(⁠◔⁠‿⁠◔⁠) Are you OK？✨ Thinking...http://tg.okhk.nethttp://tg.okhk.net/posts/11784http://tg.okhk.net/posts/11784Wed, 21 Oct 2026 15:37:46 GMT<div class="tgme_widget_message_forwarded_from accent_color">Forwarded from <a class="tgme_widget_message_forwarded_from_name" href="https://t.me/outvivid/4943" target="_blank" rel="noopener"><span>层叠 - The Cascading</span></a></div><i class="emoji"><b><span class="post-title-source">🔴</span></b></i><span class="post-title-source"> 今日漏洞总结。</span><br /><br /><mark class="highlight">php</mark> [1]：RCE。请更新至 8.5.12/8.4.27/8.3.36/8.2.35。<br />Node.js [2]：RCE。请更新至 26.12.1/24.22.1/22.23.4。<br />eMudhra 证书 [3]：或可导致 MitM。请注意停用受影响证书、检查浏览器更新及更新 ca-certificates 等相关组件。测试方法和修复版本参见 [3]。<br />TiDB 云被骇 [4]：有用户元信息被泄露；但目前没有数据库数据泄露的证据。<br /><br />1. <a href="https://php.net/archive/2026.php#2026-10-21-5" target="_blank" rel="noopener" title="php.net/~">php.net/~</a><br />2. <a href="https://nodejs.org/en/blog/vulnerability/october-2026-security-releases" target="_blank" rel="noopener" title="nodejs.org/~">nodejs.org/~</a><br />3. <a href="https://emudhra.we-have-a-problem.com/" target="_blank" rel="noopener" title="https://emudhra.we-have-a-problem.com/">https://emudhra.we-have-a-problem.com/</a><br />4. <a href="https://pingcap.com/trust-hub/security/security-update-october-2026/" target="_blank" rel="noopener" title="pingcap.com/~">pingcap.com/~</a><br /><br /><a href="/search/result?q=%23wtf" title="#wtf">#wtf</a> <a href="/search/result?q=%23today" title="#today">#today</a> <a href="/search/result?q=%23PHP" title="#PHP">#PHP</a> <a href="/search/result?q=%23Nodejs" title="#Nodejs">#Nodejs</a> <a href="/search/result?q=%23PKI" title="#PKI">#PKI</a> <a href="/search/result?q=%23PingCAP" title="#PingCAP">#PingCAP</a><a class="tgme_widget_message_link_preview" href="https://php.net/archive/2026.php" target="_blank" rel="noopener" title="PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world."> <div class="link_preview_site_name accent_color">www.php.net</div> <img class="link_preview_image" alt="PHP: News Archive - 2026" src="/static/https://cdn4.telesco.pe/file/vIgG1_bhNTuynErPmNL0_c9HYjnCHSFWNQ1ygkL4Xi3ovg_EM4nM2nRUAhsUbHbB52BevmIoCQu5PvixMuzn1R04UHcQyL3kQko26kaxPYQU8A-945OBtQaLt2EhubURkoG6Czv59rF07VZ47yUIqhtHFYtvWItbzVdMiPrcuOzs-3tXKFVIUHBw5QR-EbOcc4S_1z4EdETwxic5rj6Gg1Xk6vcIQfRT9-m3xYIEn0MLqMAjpZXbAUqOFZDZa2Vn_e_7vn61Q-f7031ribdyoUfGKYEc0rXE5w5g8hlAA1XuWDN7S9Zq_sgkFXTBdbQuCAwF8VTAEBoSh1tX1BawSQ.jpg" width="1200" height="630" loading="eager" /> <div class="link_preview_title"><mark class="highlight">PHP</mark>: News Archive - 2026</div> <div class="link_preview_description"><mark class="highlight">PHP</mark> is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.</div> </a>http://tg.okhk.net/posts/11783http://tg.okhk.net/posts/11783Wed, 21 Oct 2026 14:30:48 GMT<div class="tgme_widget_message_forwarded_from accent_color">Forwarded from <a class="tgme_widget_message_forwarded_from_name" href="https://t.me/outvivid/4941" target="_blank" rel="noopener"><span>层叠 - The Cascading</span></a></div><i class="emoji"><b><span class="post-title-source">🔴</span></b></i><span class="post-title-source"> </span><mark class="highlight"><span class="post-title-source">PHP</span></mark><span class="post-title-source"> 发布紧急修复版本 8.5.12/8.4.27/8.3.36/8.2.35。</span>建议受影响网站主立即更新。<br /><br />- 文章中也提供了无法升级时的 workaround，但它们不能完全修补漏洞。<br />- Cloudflare 也配置了一些 WAF，但它们也不能完全修补漏洞。 [2]<br />- <mark class="highlight">PHP</mark> 8.1 及更低版本不会被官方修复。