Hacker News
1Security advisory: Critical remote code execution vulnerabilities, update now
Early release debate
Commenters debated whether releasing the fix early would help or hurt. Public PoCs were already circulating and LLMs speed up exploit development, so some urged immediate shutdowns until patching.Interim mitigations
Users shared workarounds: disabling upload progress and file uploads, and blocking multipart/form-data requests in Apache, nginx, or Caddy. Several said INI settings alone are insufficient and Cloudflare WAF rules only catch known payloads.Patch availability
Patches reached php.net, Ubuntu, Gentoo, FreeBSD, and Chainguard, while Docker Hub and some distros lagged. PHP 8.1 and older no longer get upstream updates, raising concern about legacy deployments.
2PHP 8.2.35
Disclosure process criticized as leaky and PR-driven
Commenters argue OpenAI and security firms held the flaw for two months, leaked early, and used it for publicity. Others note the PHP team took months to patch and that publishing a fix reveals the flaw.Patches slow to reach Docker, Ubuntu, and hosts
Official Docker PHP images, Ubuntu apt repos, Linode mirrors, and WP Engine lagged hours behind the release, leaving servers exposed. Some images were labeled as patched while still shipping older PHP.Possible second vulnerability in patched PHP
Reports claimed a new use-after-free in 8.5.12 was exploitable. Later analysis said it causes only a crash, and the RCE claim was withdrawn, though a memory-safety bug remains.
3Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds
- eMudhra's intermediate CA private keys were found to be trivially weak, using tiny values like 4 or 56 on the P-384 curve, so they could be recovered in under a second. Eight intermediates, all cross-signed by Sectigo, were revoked by browsers, but most non-browser TLS clients, scripts, CI pipelines and IoT devices still trust them, leaving them open to forged certificates.
Weak key generation
Commenters debate whether a key seed of 4 is plausible for a true RNG. Several note that once one value is shown to be non-random, an attacker can infer the others, and the thread includes jokes about 4 not being prime.Too many certificate authorities
Users argue that about 350 trusted roots and 3,600+ intermediates is excessive. Proposed fixes include name constraints, DANE, and CT log checks, though some note that concentrated risk would remain.Unpatchable devices and bundled trust stores
Routers, TVs, and IoT devices with frozen firmware will trust the compromised certificates until 2039. Apps that ship their own CA bundles, like pip, Node, Bun, and Flatpak, can ignore OS-level fixes.
4Today's PHP security release, and how we're strengthening security
- An ongoing discussion thread covers the release of PHP 8.2.35, with a further link to related coverage.
Embargo breaks by security firms
Chainguard published fixed images about six hours before the coordinated release, and Calif posted an exploit-related video early. Many commenters blamed the breaches for the panic and for speeding up attackers.PHP security process and communication
Commenters criticized the PHP team's slow, consensus-driven decisions, reliance on a small security group, and sparse communication during the incident. Some argued for more frequent updates and mitigation guidance.Real-world mitigations and exposure
Admins shared temporary defenses, such as blocking multipart POSTs at nginx, and described how HN threads helped them find mitigations while AI-driven attacks targeted exposed PHP servers.
5The 1.5°C goal of the Paris Agreement is no longer viable
- UNEP's 2026 Emissions Gap Report says the 1.5°C Paris target is now unachievable without major overshoot. The new aim is to stay below 2°C and return to 1.5°C by century's end, requiring emissions cuts of 18% by 2030 and 45% by 2035 versus 2025 levels.
Political will and voter responsibility
Commenters argue climate progress is blocked by politics: voters elect stupid or extremist candidates, lobbyists and wealthy interests shape policy, and education and public information are lacking, so leadership is needed.Nuclear power and German energy policy
Users debate Germany's nuclear phase-out, with critics blaming green opposition and Russian gas dependence for coal reliance, while defenders dispute that coal replaced nuclear and call the criticism overblown.Individual actions versus corporate emissions
Some stress personal choices like diet and consumption, while others argue about 57 companies producing most emissions, claiming individual habits like plastic straws distract from systemic change.
