The technology circle has proactively deactivated the cosmos.coop website, and some of our other member-facing services, temporarily.
A severe security issue has been found in PHP, the programming language in which Wordpress and several of our other tools are written, and details of the problem have become public before PHP were able to release a version fixing the problem.
The fix is now released, so we are closely monitoring for updates from our hosting providers, and the developers of the software relies on, about when they’re able to install it, after which we’ll reactivate the site and services as quickly as we can.
All updates are applied and everything should be back in operation. Please reply here, or email support@cosmos.coop, if you notice anything not working as expected.
Me either, Gennifrey, though I am always enchanted witnessing the mysterious special languages that programmers speak to each other (and to the computers…!) cyborg mystics indeed, those who can speak in code — literally!
“Oblique” playfulness of the captions indeed! They captivated me. I’m still puzzling over the image associated with Göbekli Tepe. Is there any meaningful connection between them or not? Is the connection hidden in all that tech talk?
I think this is just a narrative flourish, Stefan Esser is based in Germany (although it’s possible he was visiting Türkiye!)
@Gennifrey_Edwards@care_save a much-delayed attempt at a translation from nerd into English: Stefan Esser found a vulnerability in 2004; the new one found in August was similar (both were security vulnerabilities caused by using a setting to limit per-process memory for PHP).
I think one of the overall implications is that this was not – as widely reported – “newbie points LLMs at PHP”, but rather “dedicated security team, with advice from a 20±year PHP security researcher, used LLMs to expand on previous work”.
I’ll be honest, the details of how the memory corruption leads to server takeover are also a bit mysterious to me — the writeup of the first successful recent exploit of this issue is still on my reading list, maybe I’ll have more to share when I finish it!
