About the Forum Downtime

[miyako]

Just saw the banner hanging at the top.

So is this something like the earlier update or are we getting some new features?

And how long is the downtime going to last?

 

[DukeDuck]

Just saw the banner hanging at the top.

So is this something like the earlier update or are we getting some new features?

And how long is the downtime going to last?

Click to shrink...

It's done

 

[Aspic]

It was because the PHP foundation announced having found 2 critical vulnerabilities, and in short, like most of the internet QQ had to update (and have downtime) in order to get the patch.

Edit:
Btw, here's the original post that launched the apocalypse, if anyone is interested : https://www.php.net/archive/2026.php#2026-10-21-5
And more about it from the PHP foundation : https://thephp.foundation/blog/2026...ease-and-how-were-strengthening-php-security/

 

[Doggydog]

It was a because the PHP foundation announced having found 2 critical vulnerabilities, and in short, like most of the internet QQ had to update (and have downtime) in order to get the patch.

Click to shrink...

Yeah, like 3/4 of the internet was vulnerable, wild vulnerability

 

[FableWright]

I just wish that it would be telegraphed that posting would be impossible from 1:30am to 10am before the update. THAT was a nasty surprise.

 

[Dusk Star]

Welcome to 2026, things are only going to get crazier from here!

The video was definitely something, every demo needs a dancer right?

 

[LurkingInTheDeceit]

I just wish that it would be telegraphed that posting would be impossible from 1:30am to 10am before the update. THAT was a nasty surprise.

Click to shrink...

That was accidental collateral of a temporary protective measure, not deliberate, so giving advanced warning wasn't really possible.

 

[Dusk Star]

That was accidental collateral of a temporary protective measure, not deliberate, so giving advanced warning wasn't really possible.

Click to shrink...

Ah from disabling multipart uploads I assume? Thanks for being on top of that

 

[Vanrus]

Just glad they were on top of the issue, sounds like there's still a lot of places which need to get their security patched.

 

[croaker]

I don't think we use node.js, do we?

Node.js — Wednesday, October 21, 2026 Security Releases

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

nodejs.org

Node.js Brotli decoder out-of-bounds write permits remote code execution (CVE-2026-111497) - (high)

A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Thank you, to mcollina for reporting this vulnerability and thank you aduh95 for fixing it.

Click to shrink...

 

[tacobowl8]

Ah from disabling multipart uploads I assume? Thanks for being on top of that

Click to shrink...

It was actually alethiophile being on top of things, so all credit to them. They were also the one to do the actual patching.

 

[Bear_Mint]

The number 4 was so spooky it killed QQ

 

[Dusk Star]

The number 4 was so spooky it killed QQ

Click to shrink...

Distressingly that was actually a completely different all hands on deck vulnerability

 

[steamrick]

Good news everyone: the php saga is probably only just beginning.

Elise (@elise@katze.sh)

Attached: 1 image still works on 8.5.12!

fedi.katze.sh

 

[TheFabulousCustodes]

That was accidental collateral of a temporary protective measure, not deliberate, so giving advanced warning wasn't really possible.

Click to shrink...

I thought I'd gotten banned/infracted until I saw everyone else had stopped posting as well.

Just glad they were on top of the issue, sounds like there's still a lot of places which need to get their security patched.

Click to shrink...

AO3 has patched their stuff as well, in case anyone is wondering.

 

[NumberSix]

PHP's core code is what you get when somebody in the early 90s fuses together some C and Perl and calls it Personal Home Page.
This language was never built to run anything remotely scalable.

I am very, very glad I dirtched the one NextCloud server I have running in favor of Syncthing.