Front page: at a glance
✓
Since your last visit · 23 October 2026, 01:20 UTC
9 things are new, 3 changed. Two matter for your runbook.
Internet-facing mod_php first, then FPM, then everything else. Where patching slips, apply php.net's temporary settings and record that each blocks a known path only. Alert on PHP workers spawning shells or fetching tools. Decide now who calls isolate or offline, and when.
Your next three actions
The whole playbook1
Patch internet-facing first
mod_php, then FPM, then the rest. Restart every worker; rebuild every image.
2
Bound the known paths
session.upload_progress off, low post_max_size, fatal_error_backtraces off on 8.5. None of these is a fix.
3
Watch the process tree
Alert on a PHP worker spawning a shell or a downloader. A clean access log proves nothing.
What changed
AllFactsTimelineQuestionsStories
What changed in a day: no victim yet, four named cases tested, a patch moving through the supply chain, and firewalls on the list
✓
Stories: written here
✓
NCSC-NL merges pull request 10; the inventory has 674 entries at commit cca173c64ec5.
✓
The evidence vault behind this site is opened; the first capture of the BBC live page is at 08:04:53Z.
✓
The UK NCSC page is modified (HTTP last-modified).
✓
Ryan Austin on BBC Radio 4: no evidence of exploitation yet.
✓
The BBC reports the NSA's X post.
✓
Greenbone on oss-security: the backports imply versions down to 7.4 are affected, whatever the subject line says.
✓
Marked read, an item fades and then leaves this list; it comes back only if what it says changes.