Linklog
Links, software, talks and other good stuff from the web. Collected here so I can find it again.
PHP2Shell doesn’t take weekends off
The first successful attacks are here, and plenty of PHP servers remain unpatched. Well, it was the weekend. Someone probably should have told the attackers.
More to squeeze out of the RTX 3090
Oh hell yes, I have an RTX 3090. gpu-unlock removes a limit on certain Tensor operations under Linux, potentially squeezing more AI performance out of the card. I’d have to try it to see how much that helps in practice. But extra performance from hardware I already own? I’ll take it.
Brotli’s widening reach
Looks like PHP2Shell was just the beginning. Now the Brotli vulnerability affects Bun, Python and other software alongside Node.js. One shared dependency is creating quite a bit of work.
NT to Now
You’ve got to check out this channel. Windows NT and those old Windows 95 Plus! screensavers… that brings back memories. I love this stuff.
Another PHP vulnerability
Well, shit. It just keeps coming. The last two PHP vulnerabilities have barely been patched, and here comes another warning. This one needs an unusual session configuration, but there’s no released fix yet.
Where’s PHP hiding?
With the current PHP vulnerabilities, check out selfh.st’s app directory filtered by PHP. Handy starting point for going through your own stack. See what you’re running and check whether the PHP security updates are installed. Including inside your containers.
PHP: We're f***ed.
Two critical vulnerabilities in PHP, potentially allowing unauthenticated code execution. I had other plans for tonight. Guess I’ll be patching instead.
PwnEscape: Patch your systems
A critical Linux kernel flaw can allow an attacker to escape from a VM to the host under certain conditions. PSA: Install available security updates and make sure you're actually running the patched kernel. Especially on virtualization hosts, I wouldn't put this off until next week.
Malware in the AUR
Oh dear. A fake yay package called yyay that downloads and runs external code as root during installation. Maybe don't download every piece of crap without checking the source. Just because something is in the AUR doesn't mean it's trustworthy.
REA: Another rabbit hole
REA connects AI agents to reverse-engineering tools like Ghidra to inspect programs without their source code. Oh dear, another rabbit hole. I can already see myself disappearing down it and throwing every EXE I come across at it.
Cats are liquid
Liquids take the shape of their container. So do cats. M. A. Fardin devoted a tongue-in-cheek paper to this observation: “On the rheology of cats”. Using the Deborah number and cat photos, it explores when a cat qualifies as a solid and when as a liquid. The internet supplies the cat pictures, physics supplies the equations.
They rebuilt Word, too
The ArtCraft team rebuilt Word, too. It’s called WordCraft, it’s open source, and it runs natively on Linux. Why did I install WinBoat with libvirtd two weeks ago? Fml.
Rebuilding Adobe apps with AI
SemperVideo takes a look at AI-built recreations of Photoshop and other Adobe apps. The source code is openly available on GitHub. Adobe must be fuming.
twinBASIC: back to Visual Basic
A modern BASIC development environment aiming to support existing VB6 and VBA projects. Looking at it takes me straight back to my “childhood.” Visual Basic and the tutorials on sempervideo.de: that’s how I got into programming.