Recent content by ES Dev Team

Yes. The PHP team suggests remediating for now. This remediation should cover new / old versions of php and also all 3 CVEs: #Courtesy mitigations, updated 10/23/2026 #rationale: https://github.com/syhunt/php2shell-protection session.upload_progress.enabled = Off memory_limit = -1...

Another heads up. If you use the ondrej ppa to install and can't pull down patches because you're seeing 503.. the problem is likely you run the old repo for it here is your solution: First, google how to remove the launchpad ppa for your particular version of ubuntu, then copy and paste this...

I'm just finishing updating my fleet and i'm glad i did the mitigations last night; Unfortuantely yes, Xenforo does not take well to them, but it works on other apps. PHP team offered some other good mitigations if you're unable to upgrade.

I failed to get AI to make the PoC workable, here's the co-author's words. I hear also the PHP team members are saying the suggested mitigations won't work but i am applying the last line anyway.

Be prepared to update your PHP tomorrow as there'll be a patch for a 10.0 level CVE tomorrow. PHP.net is not releasing details until then. php.net is intermittently not responding so here is a screenshot of their latest message. Proof of concept attack...

Yes. i sometimes see periods of bots breaking through the protection, but never overwhelming the system anymore. The combination of fail2ban and anubis is quite good and we are typically meeting or exceeding the protection level provided by cloudflare without having to use a wall of cloudflare...

I've been running AI models for my dev shop since early 2025 for privacy, reliability, latency, and cost. I made this image to show my developers the progression of commercial AI vs what we are running on a 3 GPU setup. I don't think AI model intelligence is a problem today, however, the...

AI codes worse than me but in cases where speed is more important than quality, and the task doesn't take longer to describe by hand, i'll use it, read the code, test extensively, and do manual cleanup until it's equivalent to a product i would have hand-coded. Those latter steps - most people...

I've seen these kinds of attacks twice recently in logs and these bots are both numerous and seem to be pretty good at doing the evil. In neither cases did they get close to landing an attack because: i patch on the same day i hear of a security patch i add other layers of protection on against...

It takes some practice to understand how to get the clanker to do what you want. It also takes good software tools and setup to get good visibility and control. The hardest part is learning what level of detail you need to specify. If you want high quality results, you need high quality...

I find that a human in the loop type workflow ( versus having an agent do everything ) produces results that are equivalent to my quality, and in some cases, better than what i write. That's because you're fully connected to the entire process and you can intervene. Almost nobody uses that...

I get that because i've built some serious stuff with AI by now, but it's only made possible because i know how to program still ( for how long? ), do intensive systems thinking, and sweat all the details. My problem with things that look AI coded is that i don't know anything about the...

..and yes there are other design issues. We simpified i, the only part i haven't cracked is, why do we need the thread title and post button there... it's awkward, looks like a visual glitch, and wastes horizontal space. We'll fix it in 2.4. Hope team Xenforo sees this and copies our design

I kinda agree with OP. It would be ideal if updates were in another section so that you don't have to sift through all the various automated postings to see human communication. I find 'whats new' to be totally useless and from that POV it looks like nobody is participating in the forum due...