i'm disappointed but not surprised

We've decided to sunset Arc on December 22, 2026. That's not an easy sentence to write. We spent years building Arc and celebrating each and every release along the way: we have so much pride and love for what we made alongside the Arc community. Our priority is to deliver best-in-class security for our members. Keeping a browser secure takes constant, dedicated work that is only increasing in the age of AI. Dia was built from the ground up to meet today’s security standards, so that's where our engineering and security teams will focus moving forward. We've worked to make switching to @diabrowser as easy as possible for Arc members. Here's how: · Your passwords, bookmarks, extensions and history come over to Dia seamlessly. · Spaces, Folders, and Tab Groups are in Dia and import over with your data intact. · Dia now surpasses Arc benchmarks in stability, speed, and security. · The browser features you use in Arc are free in Dia, and the AI is optional. Thank you for using Arc, for pushing us to make it better, and for building alongside us. The team that made Arc is the same team behind Dia, and some of our most ambitious work is just ahead. We'd love for you to be there with us when it lands.

Prediction: Railway may have suffered a major security breach that exposed its customers API keys

🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases. CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers. Read - thehackernews.com/2026/10/cr…

What should have been today's XKCD

chat. chat... its not funny anymore

I pre-emptively disconnected ALL my sites / VPS servers from the web I'll wait for the patch to hit at 2 PM UTC If you have a PHP website, probably good to take them down until you patch PHP 69.3% of the web runs on PHP so this is going to be intense! Good time maybe to buy cybersecurity stocks? (not financial advice)

PHP's security team just confirmed two critical RCE flaws after a leak. Here's what you need to know. Security researcher Florian Roth posted that there is an RCE vulnerability in PHP core, rated CVSS 10.0. He said details were due October 20 and that only PHP 8 would get patches. The post drew 53K views. The story spread after a leak broke the embargo, which watchTowr had expected to hold until Thursday at 11am ET. The PHP Foundation then gave official advance notice. The security release is set for Wednesday, October 21, 2026 at 14:00 UTC, which is 10 AM EDT. It fixes two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The official rating is CVSS v4.0 9.2, not the 10.0 circulating online. The team says it may release earlier if details become public or active exploitation shows up. Some posts quoted 9 AM EDT, and watchTowr's post misprinted the CVE year as 2926. The leak is confirmed as real. watchTowr says the embargoed zero-days are real, and Previdian says it reproduced them. No technical details are public. Reports say the flaws touch PHP 5, 6, 7 and 8, but only 8.0 and up are expected to get fixes. That is unconfirmed. Researcher Nicolas Krassas plans to publish a lab on the bugs when the embargo lifts. Security commentators expect exploitation within minutes of the details dropping. PHP runs Wikipedia, WordPress sites, WooCommerce stores, Drupal sites and Adobe Commerce storefronts. Key numbers: - 2 critical RCE vulnerabilities - CVE-2026-109618 and CVE-2026-109619 - CVSS v4.0 9.2 officially, 10.0 in leaked reports - Patch release: Oct 21, 2026, 14:00 UTC - Patches expected for PHP 8.0 and up PHP admins should inventory their hosts now and update as soon as the release lands.

Funny ad placement 😅

protesters raided an Apple Store in Lille France yesterday, dumbest move ever 😭