Could @nahime0 Elephc be faster than PHP and sometimes even faster than C? Yes 🚀

#Battlefield3 was released 15 years ago today 🎂 October 25th, 2011. One of the greatest Battlefield games to date. So far ahead of its time.

Même les journalistes sont choqués.

The DOOM gate is open. elephc 0.27.6 is here, bringing the compiler improvements behind our rebuilt PHP DOOM showcase. This release brings: - Faster numeric loops and fewer heap allocations - Method inlining and faster final-class dispatch - C-width packed fields and buffers: u8, u16, i32, f32 - buffer_ptr() for passing buffer memory directly to C - Arrays of buffers and pointers, plus static buffer properties - Nullable strings in C FFI - Faster compilation for large projects - PHP compatibility fixes and safer memory handling Original WADs. Textured BSP rendering. Sprites, doors, lifts and teleporters. Written in PHP. Compiled to native code. Frame rates capped by VSync. Thousands of PHP demons are escaping hell to star elephc on GitHub. ⭐ github.com/illegalstudio/ele…

Now live: abliterated-model-large-flash (our version of DeepSeek-V4.1-Flash-1017). It is a cheaper alternative to our GLM-5.3-based model for product owners and defenders who need access to the most cyber-capable models. - 1M context - Vision - Zero input/output retention or training We believe paying customers should be in control, and over the past few months, leading experts and major brands have adopted our models. abliteration.ai

The whole Random Access Memories album was very strange when it came to music videos: - Get Lucky was arguably THE song of 2013 and yet had no music video, only these short promo clips - Lose Yourself To Dance got a video, despite never really taking off as a single - Contact wouldn't get a music video until 2025, 12 years after the album released, and it was Fortnite - Other than Instant Crush, with quite a normal video, no other songs (including Giorgio by Moroder and Touch) ever got a video

While waiting for PHP release, we explored the topic behind the exploit called php2shell, the first investigation confirmed that the main exploit path was covered and only tests were missing (merged in github.com/illegalstudio/ele…), after reading qideng.substack.com/p/php2sh… and running a set of tests against Elephc, we found one issue that could be exploited (others were already covered). To solve it, github.com/illegalstudio/ele… was tested and merged, Elephc is now waiting for the release from PHP to investigate further and ensure that everything is covered. As stated before, take this issue seriously, update your stack once the patch is live.

BEFORE READING FURTHER, take this issue seriously, update your stack once the patch is live. I don't like to do things like that publicly while others are facing a huge security issues but if you're using @nahime0 Elephc, your application is safe and secured against this issue, here's the explanation of the implementation on Elephc: - Elephc is storing fields/data in a Vec<u8>, the tracker does not keep any address related to session cells. - The position of the HTTP body are offsets, the progress position is determined from this offset and the current buffer size. - Each file has its own metadata, if a new file is encountered, Elephc register it a new file and current file data are reset. - The `serialize_progress` function build a new buffer each time that a file is uploaded then `rmw()` open a new session file, lock it, read the data, replace the current entry and write the final file. - The upload tracking is separated from the execution handler, to be simpler, as no pointers are used, no data is kept during requests / upload. If you want to dive into the current implementation, here's the file related to file upload: github.com/illegalstudio/ele…. Keep building with PHP 🐘

Teamwork makes the dream work. The team and I @J4ck3LSyN @Archknight23 🚨 Heads-up for anyone running PHP: two critical RCE bugs, patch drops tomorrow. The PHP project has confirmed an emergency security release for two critical remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. 📅 Patch lands Wednesday, Oct 21 at 14:00 UTC (9:00 AM Central). PHP has reserved the right to ship it earlier if details leak or exploitation shows up. PHP runs about 75% of the web, including WordPress, Drupal, Joomla, Laravel, Magento, and countless custom apps. If you operate a PHP server, this is your weekend-ruiner unless you act. Here's the part the big threat-intel shops aren't shouting about: No official technical details are public yet. But based on my own source-code analysis of php-src, my best assessment (moderate confidence, NOT officially confirmed) is that the vulnerable path is PHP's session.upload_progress / multipart form-data (rfc1867) handling: 🔹 Present since PHP 5.4 🔹 Enabled by default (the compiled-in default is On; the sample php.ini ships it commented out, so stock installs have it live) 🔹 Processes uploaded request data before any of your application code runs, so it's reachable pre-authentication on a default config That lines up exactly with the public breadcrumbs: "affects default installs," "every version since 5.x," "fires before user code." Treat it as a working hypothesis, not gospel. The official advisory supersedes all of this when it lands. ✅ What to do right now: 1. Inventory your PHP. Know every host and version (php -v). Anything on PHP 7.x or older won't get a fix, so plan to upgrade. 2. Apply the stopgap (best-intel, low-risk, reversible). In php.ini / .user.ini / .htaccess: session.upload_progress.enabled = Off Reload PHP-FPM or your web server. My analysis says this closes one of the two likely paths. 3. Clamp multipart uploads at the edge. The second likely path lives in the multipart parser itself, which runs for any multipart/form-data POST regardless of the setting above. If you've got a WAF or reverse proxy, tighten inspection or rate-limit multipart POSTs to endpoints that don't need uploads. This is the same network-layer mitigation the enterprise vendors are quietly deploying for their paying customers. 4. Patch the second it drops. Current stable: 8.5.11 / 8.4.26 / 8.3.35 / 8.2.34. If your hosting is managed, confirm your provider's timeline today. Why I'm posting this for free: A pre-patch mitigation shouldn't be a subscription perk. I'm a one man shop, and the orgs most likely to get burned in the gap between leak and patch are the small teams without an enterprise threat intel contract. The steps above cost nothing. Spend tonight reducing risk, not tomorrow doing incident response. I'll follow up once the official advisory publishes and confirm whether my root cause read was right. Stay patched. 🔒 #PHP #CyberSecurity #InfoSec #RCE #CVE #WordPress #Laravel #ThreatIntel #VulnerabilityManagement #AppSec

// NEW UPDATE INCOMING… [v.2.5][22.10.26]

Nvidia CEO Jensen Huang to Chancellor Merz: I've also heard you say that you want to find that balance between innovation and regulation. There's nothing to regulate if the industry doesn't thrive.

RAM is the new bottleneck. Every Node.js process is fighting for memory: containers, serverless, cloud bills, k8s limits. And here's the maddening part: V8 can use half the memory with one flag, and almost nobody turns it on.

Il y a quelques jours, DHH, le créateur de RoR, a écrit que l'immigration était une « catastrophe » pour l'Europe. Je lui ai dit de fermer sa grande bouche. J'ai passé la soirée à bloquer des racistes. Alors j'ai creusé. Et la tech bascule bel et bien dans le fascisme. 🧵

There is an absolute shift happening and it's not in favor of PC. PC gaming sucks and at least more are finally admitting it publicly.

Les boomers pendant que le pays se fait piller.