thanks for coming to my ted talk.

Uptime: 4,512 days. Nobody knows what it does. Nobody owns it. Nobody can shut it down.

PHP patch is now avaiable https://www.php.net/archive/2026.php#2026-10-21-5

Get it while its hot :)

Can we get a list going?

So far I found:
Synology
Unifi OS EDIT: I may be wrong about this one.
pfsense
fortinet

Anyone else sitting at working just spamming the update button on my Linux web hosts because the PHP repo servers are so overloaded they have basically been hit with a DDOS attack, so you just keep hitting update in the hopes it will eventually work or is that just me?

That's the subject line of an email from my personal website hosting this morning, advertising upgraded AI-assisted websites.

I'm taking it as a sign that my decision to retire early at the end of the year is a good one. But it's also really depressing, especially given the posts I've seen here lately of layoffs and other separations attributed to management confidence in AI as a substitute for skilled sysadmins. EDIT: I made my decision months ago, I had many reasons for retiring, it was NOT because of this marketing email.

Ultimately, I think the bubble will burst, and the value of experience will make itself obvious again, but it's going to be a rough ride for our profession until then.

So, how’s everyone’s security department handing this so far? Mine has been completely worthless like always. Give me some good stories to cheer me up.

Someone on our team changed numbers recently and it exposed something I’d never really thought about. A few weeks later we found out their old number had already been reassigned. That number had been used for years with vendors, former coworkers, contractors, delivery people, old MFA setups, random group chats and probably a hundred things nobody remembers anymore. Imagine being the person who gets it next. You don’t need to hack anything, people just start texting you assuming you’re the previous owner.

Obviously the answer is cleaning up accounts and not using SMS as an identity system in the first place but realistically nobody remembers every place their number has ended up. We’ve started thinking much more carefully about which relationships are tied to phone numbers at all. Signal for some people, Kibu for a few contacts where identity matters more, company managed accounts for work etc. Am I overthinking this or is phone number recycling a massively underrated social engineering risk? These two hit very different things like the first is invisible wealth, while the second is identity persistence after a phone number changes.

Hey fellow sysadmins, a significant chunk of our tech stack is hit today, affecting our main CRM (PM Tool) alongside our dev tools; wondering could this be caused by the PHP day0 discovered or you believe there's something else lingering in the background?

Wondering if anyone got any insights as to what's going on in here, any other global, widespread used apps that are affected?

For anyone with cPanel, Plesk, CloudLinux or DirectAdmin boxes: those usually have several PHP builds side by side (ea-php74, ea-php81, alt-php and so on), each one needs its own fix, and 8.1 and older have no PHP release at all, only source backports. The other thing that'll bite people tonight is updating the packages and never restarting PHP-FPM, so the old binary keeps serving requests.

I wrote a small read-only bash script that lists every PHP install on a server, marks which branch has a fix, and flags FPM processes still running a binary that was replaced after they started. Exit code 0/1/2 so you can run it across a fleet:

https://github.com/KyleClouthier/php2shell-check

MIT, about 150 lines, read it before you run it. Happy to add paths for panels I missed.

Two critical PHP core RCEs (CVE-2026-109618 and CVE-2026-109619) leaked before disclosure, and the fixed releases are due today at 14:00 UTC. Reports say PHP 5 to 8 are affected and EOL branches may get no fix (BleepingComputer). Huntress's write-up has a practical checklist: inventory every install, including php.exe and php-cgi.exe bundled inside vendor software and control panels like cPanel and Plesk, and isolate EOL PHP from the internet (Huntress). The harder part is the external view: legacy sites and appliances on the internet that aren't in anyone's CMDB. This overview of handling zero-day exposure makes the same point: when patches are late or missing, asset visibility and temporary controls (restricting access, disabling the affected service) do most of the work.
What's your fastest reliable way to enumerate PHP across servers, appliances and your external footprint? Package queries, EDR inventory, banner scans, something else?

Lots of my jobs are failing or stuck and I'm told their is an issue with asynchronous job processing on their backend for US-1.

Specifically the SOAR part of the platform is dead right now.

Current setup:

• Main site in Houston with on-prem AD and Windows file servers. Users map drives network Drives
• Azure Hybrid environment with about 100 users.
• Brazil users connect back to Houston over FortiGate VPN, and file access is slow
• About 10 TB of data total.
• ½ of Brazil staff don't work from one office. They're spread out or remote. We have about 10 users now and may be expanding soon.
• Veeam for backup

Hope you guys can give me some reocmmendations on how can users from Brazil can access the data on on-prem faster. I looked into Azure Files and Azure FIle Syncs with and without local Brazil server. What do you guys recommend? Thanks.

