]]>https://forum.fedi.dk/post/https://social.highenergymagic.net/ap/users/116201069828972775/statuses/117482108266658520https://forum.fedi.dk/post/https://social.highenergymagic.net/ap/users/116201069828972775/statuses/117482108266658520Thu, 22 Oct 2026 02:05:08 GMT<![CDATA[Reply to something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all. on Thu, 22 Oct 2026 02:04:52 GMT]]>@pikhq

well yes that's obvious; you don't -get- that much code that fast without the connivance of that horseshit.

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/munin/statuses/117482107190663867https://forum.fedi.dk/post/https://infosec.exchange/users/munin/statuses/117482107190663867Thu, 22 Oct 2026 02:04:52 GMT<![CDATA[Reply to something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all. on Thu, 22 Oct 2026 02:04:34 GMT]]>@r

right. it -doesn't make sense- to not adopt that, especially in a high pressure time constrained situation.

something -isn't right-

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/munin/statuses/117482105997900225https://forum.fedi.dk/post/https://infosec.exchange/users/munin/statuses/117482105997900225Thu, 22 Oct 2026 02:04:34 GMT<![CDATA[Reply to something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all. on Thu, 22 Oct 2026 02:04:32 GMT]]>@munin i am pretty sure it was vibe coded. so.

]]>https://forum.fedi.dk/post/https://social.treehouse.systems/users/pikhq/statuses/117482105890545313https://forum.fedi.dk/post/https://social.treehouse.systems/users/pikhq/statuses/117482105890545313Thu, 22 Oct 2026 02:04:32 GMT<![CDATA[Reply to something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all. on Thu, 22 Oct 2026 02:03:59 GMT]]>@munin idk about claude, but we also believe "abort on OOM" is the correct behavior

this is *already* a cgi-bin-inspired execution model, you are *perfectly suited* to just abort!

]]>https://forum.fedi.dk/post/https://glauca.space/users/r/statuses/117482103718401360https://forum.fedi.dk/post/https://glauca.space/users/r/statuses/117482103718401360Thu, 22 Oct 2026 02:03:59 GMT<![CDATA[Reply to something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all. on Thu, 22 Oct 2026 02:03:47 GMT]]>@munin esp a half assed solution that only touches _most_ of what needs to be touched

]]>https://forum.fedi.dk/post/https://tacobelllabs.net/users/astraluma/statuses/117482102920632840https://forum.fedi.dk/post/https://tacobelllabs.net/users/astraluma/statuses/117482102920632840Thu, 22 Oct 2026 02:03:47 GMT<![CDATA[Reply to something that's been bothering me about the phpocalypse - which, talking with @rain I was able to put a pin in, after they pointed out what they would do in a similar situation - is that this doesn't feel like a security patch at all. on Thu, 22 Oct 2026 02:01:36 GMT]]>and yes, I think they've been suborned by claude because the solution is "way more code" instead of "simplify oom handling in an easy to understand way" and claude has a history of suggesting "create a vast new thing" before any other solution, as claude is a paperclip maximizer for software and it's gotten into everything.

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/munin/statuses/117482094363580806https://forum.fedi.dk/post/https://infosec.exchange/users/munin/statuses/117482094363580806Thu, 22 Oct 2026 02:01:36 GMT