Malwarebytes:

If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched.

[…]

Successful exploitation could let an attacker run malicious code on an affected server without logging in. That code would run with the permissions available to the PHP process, potentially allowing attackers to steal application data, alter website content, or establish a backdoor.

[…]

The PHP team scheduled its emergency security updates for October 21 at 10:00 am ET (14:00 UTC). It has now released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and urges users to update immediately. Administrators should check with their hosting provider or operating system vendor for the appropriate updated packages.

Adam Engst:

Expect to see numerous websites go down or serve “Page not found” errors as they update PHP, the programming language that underpins 70% of websites. If you run a WordPress, Drupal, or Joomla site, this affects you directly.

Nick Heer:

Word on the street is that these exploits have leaked, and that remote code can likely be executed all the way back to PHP 5. If you have access to your website’s php.ini file, it might be worth turning off multipart uploads for now.

Vincent Schmalbach:

Two changes reduce the risk until the fixed versions are out. They were checked against PHP’s source code and the PHP manual, but they are not an official PHP mitigation. When someone suggested that turning off session upload progress might be enough, PHP core developer Gina Peter Banyard replied, “The only thing I can say is that the only mitigation is patching / upgrading PHP. I sadly know too much.” Use the stopgaps to lower the risk for a few hours, and update PHP as soon as the fixed builds exist.

Add to php.ini:

session.upload_progress.enabled = Off

Add to .htaccess:

<If "req('Content-Type') =~ /multipart/i">
    Require all denied
</If>

Guido Fawkes:

Ofcom boss Dame Melanie Dawes has admitted today that tech firms have paid just two of the eleven fines handed out under the Online Safety Act since March last year. Giving evidence to the Culture, Media and Sport Committee, she conceded nine remain unpaid, four of the offending sites have simply geo-blocked the UK, and three are still up and running with nothing changed.

Via Preston Byrne (Hacker News):

American courts have, by now, provided their preliminary view on the likelihood of Ofcom’s enforcement powers being successful in U.S. courts – the obiter dicta in 4chan v. Ofcom, the opinion in the case we filed against Ofcom in the federal District Court for the District of Columbia a little over a year ago.

[…]

Ofcom can’t enforce the Online Safety Act in America. Ofcom knows it, Ofcom has known it for a long time, and now, Ofcom has, finally, admitted it.

[…]

The GRANITE Act, a foreign censorship shield now before both the House and Senate (H.R. 10174 / S. 5478), is one proposed legal response America could adopt. The HOMEFRONT Act, H.R. 10309, is another. Either of GRANITE or HOMEFRONT would strip sovereign immunity from foreign censors and let Americans targeted by their orders drag those agencies into federal court, where they could be held accountable for their actions.

Previously:

• UK Child Protections and Messaging Backdoor
• Imgur Blocks UK Users Over Age Verification
• UK Online Safety Act
• UK Proposal to Weaken Messaging Security

TheLastProject (Hacker News):

In the [EU age verification] README, the following is listed:

App and device verification based on Google Play Integrity API and Apple App Attestation

I would like to strongly urge to abandon this plan. Requiring a dependency on American tech giants for age verification further deepens the EU’s dependency on America and the USA’s control over the internet.

Bobby Borisov (Hacker News):

The European Union’s open-source age-verification project has drawn criticism after a maintainer confirmed that hardware-bound attestation is a mandatory architectural requirement, raising concerns about Linux, custom Android ROMs, and independently compiled applications.

[…]

The solution lets users prove they are over a certain age without revealing their name, exact birth date, or full identity document. To prevent credentials from being copied, cloned, or reused by modified clients, the project relies on keys stored in protected hardware like Android TEE, StrongBox, or Apple’s Secure Enclave.

However, critics claim that this approach endangers the system by making it dependent on a small number of approved devices, operating systems, and attestation providers.

Positiveblue (Hacker News):

Cloudflare’s new “signed agents” pitch sounds like safety but it’s a wolf in sheep’s clothing. They’ve built an allowlist for the open web and told builders to apply for permission. That’s not how the internet works. An application form is not a standard.

GrapheneOS:

Apple and Google are gradually expanding their use of hardware-based attestation. They’re convincing a growing number of services to adopt it. Google’s Play Integrity API and Apple’s App Attest API are very similar. Apple brought it to the web via Privacy Pass, which Google intends on doing too.

Google’s Play Integrity API requires hardware attestation for the strong integrity level and is gradually phasing in requiring it for the more commonly used device integrity level. Apple already has it as a requirement. Over the long term, this will increasingly lock out hardware and OS competition.

The purpose of these systems is disallowing people from using hardware and software not approved by Apple or Google. This is wrongly presented as being a security feature. Banks and government services are the main ones adopting it but Apple and Google are encouraging every service to use it.