Came across this in the wild today as a sysadmin, spoofed quarantine@messaging.microsoft.com email suggesting a forwarding group had a 98% full mailbox. Passed all SPF, DKIM, Dmarc checks because it came from a genuine Microsoft tenant. In the headers its given away by the actual tenant which was sirackoleji.onmicrosoft.com

Submitted to Microsoft for analysis and confirmed as a highly sophisticated spoof worth being vigilant.

How seriously was it taken? Was there genuine panic, or was it mostly business as usual? Did you spend months preparing for it, and what was the atmosphere like as midnight approached?

Would love to hear some firsthand stories, especially from those who were on duty that night.

Anyone trawling their estates currently gathering info for a big cleanup of affected software etc ?

PIP, Python, Homebrew, Ubuntu, Debian......just trying to get our heads round what needs updating and what doesn't.

Feels like Heartbleed all over again.....

Apologies if this has been asked before:

Does anyone have any practical solutions for application whitelisting for RHEL Linux?

Thank you!

I’m looking for some advice on my next career move.
I have almost 5 years of IT experience and currently work in a VIP Desktop Support role as a contractor for a large healthcare organization. I’ve been in this position for 1.5 years, as a contractor but there’s no clear path to becoming a direct employee yet.
I recently received an offer for an IT Systems Analyst position at manufacturing company. The role involves maintaining the IT infrastructure, servers, networking, Active Directory, and Microsoft cloud services of the company.
I’m trying to figure out which opportunity would be better for my long-term career.
My current role has given me valuable experience supporting executives and working in a large enterprise environment. However, the new position could help me develop more technical skills outside of desktop support.
My long-term goal is to increase my earning potential and eventually move into sysadmin, network/cloud engineering or cybersecurity roles.
For those with experience in IT, would you stay in a contractor role at a large organization with a recognizable name, or move to a Systems Analyst position to gain broader technical experience?
The new job offers me 30% pay increase with benefits . which path would you choose, and why?
I’d appreciate any advice, especially from people who have made a similar transition.

Azure hybrid environment here. We currently append user email signatures via a transport rule. Looking at CodeTwo, but I still think I'll have to solve this problem.

Some users have professional credentials they want to list after their name. In the past, the handful of people we had, we just added it to the display name, which is kind of clumsy. We can continue with that I suppose, but I wonder if there's a better way (like, . Side note, how do you handle, if at all, credentials that require a trademark symbol?

I could add these as attributes and format them in the transport rule, but I'm wondering what other ways people are doing this...

anyone else getting errors on the dashboard?

Public Sector US - not federal

Background: I was able to land position on the helpdesk after a lay off ended my circuit working at MSPs. After a while due to upper management, previous security guy left and I ended up taking over most of the responsibilities as a stop gap until the position was filled in addition to my other responsibilities.

Eventually was approached and offered the the position full time, so would get the title and big pay bump. I've been doing a decent chunk of the job already and the pay would've been big for me (low 60k to high 70k) so I said yes.

Fast forward I get the promotion offer and the rough responsibilities seem pretty broad for one person. CyberSec Analyst/Lead, Tier 1/2 Access Control Tech, AI advisor(?) plus some governance stuff.

I've already been doing and learning the first half somewhat ok I think, with plans to do more already but AI hasn't been full swing here yet as no one wants to pay for it minus what's included in our GCC licenses and nothing really with governance yet either.

There's also a big "numbers first" initiative happening with the big wigs.

Anyone that's been in a team of one position like this before have any advice on how to approach things? CYA, etc?

A heads up in case you weren't aware, a patch is being released tomorrow for two RCEs found in PHP core by Calif^\1].) It affects PHP version 5 onwards^\2].)

The RCE appears to work on default installations of many commonly deployed services and frameworks such as WordPress, Magento, Laravel and more^\3].)

If you have deployed any service that runs on PHP, prepare to patch ASAP. As soon as the patch drops, attackers will begin to weaponise the vulnerability at scale.

Patch is reportedly being released at 14:00 UTC, however as per PHP's announcement (We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.), it may well drop sooner since details are beginning to leak.

[1] https://www.php.net/index.php#2026-10-20-1
[2] https://watchtowr.com/intelligence/php-cve-2026-109618-faq/
[3] https://x.com/k_firsov/status/2112641845926989944

EDIT 03:00 UTC - A PoC for the vulnerability has dropped within the past hour: https://jackalsyn.com/posts/php-up-2026.html. This post mentions potential mitigations, but to be safe you should take any internet-facing PHP apps offline ASAP until you can patch properly, less you risk getting pwned. 🫡

EDIT - Patches are out: https://www.php.net/archive/2026.php#2026-10-21-5

https://www.cyber.gov.au/essentials

We've been working towards E8, thankfully don't need to start from scratch.

Any other (Aussie) E8 sysadmins have an opinion on these new principals?