FeedCity

RE: https://mastodon.social/@csstricks/117507965781292746

Yessssssss!! Go @geoff! 🫶🔥👏💚

Obrigado, Brasil! 🙏🌎💚

Brace yourselves for the true horrors of AI-generated Halloween … 🎃😱

And there will be a live stream as well:
https://www.youtube.com/live/4PNiwX4Go5A

We’re going to see this tonight … 🤩🎻
https://www.youtube.com/watch?v=R_3da0fPLQs

Well this is timely 👀

[contains quote post or other embedded content]

Nothing makes me happier than when I look up some new css thing and the top result is written by a friend. H/T to @seaotta.dev this time for writing about CSS for foldable screens TWO YEARS ago :)

Still here for the craft. Don’t @ me. 😁

Feels like this is the final boss … 👾

Client’s sending half-baked prototypes again and asking if they can just add them to the site themselves.

Thanks, Dario!

Official #php2shell soundtrack just leaked:

https://youtu.be/0l0nzPpvbFs

And seeing all the reports from people waiting for their hosting providers to patch the servers their clients’ sites run on (myself included), and with all-inkl.com, the host I moved away from, still down, there’s also something to be said for taking care of some things yourself – and choosing your hosting provider carefully.

Still, hang in there, everyone patching things late into the night! 🫶

My first reaction to #php2shell was: “Dang, that’s the thing with running your own VPS – you have to keep everything up to date yourself…”

But: my own site is already running on #PHP 8.4.27. ✅

RE: https://fedi.katze.sh/@elise/117479383739450605

Happy #PHP Groundhog Day!

The issue affects PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. Update as soon as your distro or repo has the packages. On shared hosting, you might ask your host whether they’ve patched already. #CyberSecurity #infosec #php

https://www.php.net/archive/2026.php#2026-10-21-5

If you can't update yet or a patch is not yet available for your distro / repo: Apply the temporary mitigations from the advisory. Set them in php.ini, then restart PHP:

```
session.upload_progress.enabled = 0
post_max_size = 32M
upload_max_filesize = 30M
```

They reduce the risk but don’t fix it.

What could an attacker do? Read everything your site can read (config files with database passwords and secret keys, the entire database), change your site (spam links, malicious JavaScript, hidden backdoors), and use your server to send spam or attack others. 🥳

Again, those security releases PHP just shipped are just … 🤯
Those two bugs let anyone run their own code on your server with a single crafted request: no login needed, and it happens before your CMS or framework even starts. And proof-of-concept exploits are already circulating … 🧵

Update your PHPs, everyone:

“PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.”

https://www.php.net/archive/2026.php#2026-10-21-5

The "3-clicks rule." The "7±2 rule." The assumption that people don't scroll. Our work is packed with strong beliefs, confusing misconceptions, and random myths. So what's actually reasonable — and what should we take with a grain of salt? Let's get to the bottom of how peop...