German National EUDI Wallet Architecture Documentation (Hacker News):

When issuing the PID, the WB confirms to the PP (via OpenID4VCI Key Attestation) that the keys to which a PID is to be bound are controlled by an authentication means that meets certain security requirements with regard to resistance against attackers with a certain attack potential (see ISO/IEC 18045).

Simon B. Støvring:

It’s great that App Attest is coming to Mac with macOS 27. It means I can ship Canvases’ intelligence and sharing features with much more confidence, knowing I can protect the endpoints with App Attest.

Previously:

• Instagram Charging for Links
• The Age Verification Trap
• Apple Platform Security Guide (January 2026)
• EU Council Approves New “Chat Control” Mandate
• Google Abandons Web Environment Integrity API
• Web Environment Integrity
• App Attest

Toni Sagrista Selles (Hacker News):

In a dramatic turn of events, the Chromium team has reversed its Obsolete tag, and has decided to support the format in Blink (the engine behind Chrome/Chromium/Edge). Given Chrome’s position in the browser market share, I predict the format will become a de factor standard for images in the near future.

[…]

I’ve been following JPEG XL since its experimental support in Blink. What started as a promising feature was quickly axed by the team in a bizarre and ridiculous manner. First, they asked the community for feedback on the format. Then, the community responded very positively. And I don’t only mean a couple of guys in their basement. Meta, Intel, Cloudinary, Adobe, ffmpeg, libvips, Krita, and many more. After that came the infamous comment[…]

[…]

To top it off, a couple of weeks ago, the PDF Association announced their intent to adopt JPEG XL as a preferred image format in their PDF specification.

Michael Larabel (Slashdot):

JPEG-XL image support is back in the very latest Google Chrome/Chromium codebase. Back in December they merged jxl-rs as a pure Rust-based JPEG-XL image decoder from the official libjxl organization. At the end of December they did more JPEG-XL plumbing with the enums and build flags for the support.

Luca Versari et al. (via Jarek Duda):

We’re excited to announce that Chrome is shipping decoding support for the JPEG XL (.jxl) image format starting from Chrome 155. JPEG XL is a next-generation image format designed to meet the needs of modern web developers and photographers. It offers 30-50% better compression than JPEG, lossless compression, built-in HDR support, lossless JPEG transcoding, and more.

In general, we recommend trying both AVIF and JPEG XL to get the best results. We expect that JPEG XL is most helpful for high-fidelity or lossless compression, especially of photographic images or in cases in which fine-grained progressive decoding is preferred.

Previously:

• Chrome Doesn’t Support JPEG XL
• iPhone 16 Adds JPEG XL

Meta:

If you subscribe to a Meta One plan, you can add links to a set number of posts and reels each month based on your plan:

• Meta One Advanced plan: up to 4 posts and 4 reels with links per month
• Meta One Expert plan: up to 8 posts and 8 reels with links per month
• Meta One Max plan: up to 12 posts and 12 reels with links per month

Via Nick Heer:

Instagram has never supported links of any kind in individual posts, so that is a new feature with two links per month permitted for free, and more enabled by this pricey subscription — starting at $50 USD per month for four posts per month containing external links. But links in Reels have been commonplace for years. Meta is now gating that, too; and there is more.

[…]

Meta seems to have two objectives here: to take a cut from businesses that use Meta’s services as a referral source more generally, and — more specifically — to capture some of the money made by influencers.

Requiring login, removing RSS, discouraging links. Things are not looking good for the open Web.

Previously:

• Reddit to Remove RSS
• Twitter Now Requires Logging In
• “Link in Bio” Is Apparently a Billion-Dollar Business
• “Link in Bio” Is a Slow Knife

OpenAI:

Starting today, API customers globally will be able to opt in to text watermarking for select models. Text watermarking will remain off by default in the API.

Over the coming weeks, we will add an invisible watermark to eligible ChatGPT and Codex text output in the European Union.

[…]

More details about how textGrain works can be found in our technical report (opens in a new window), which will be updated with additional details in the coming weeks. We also plan to make the technology available in open source so that others can build on it.

[…]

At a target false positive rate of 1%, our detector identified watermarks in about 80% of 200-token passages, compared with about 95% of 400-token passages, for content such as psychology.

Via John Gruber (Mastodon):

OpenAI has made this available via an API so developers should be able to actually see if this adulterates text output with real-world usage.

Third, none of these companies have yet made their watermark detectors publicly accessible. I remain highly skeptical that they will work as advertised in the real world. I think this is all somewhat of a sham to claim compliance with the EU AI Act without actually providing anything that anyone can actually use in a practical way.

