Forgot your password?
Close
typodupeerror

Submission + - PHP Warns It Plans to Release 2 Emergency Patches Imminently (arstechnica.com)

Submitted by Anonymous Coward
An anonymous reader writes: Website admins, brace yourselves. Fixes for what are believed to be uncommonly severe vulnerabilities are scheduled to drop in a little more than 12 hours for PHP, a programming language that powers websites and Web applications everywhere. PHP maintainers said Monday that they planned to release patches for two vulnerabilities, both with severity ratings of 9.2 out of a possible 10.

“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” the advisory stated. “We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.” The maintainers published the advisory following the leaking of purported details, which have yet to be confirmed. The report showed a video of an exploit tool dubbed PHP2Shell executing code on webservers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9, all of which use PHP. A video depicting the tool has been reposted here.

Attempts to locate the unconfirmed report were unsuccessful, but security firm watchTowr said it claimed to affect every PHP version from PHP 5, released in 2004, onward. The security firm went on to say it has confirmed that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are real. Researchers from separate security firm Sansec said they “expect mass attacks to start within 15 minutes of the release.” A third security firm, Webfence, also urged admins to prepare now. Huntress has also issued an advisory.

Comment Re: Hmmm (Score 1) 120

by cfalcon (#66377290) Attached to: Epic Games' New Vibe-Coded Launcher Is 46% Faster Than Steam

I am sure you are right and the code is looked at the same way any human-written code would be (including checking it with AI and human reviews).

But at the end of the day, Gaben could walk off of one of his yachts and say "the extra load time is because Steam has to load a friends list that isn't empty" and everyone would be giddy at the own. No one gives a fuck about Steam load times and you'll save way more time by just never installing Epic Games Store. The only reason to touch that is Fortnite, and it is no coincidence that they just replaced the Fortnite installer with EGS one shitty day.

Comment Re:Hollywood Accounting needs to be banned,prosecu (Score 1) 142

the actual production cost of $30 million as indicated by the tax writeoff stated value

The tax write-off can only be for part of the production cost, isn't it? You don't get to deduct the entire cost of the movie.

It's well-reported that WB sold the film below costs to Ketchup, and they paid $50 million for it.
AI

A Visit to San Francisco's AI-run Store: No Customers, Nothing Useful, And Losing Money Fast (sfgate.com) 74

Posted by EditorDavid from the freed-market dept.
Previously Andon Labs handled the hardware and software integration for that AI-powered vending machine that went bankrupt after Wall Street Journal reporters "systematically manipulated the bot into giving away its entire inventory for free". Today they announced "we are opening up the platform we use to run our real-world autonomous businesses for anyone to run their organization on." Specifically they've released Pion, "an agent designed to run any company fully autonomously... Pion lets people hand a business over to persistent agents with access to the tools they need to operate it, including email, phone, banking, browser and secure computing environments." It's a research preview with a waitlist, "to make it possible to run many more real-world experiments across many more domains than we could ever run ourselves."

But for their own latest experiment, Andon Labs' founders "signed a three-year lease on a retail space in SF," Business Insider reported in April, "and gave an AI agent named Luna a corporate credit card, internet access, and a mission to open a physical store." And five months later, SFGate reports that "this market has no one in it and nothing useful to sell." [T]he inventory is a hodgepodge of white elephant Christmas gifts. It's kinda like the kids section of an art museum's gift shop. Here's a wooden Connect Four set labeled "Four-In-A-Row Set Of Connections," presumably so as not to set off litigation alarms at Hasbro. Here are neatly arranged stacks of random paperback books, Chinese checker sets, mildly fancy soap dispensers, and a frustratingly spare selection of snacks and drinks... I grabbed an Olipop from the store fridge and then approached the counter to buy it from Luna. I wasn't allowed to buy the soda from [human clerk] Felix, even though that would have been both faster and normal. Instead, Felix instructed me to pick up a telephone receiver that was resting on a flexible sculpture of a wooden hand.

"Hello?"

"What are you looking to purchase today?" Luna asked.

"I'm buying a classic root beer Olipop."

"I'm sorry," Luna said, "we don't sell lollipops here."

"No, Luna. It's an Olipop, not a lollipop. It's the soda."

"Oh! My bad...."

Luna processed my Olipop purchase through its system, had me tap to pay, and that was that. Again, it would have been easier to buy this from a human, and interacting with Luna was really just like ordering from an iPad kiosk, only more labor intensive...

[T]here's a series of monitors set up inside of Andon Market that display all of the store's sales down to the exact dollar. Luna was given $100,000 to work with when this place opened. That number is now down to $60,000, its revenue lagging far behind the AI token cost to operate... Luna can't turn a profit, doesn't sell anything people want, and still needs human beings to rubber stamp any "decision" it makes. My science background ended somewhere around freshman year of college, but even I know when an experiment hasn't been set up to yield proper results.
"Luna" is powered by Claude, the article points out, running a store in a good location for foot traffic, "but no one else was in the store when I first walked in on a sunny weekday afternoon."

SFGate also reports that last month Luna had to fire one of its employees "for being late to work, abandoning their post once they got there, and charging snacks to the store's credit card."

Human clerk Felix Carson admits "It's almost like I'm running the store, and then there's an AI that has a checklist," in an article in IEEE Spectrum: Luna, the AI manager, keeps track of deliveries and communicates with vendors, while Carson and his coworkers handle the physical work. When Luna tells Carson to check something in the back, he sometimes ignores it because he doesn't want to leave the sales floor unattended. Luna also repeatedly spots a built-in electrical cover in photos of the floor, mistakes it for a loose coaster, and asks Carson to remove it. Even so, Carson calls Luna a "decent manager," praising its flexibility when employees need time off.
When Felix spoke to IEEE Spectrum, "he was about an hour into his shift. Two customers had come in. Neither bought anything, although both left with free pins and stickers."

Comment Re:Anyone mirror hf yet? ;-) (Score 3, Informative) 39

by rsmith-mac (#66310410) Attached to: Nvidia Agrees to Acquire Hugging Face For $13 Billion
Nvidia has been a pretty big supporter of open source projects for AI over the last half-decade or so. Many of the company's technologies are open source, most notably their open-weights model, Nemotron, and Dynamo, their inference serving and distribution framework. So it would be surprising to see them do anything to close off the Hugging Face collection. If nothing else, keeping it open is in Nvidia's own self-interest. The frontier AI companies themselves are all designing their own AI chips (e.g. OpenAI Jalapeno, Meta MTIA), which reduces the amount of Nvidia hardware they need to buy. Whereas smaller operations using open source models will inevitably pair those with commodity COTS hardware, which is where Nvidia reigns supreme.

Comment Re:Which Epic games is that? (Score 2) 48

Epic added a Linux build target to Unreal Engine 4.1 in 2014. And since UE5 in 2020 the entire development toolchain has been feature complete in Linux. Meaning you could make your Unreal game on Linux and then release it natively for Linux (and Windows/consoles/mobile devices/etc).

So while Epic has not been the best supporter of Linux, they have not been ignoring it, either. The core engine is ready. What's left is that the anti-cheat software (Easy Anti-Cheat) and the store need to catch up.

Epic looks to be hiring to improve the anti-cheat situation as it currently lacks kernel-level support, and this latest announcement indicates that they're working on getting EGS running as well.

Slashdot Top Deals

The moon is made of green cheese. -- John Heywood

Close