General AI Crap

PHP shares mitigation for new RCE vulnerability with no patch - Bleeping Computer​

1792771303882.png

The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch.

PHP is an open-source web development language used by nearly 70% of all websites on the Internet. According to VirusTotal estimates, more than 5.1 million PHP hosts are exposed online, and roughly 3.8 million have at least one port open to attacks.

According to a Friday advisory, this security flaw (tracked as CVE-2026-115560) can only be exploited when targeting systems "with an unusual combination of configuration and application code."

"An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also still be enabled," the PHP team explained.

"Applications that never change the serialize handler at runtime can keep the feature enabled. Since this setup is unlikely in practice, we are handling it in the regular release cycle and will publish a full advisory for CVE-2026-115560 with the next release."

Until a security patch is available, the PHP devs suggested setting session.upload_progress.enabled=0, adding that "If you applied it then, keep it in place and no further action is needed."

This mitigation should have already been applied on Wednesday, before patching two other critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell.
Click to expand...

Read the full article here:

www.bleepingcomputer.com

PHP shares mitigation for new RCE vulnerability with no patch

The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch.
www.bleepingcomputer.com www.bleepingcomputer.com
 
1793122597939.png
China's ambitious experiment with AI filmmaking has struggled at the box office. Sanxingdui: Future Past, promoted as the country's fully AI-generated theatrical feature, opened on October 23. Despite a production budget exceeding $1.5 million, the film earned only $181,000 during its first four days, even after receiving more than 10,000 screenings on opening day.

The science-fiction film took 100 people over two years to complete, using AI-generated characters, voices, plus backgrounds. Meanwhile, Niu Lai, a crudely animation made on a budget of $200-$500, achieved the opposite result. Created by director Xin Yumeng alongside his mother, Sun Lifang, the low-budget production earned nearly $10 million at China's box office alone.

What made the comparison more striking was Niu Lai's unlikely success. The film initially earned $1,150 during its first ten days, but its awkward, bizarre performances and hilarious scenes became appeal points. Audiences eventually embraced its rough presentation, turning an amateur production into a hit while the expensive AI movie struggled to attract moviegoers.

Source: Cartoon Brew, AFP, Vulture
 
1793169550039.png
Highway thieves are using sophisticated digital tactics that investigators worry make it easy to rob trucks carrying millions in expensive data center equipment.

NBC News spoke to “several industry leaders, consultants, and investigators advising law enforcement” offices probing the biggest thefts yet and reported that since June, thieves have “made away with more than $100 million in data center freight.”

Here’s how they said thieves get away with it: First, thieves hack freight brokers’ accounts on shipment-listing websites and post fake shipments to lure real bids, then send a malicious link to any trucking companies that respond. Once victims click, thieves install software to take control of their accounts and start bidding on real shipments. Sometimes, a real delivery driver is hired to collect the cargo, unaware of the scam, and other times fake driver’s licenses are used to get accomplices hired. Either way, the goods are eventually transferred to a driver working with the thieves to resell the gear, and, in one of the largest thefts, tracking coordinates were spoofed to prevent digital monitoring.

Equipment commonly targeted includes “servers, fiber-optic cables, computer memory chips, copper wires, and bitcoin mining machines,” NBC News reported.

Some trailers hit seem to be carrying only data center equipment, like two stolen freights found in Illinois. The Cook County Sheriff’s Office estimated those contained $300,000 worth of copper wire spools and about $1 million in “custom-made data center modular power solutions equipment,” NBC News reported. Other trucks impacted were carrying additional freight, like a Los Angeles County Sheriff’s Department case where “data center cooling equipment” bound for Deepcool AI was recovered among nicotine pouches, televisions, shoes, printers, speakers, and skin care cosmetics. Experts worry that means Americans may be broadly harmed by the thefts, not just the AI industry.

 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X