6The Future of CSS
- The post previews the top CSS features users voted for in Mozilla's Interop 2027 ranking, which browser vendors use to prioritize web standards. Highlighted proposals include CSS functions, corner-shape for bevels and squircles, border-shape for custom borders, anchored container queries, inherit(), and scroll-triggered animations, with notes on current browser support.
Vanilla css and js are better than ever
Many commenters say modern CSS, such as flexbox, grid, nesting, @layer, :has(), and light-dark(), can replace much JavaScript, such as accordions and scroll progress bars. Some still doubt it for complex state management.Skepticism about css functions and feature creep
Critics say CSS functions and other additions make the language more convoluted, move it toward JavaScript, and grow browser complexity. They also worry this could make JavaScript-free browsing impossible.Missing native ui widgets like date pickers
Commenters complain that date pickers, touch-friendly inputs, and native tooltips remain poor or missing. Others reply that date pickers are hard to standardize and that OS vendors and Open UI are working on them.
7The No Kings Takedown Is Why You Shouldn't Rent Your Megaphone from Zuck
Platform takedowns of activist accounts
Commenters say Instagram and Reddit removed accounts of Palestinian journalists and an IDF-accountability group, and that repeated waves of deletions quietly erode dissenting voices, possibly by design.Free speech and deplatforming hypocrisy
Users debate whether people who cheered past deplatforming now object to it, and whether free speech applies to private companies or only to government censorship.Network effects versus open alternatives
Participants argue that people will keep using dominant platforms because they are convenient, so decentralized tools like Mastodon, Signal, or POSSE need to be easier to adopt.
8EA is shutting down BioWare
- BioWare, the studio behind Mass Effect and Dragon Age, is closing, and EA has ended early development on the next Mass Effect game. About 400 EA staffers are being laid off, including around 50 at BioWare, following EA's $55 billion take-private deal.
Mismanagement at Bioware and EA
Commenters blame shifting goals, constant reworks, and EA executive pressure for Anthem's failure. Veilguard and Andromeda also disappointed, and many say the studio had been declining for over a decade.Buy-and-liquidate studio model
Commenters see EA and private equity as repeatedly buying successful studios and shutting them down, citing past closures like Westwood and Bullfrog and calling it a new hot business model.Saudi ownership and romance options
Some suggest the Saudi Investment Fund's stake in EA may influence decisions to drop same-sex romance options, while others call that a stretch. The thread becomes a heated debate over LGBTQ representation in games.
9What shall I teach my son?
- A programmer expecting his first child wonders what to teach when AI may erode the value of his skills. Drawing on Neil Postman, he notes that schools have survived past technologies, that education's purposes keep shifting, and suggests involving children in deciding them together.
Parents as role models over direct teaching
Commenters argue children mirror parents' behavior more than lessons, so parents should focus on becoming happy, compassionate people and modeling the values they want to pass on.Education's value as AI advances
Some suggest education and intellectual work may lose value if AI succeeds, while others counter that knowledge, critical thinking, and math remain essential for adapting and spotting bullshit.Hard skills versus connections and privilege
One view holds that parents' professional skills matter less than values, while another argues that wealthy parents' networks, knowledge of the system, and access to experts give their children a lasting advantage.
10Facebook Pages require paid subscription to post more than two links per month
- The author says a practice is actively harming the creators themselves, including businesses and groups, and can't understand why they would do it. They suggest this is another reason to move to something not locked-in, such as a federated forum for group discussions.
Link limits as monetization or anti-bot measures
Commenters see the link limit as a response to clickbait "link in comments" tactics, throttling, or bot control, but many view it as monetization creep that pushes businesses to pay for reach.Facebook as local community hub
Towns, schools, and businesses rely on Facebook groups for announcements, though many lament the spam, foreign trolls, and platform dependence, and hope for blogs, RSS, or decentralized alternatives.Meta engineers' reputation
Debate over whether open-source contributions like React, PyTorch, and Llama offset Meta's social harms, with critics arguing the damage outweighs the engineering output.