Am 27.10.26 um 08:25 schrieb Adam Williamson:
On Tue, 2026-10-27 at 00:31 +0100, Marius Schwarz wrote:
btw.. the next *2Shell issue is out : brotli decoder issue in all sorts
of apps, incl. nodejs, python, libbrotli etc. one malformed datapacket
and the server is gone... and there is no build in the node oven :(
Our nodejs packages do not bundle brotli. They use the system brotli.
Updates for brotli are in stable for F45 and testing for F43 and F44 -
https://bodhi.fedoraproject.org/updates/?packages=brotli .
Thanks Adam to clarify this.
update installed, system still working ;)
BTW: a working-in-the-wild exploit for php has been finally confirmed.
an anthropic researcher made a CTF for a bitcoin wallet and after 19h
php got exploited with a "typical" setup. They did not say what it
means, but he revealed that i had some nginx rules to make it a bit
harder, so something you could expect in normal webhosting (my thought:
anti bot rules). the full config was not released to verify it. In
other PHP news, the fix for CVE-2019-11043 did not involve php-cgi. this
was also patched on 8.4.27, but not specially attributed. hard times for
the php foundation :( best regards, Marius Schwarz--
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