<br /><br />1. <a href="https://www.php.net/archive/2026.php#2026-10-21-5" target="_blank" rel="noopener" title="https://www.php.net/archive/2026.php#2026-10-21-5">https://www.php.net/archive/2026.php#2026-10-21-5</a><br />2. <a href="https://developers.cloudflare.com/changelog/post/2026-10-21-emergency-waf-release-cfmr/" target="_blank" rel="noopener" title="developers.cloudflare.com/~">developers.cloudflare.com/~</a><br /><br />thread: <a href="https://t.me/outvivid/4940" target="_blank" rel="noopener" title="/4940">/4940</a><br /><br /><a href="/search/result?q=%23PHP" title="#PHP">#PHP</a><a class="tgme_widget_message_link_preview" href="https://php.net/archive/2026.php" target="_blank" rel="noopener" title="PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world."> <div class="link_preview_site_name accent_color">www.php.net</div> <img class="link_preview_image" alt="PHP: News Archive - 2026" src="/static/https://cdn4.telesco.pe/file/RS6tW0F_eC9hfe0e7NIWpYSWxHJWGRZYnExTvfocNMeShAiHNfWwPVKvivyG1IL1eDmg1upWD5Wl6mT26Dz7HbX2Y9uvEYAzfkoywDCMhGzim67P090afWuO43O8ABw5YaZUdZqU6l9peoQkFCZD3CBF67p0bKCIcOcLGk6CSvhXyIZR73SHUZJxt0HdJzg-ihE8c3PplcsyzMsxL80a7S41rBey-k3EE5NSYq3KnJRC8VJlfllbOU95uCvU_8-YgemzJ8StUGBCJ6YCaG8Q8CvvyOdPBjWrPk4JI3goZOdC8oJdpoKBbWvuRBuPzRpxmYz5cZT70I4-owRXLdPBZQ.jpg" width="1200" height="630" loading="eager" /> <div class="link_preview_title"><mark class="highlight">PHP</mark>: News Archive - 2026</div> <div class="link_preview_description"><mark class="highlight">PHP</mark> is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.</div> </a>http://tg.okhk.net/posts/11776http://tg.okhk.net/posts/11776Wed, 21 Oct 2026 03:17:39 GMT<div class="tgme_widget_message_forwarded_from accent_color">Forwarded from <a class="tgme_widget_message_forwarded_from_name" href="https://t.me/outvivid/4938" target="_blank" rel="noopener"><span>层叠 - The Cascading</span></a></div><i class="emoji"><b><span class="post-title-source">🔴</span></b></i><span class="post-title-source"> </span><mark class="highlight"><span class="post-title-source">PHP</span></mark><span class="post-title-source"> 严重漏洞被泄露和复现；欧盟机关建议 </span><mark class="highlight"><span class="post-title-source">PHP</span></mark><span class="post-title-source"> 服务在修复漏洞前暂时下线。</span><br /><br />- <mark class="highlight">PHP</mark> 官网称修复会在今日 22:00 (UTC+8) 发布。<br />- 有说法称 mitigation 是在 <mark class="highlight">php</mark>.ini 设置 session.upload_progress.enabled = Off 。<br /><br />1. <a href="https://php.net/archive/2026.php#2026-10-20-1" target="_blank" rel="noopener" title="https://php.net/archive/2026.php#2026-10-20-1">https://php.net/archive/2026.php#2026-10-20-1</a><br />2. <a href="https://cert.europa.eu/publications/security-advisories/2026-018/" target="_blank" rel="noopener" title="cert.europa.eu/~">cert.europa.eu/~</a><br />3. <a href="https://news.ycombinator.com/item?id=50167754" target="_blank" rel="noopener" title="HackerNews:50167754">HackerNews:50167754</a><br /><br />CVE: CVE-2026-109618, CVE-2026-109619<br />linksrc: <a href="https://t.me/usr_bin_cat/4464" target="_blank" rel="noopener" title="https://t.me/usr_bin_cat/4464">https://t.me/usr_bin_cat/4464</a><br /><br /><a href="/search/result?q=%23php" title="#php">#php</a><a class="tgme_widget_message_link_preview" href="https://php.net/archive/2026.php" target="_blank" rel="noopener" title="PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world."> <div class="link_preview_site_name accent_color">www.php.net</div> <img class="link_preview_image" alt="PHP: News Archive - 2026" src="/static/https://cdn4.telesco.pe/file/O9ofpWNrm04lQVTMnhL97n-EzaAd_tIkcOuTY7fj_lwDroidlBH_Cge-qT2Lyui5aZVxrOAuCE4pV6CobJ8eSXu_Uu3TTnTbLfNLU5__lnWa3mbwR62eiNQ06f481KnAXyMFzobNu9EALZbweZ-9JIYNsTWrU5btzV9h5QC91fgezAz46ZdOstPBwsTjsBZb_livmd-fEFAVtFghnaplepnkhIJSILMPiXVB_LHfUIW-Z7BEGIPCAEjdGNbhEWlTpstR_YXfXvviquPzQvDRG6p8TeQj7pqNLUP5CouDNzJThA_LEOrXESugDZqpkKRgKWdKrNhOWrkBB2MsigZ7Hg.jpg" width="1200" height="630" loading="eager" /> <div class="link_preview_title"><mark class="highlight">PHP</mark>: News Archive - 2026</div> <div class="link_preview_description"><mark class="highlight">PHP</mark> is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.</div> </a>