Previously:

• How Claude Marks AI-Generated Content

Jeff Johnson (June):

This new RSS rate limiting was perhaps foreshadowed by an r/modnews post a couple of weeks ago[…]

judy-funnie (September, via Jeff Johnson):

Because RSS is now a common surface for large-scale scraping and automated abuse, we'll stop supporting RSS feeds on November 13, 2026 while preserving moderation workflows that depend on it through supported alternatives.

[…]

To close this gap, in the next few months, we'll further limit access [to Old Reddit] for logged-in users to only those who have used Old Reddit in the last six months (which covers the vast majority of all Old Reddit users).

Ana Maria Constantin:

Public API access ends in March 2027, Reddit said in a separate post for developers. It will stop accepting new API requests on 31 October. From 12 January, it will start cutting off apps that have not registered.

Jeff Johnson:

Since I use RSS to follow Reddit, I intend to discontinue my Reddit use on November 13, unless Reddit backtracks on their user-hostile decision to drop RSS.

[…]

My biggest regret in leaving Reddit is that I‘ll have to shut down my product support subreddit.

[…]

The most ridiculous part of Reddit’s announcement was the suggestion that subreddit moderators replace RSS feeds with Discord notifications. What perversity, insanity to recommend a competing social network as the only practical way to use yours! I’m also skeptical of Reddit’s public excuse for dropping RSS: bot scraping. As I noted back in June, Reddit is already rate-limiting RSS feeds. If the current limits are insufficient, why not impose stricter limits?

John Brayton:

I am disappointed because I know that many Unread customers use Reddit’s RSS feeds to keep up with subreddits.

Sarah Perez:

Moderators have already expressed worry about how this shift would impact their workflow. When Reddit hinted earlier that it was preparing for the end of RSS on its site, many responded by complaining that Reddit would become unmanageable for them. Meanwhile, many users stressed that RSS was how they enjoyed accessing Reddit’s content.

Previously:

• Old Reddit Now Requires Logging In
• Reddit Pushes Web Visitors to App
• Reddit Will Block the Internet Archive
• Reddit AI Training Data and IPO
• Apollo Shutting Down June 30th

Update (2026-10-07): John Brayton:

I overlooked the fact that Feedly uses Reddit’s API to retrieve articles from subreddits. The folks at Feedly expect this functionality to continue working after Reddit removes their feeds.

A Apple bloqueou recentemente oito certificados vulneráveis que eram utilizados pelo Safari para determinar se uma página da web era legítima ou não — recurso que existe para proteger usuários de cópias baratas de sites feitas para golpes.

De acordo com informações do BleepingComputer, essas chaves privadas foram revogadas pela autoridade certificadora indiana eMudhra após pesquisadores descobrirem que eram tão fracas que qualquer pessoa poderia utilizá-las para forjar um certificado de uma página legítima.

Além do Safari, navegadores populares como o Mozilla Firefox e o Google Chrome também se baseavam nesses certificados para proteger usuários. Em um relatório, inclusive, a Mozilla explicou que todos os oito certificados utilizavam chaves privadas P-384 (geradas em abril de 2025), as quais tinham valores menores que 256 — o que permitia a qualquer pessoa recuperá-las testando apenas 256 possibilidades.

Descoberta primeiro por um pesquisador identificado apenas como Wayne, em 17 de outubro, a vulnerabilidade foi demonstrada no GitHub por outro pesquisador chamado Flüpke, o qual mostrou que uma chave privada para o certificado “EM OV TLS CA – G3C” da eMudhra contava com um valor de apenas 4.

Em uma resposta à Mozilla, desenvolvedora do Firefox, a eMudhra disse que identificou um erro em um script usado para gerar certificados que fazia com que um segundo conjunto de chaves mais fracas fosse gerado — as quais eram, então, selecionadas erroneamente como as chaves definitivas por terem rótulos parecidos com os das chaves corretas.

A autoridade também colocou panos quentes na situação ao afirmar que a maioria dos certificados nunca foi usada em produção e que não encontrou evidências de que o problema tenha afetado usuários finais.

Além do Safari, o Firefox e o Chrome também já revogaram esses certificados.

Macs ainda podem estar vulneráveis

Ainda de acordo com o veículo, Dennis Jackson, engenheiro de criptografia da Mozilla, alertou que o utilitário embutido /usr/bin/curl do macOS poderá continuar confiando nesses certificados vulneráveis, pois o seu bundle de certificados não verifica se os certificados foram revogados.

Isso quer dizer que, caso o Mac já tenha aceitado algum desses certificados, ele continuará confiando nele até que haja uma correção — algo que só poderá ser feito em uma futura atualização de segurança.