A 16 KB name took 17.4 seconds to parse.
'Smith, ' . str_repeat('V ', 8188) on nameparser 1.5.0: every V is a candidate roman-numeral suffix, and the old scan walked back over every earlier token for each one. 1.7.0 parses it in 0.064 s on the same box.
A security scan found it. The same scan ran across all ten of my PHP extensions this month, and every fix is now released.
What's the worst junk row you've seen hit a production import?
ilia.ws/blog/seventeen-secon…
PHP 8.4.27 and 8.5.12 (CVE-2026-109618) changed memory_limit. The engine now queues the error and lets the allocation succeed.
A C loop in an extension never reaches a VM safe point, so it keeps allocating to a hard limit (2x memory_limit below 1 GiB) and the process _exit()s. No shutdown functions, php-fpm loses the worker. phpser, mdparser and pdo_duckdb now check ZEND_HAS_OOM() and stop on their own.
There's a catch. The new headers pull in smart_str_ferealloc(), which 8.4.26 doesn't export, so on Oct 26 five of my extensions shipped prebuilts that died with "undefined symbol" on older patches. All five were re-released the same day. The next pdo_duckdb, phpser and mdparser releases refuse to start on an older patch than they were built for.
pdo_duckdb 0.9.0, out today, bundles DuckDB 2.0.0.
The change most likely to bite: 2.0 writes storage version 69, and 1.5 reads only 64 to 68. If a 1.5 process shares the file:
new PDO('duckdb:/data/shared.duckdb;storage_compatibility_version=v1.5.6');
Also new: opt-in lossless fetches for LIST, STRUCT, MAP and VARIANT, and a fix for lost writes between two connections to the same file.
pie install iliaal/pdo_duckdb
github.com/iliaal/pdo_duckdb
Not sure if it is just curiosity or OCD, but been spending the morning digging into php2shell trying to reproduce the RCE, since none of the ready-to-go versions I saw worked. So far, under controlled conditions with a few deviations from stock PHP config, with a single process model using mod_php (PHP as Apache module) I am able to reliably trigger RCE on PHP 8.5.11 on stock Debian Trixie docker container.
The single process "cheat" is needed because it takes 4 requests to get things just right... I am still poking around and it's worth noting that I am not at the level of folks at @calif_io & @wiz_io, but I know my way around PHP internals and not a complete security neophyte. Obviously the experts may have far easier time getting there and doing something more universal.
It is also worth noting that while I am doing it on plain PHP (<?php echo "hi";) presence of a framework or large application would actually make it easier in some respects, but that's a story for another day.
Ilia retweeted
If all the govs shutting down servers for a PHP update, all the hosters & enterprises terrified by the vuln, gave $100k, or just $50k a year to the PHP Foundation, things could look very differently. Go, make your employer sponsor *today* thephp.foundation/sponsor/ #php #phpc @ThePHPF
Ilia retweeted
We have posted more information about today's security releases, including the sequence of events that led to the discovery, how the PHP security team is improving their processes, and what we need from you to continue this critical work. #php #security thephp.foundation/blog/2026/…
Ilia retweeted
PHP 8.4.27 released - 89 fixes in 30 components, including security fixes (CVE-2026-109618, CVE-2026-109619).
Changelog + downloads: php-net.pro/news/php-8-4-27-…
The case in the README: you ask Codex to change one setting and keep the rest. It rewrites the whole settings file and reports success. The reviewer flags the lost settings anyway.
Two hooks drive it. PostToolUse can start an async check after 6 completed tool calls; Stop checks at turn end, including turns with no tools. One note per check at most, sometimes none. Notes are advisory: a systemMessage to you, nothing added to the agent's instructions.
It runs on your existing Codex login, no extra API key, but each check spends model usage. Defaults: 120 s between checks, 30 per session, no call when the transcript hasn't changed. The reviewer sits in a read-only sandbox, and any tool use voids its result.
The idea is @ClaudeDevs's. What mine lacks: their native alert buttons and panel. Notes go through a skill or CLI instead.
codex plugin marketplace add iliaal/codex-you-should-know
codex plugin add you-should-know@you-should-know
Then trust both hooks in /hooks.
I had my doubts about Claude Code's "You Should Know" plugin. Then I came to rely on it, and every time I switch to Codex I miss it.
So I ported it. codex-you-should-know runs a separate reviewer over the recent session and tells you when the agent missed something that matters.
What did your agent last report as done that it quietly got wrong?
github.com/iliaal/codex-you-…
Does anyone know (or can help) on getting upgraded(?) from Daybreak Blue to Daybreak Red from @OpenAI
/cc @thsottiaux
Second correction on my Mythos A/B/C test, and this one matters more. Original thread: xitter.cf/iliaa/status/210932443…
In arms B and C, Mythos was only the orchestrator. My global Claude Code config routes subagents to agents pinned to Opus 5.5, so Mythos planned and delegated while Opus did the auditing. By message count, B was 24 Mythos to 510 Opus, C was 19 to 564. Only arm A, with no config, was Mythos end to end.
I was wrong about Mythos. Having had a chance to put it to work, it shows cyber capabilities I haven't seen from other models, including abliterated open-weight ones. Credit to @AnthropicAI.
The test: I pointed it at one of my projects. It found 20 distinct real bugs, one of them high severity. Every bug it called confirmed reproduced when re-run blind. Nothing fabricated.
The verifier earned its keep. It caught two DoS timings overstated by 3x to 16x and changed several severities. Bundled-library issues are going upstream, the security-relevant ones privately.
Been trying to use Muse wonder 1.0 (contributor) clearly @MetaforDevs doing some work 1st hit 100% of 5h limit in 40 mins, then they did a reset (thanks!) and one session hit 20% usage in 5h and 6% of weekly. Checked again now 5h usage reset to %0 and weekly still at 6%.
whetstone 5.1.1 fixes 20 findings from an external security scan of 5.1.0: 8 high, 6 medium, 6 correctness. Volker Dusch (@__edorian) scanned the plugin through OpenAI's Daybreak Red security program and reported them. Each one reproduced against the source before it was fixed. Thank you, Volker.
An agent plugin runs with your shell, your tokens, and your repo checkout. That makes it attack surface, and I would rather hear about a hole from a researcher than from an incident. If you find one in whetstone, report it privately: github.com/iliaal/whetstone/…
github.com/iliaal/whetstone
Two of the fixes change what the agent does with input it didn't write.
ia-git-worktree now copies .env files into a new worktree only when the base is the default branch, or a local branch that already contains the fetched commit. Branch bases are fetched as refs/heads, so a same-named tag can't stand in for one, and the copy never follows a symlink. The skill also tells the agent to skip install scripts and plugins in untrusted trees.
/ia-resolve-pr records each comment's authorAssociation. Comments from untrusted authors are report-only, and commits and pushes wait for you to approve the exact diff.
On the Codex side, install, convert, and sync now merge into config.toml between managed markers instead of overwriting it, so your approval_policy and sandbox_mode survive a sync. Writes stay inside the output root and refuse symlinks, config files are written 0600, and convert defaults --permissions to none, matching install.
Sync also stops on an unreadable or invalid Claude settings.json; it used to read that as "no MCP servers".
Distiller, SkillOpt grading, and release pipeline fixes are in the notes: github.com/iliaal/whetstone/…
29 skills, 18 agents, 19 commands.
Install: /plugin marketplace add github.com/iliaal/whetstone && /plugin install whetstone@iliaal-marketplace && /reload-plugins
