Creator of Fido for @teslafi and https://nitter.cf/t.co/NZZTaRmrtQ - Laravel Artisan - Inertia JS Fan - Go Crew! - Go Bucks!
Columbus, OH
Joined April 2009
- Tweets7.5K
- Following294
- Followers442
- Likes13.4K
Vince Mitchell retweeted
In the American Midwest, grown men do not say "I care about you" when you leave at night.
Instead, they say three words:
"Watch for deer."
I heard it for the first time at a rural gas station in Michigan at ten at night. The attendant handed me my receipt, glanced out at the dark pine trees beyond the pumps, and said, "You be careful out on County Road 12. Watch for deer."
I thought it was a wildlife report.
Then I had dinner at the home of a local mechanic and his wife. When I stood up to leave at nine, it took forty-five minutes to reach the front door because we had to have three separate conversations while standing in the kitchen, the hallway, and the porch.
Finally, the mechanic walked me all the way out to my car in twenty-degree cold without a coat.
He waited until my heater was blowing warm air. He tapped the roof of my car twice with his knuckles, leaned down to the window, and said, "Text me when you get to the hotel. And watch for deer."
In Japan we have many formal phrases to wish a traveler safe passage.
None of them are as warm as a man standing in the snow in his flannel shirt, blaming the local wildlife because he is too shy to say he wants you to live a long life.
Vince Mitchell retweeted
Your Inertia pages can now update themselves in real time. ⚡️
Mark a prop as live and connect it to a broadcast event. Whenever that event fires, Inertia refreshes just that prop, without polling. Perfect for order statuses, unread counts and dashboards.
Vince Mitchell retweeted
Laravel Cloud Console has shipped. 🖥️
Easier to show than tell, so here’s a video.
✓ Interactive shell for every Laravel Cloud application.
✓ Run any command.
✓ Full audit trail with replay capability for every session.
Vince Mitchell retweeted
3D Model Anything scanner app is now in the app store! Give it a shot an send any PRs on github apps.apple.com/ca/app/3d-mod…
I have discovered the the BEST way to get 3D modeling results from LLMs
The app LiDAR scans the room while taking hundreds of high quality photos.
Then a workflow + skill I've created models out every item recursively checking the model against the photo at the exact spot + angle where the photo was captured
The result is a a dimensionally accurate and high quality model of your room
All in my latest video on how to do it youtube.com/watch?v=JGQCcCzu…
Vince Mitchell retweeted
Forge is working normally, however the team has encountered issues bringing broadcasting back online so real-time updates are not operating correctly in the UI.
We are testing different solutions for the problem and in the meantime, please refresh the page in order to see page updates.
Vince Mitchell retweeted
Forge update: some users are seeing slower response times while we scale capacity to meet demand.
Patched versions for PHP 8.2, 8.3, 8.4, and 8.5 are available. Click "Update PHP" on each server, or update over SSH if that doesn't go through.
Review our guide for help → laravel.com/forge/docs/knowl…
Vince Mitchell retweeted
Good news everyone!
The absolute legends @ the Sury php mirror have backported the patch all the way back to 5.6
Vince Mitchell retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Vince Mitchell retweeted
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Vince Mitchell retweeted
For the Forge users, I've just published Update #5 to my post about the PHP CVEs thanks to @MidgetK.
The Forge API includes an endpoint for pushing patches for PHP versions: laravel.com/forge/docs/api-r…
securinglaravel.com/laravel-…
Vince Mitchell retweeted
The Cloudflare's writeup on our php2shell response is up.
Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared.
New rules keep landing in the WAF changelog.
Expect updates through out the day. We will have a more thorough post of what we had to build to better protect people coming shortly.
PHP runs almost 70% of websites. The flaw is in the runtime, so updating plugins won't fix it. Patch PHP.
blog.cloudflare.com/php-vuln…
Vince Mitchell retweeted
Living in the future!
Was watching @MostlyTechPod in a cybercab, @IanLandsman brought up @AmpCode, realized I should be orbin’ instead
There’s no general web browser in a cab, so I left a comment on YouTube with the amp url which let me open it
It’s orbin’ time
Vince Mitchell retweeted
One-click mitigation for php2shell vulnerability:
If you have Cloudflare in front of your PHP website, please login to the dashboard and click this button to make sure you are protected.
dash.cloudflare.com/?to=/:ac…
This reduces your risk but doesn't fix the vulnerabilities in PHP. We recommend updating PHP to a patched version.
Vince Mitchell retweeted
PHP Security Releases Fix Two Critical RCE Vulnerabilities posted by @ericlbarnes laravel-news.com/php-critica…
Vince Mitchell retweeted
PHP Security Advisories are out:
RCE via OOM corruption (9.2/10): github.com/php/php-src/secur…
RCE via stale global state (9.2/10): github.com/php/php-src/secur…
Need to upgrade to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 ASAP to mitigate. Updates rolling out now. #PHP
Vince Mitchell retweeted
This is exactly what waiting for a hurricane feels like. You keep getting ready but until it hits... you're just waiting for the turtle to close the distance.
#phpocalypse
Vince Mitchell retweeted
🚨 PSA
Worrying how the #PHP CVEs affect your NativePHP/SuperNative apps?
Good news:
*** NativePHP (by default) doesn't expose any sort of remote access to your apps ***
If you have explicitly added some form of remote access, you should take a closer look
Note: we don't yet have the full vuln details. Stay tuned. We are watching closely and will update as things develop
Questions? We're here. Reach out
Stay safe out there! 📱 🖥️