Nils Adermann

@naderman

Co-Founder of @packagist / packagist.com and Co-Creator of #composerphp - he/him - @[email protected]

Berlin, Germany

naderman.de

Joined January 2008

1,224 Following

5,404 Followers

Replies Reposts Media

Nils Adermann
@naderman
Oct 29
@mitchellh another one for your OSC7501 list: Composer package manager for PHP 😃
Packagist
@packagist
Oct 29
Composer 2.11 is out 🚀 cooldown dependency policies hold back freshly published package versions for an hour or a day, so compromised releases can be flagged before they reach your composer update. blog.packagist.com/composer-2-11-… #php #phpc #composerphp #supplychainsecurity
1
Nils Adermann
@naderman
Oct 25
Let me help you @TechCrunch: @AWS labeling honeypot hits with PHP_SESSION_UPLOAD_PROGRESS as php2shell is absurd. That field has been in public PHP crash reports and exploit writeups for 10+ years. Likelier: attackers stabbing in the dark with old public info 🧵
TechCrunch
@TechCrunch
Oct 24
Two critical bugs in the PHP web programming language, used by the majority of the internet, threatened to upend the internet — and it's unlikely to be the last major software scare. spr.ly/6018BHdOTy
4
Nils Adermann
@naderman
Oct 22
If all the govs shutting down servers for a PHP update, all the hosters & enterprises terrified by the vuln, gave $100k, or just $50k a year to the PHP Foundation, things could look very differently. Go, make your employer sponsor *today* thephp.foundation/sponsor/ #php #phpc
Sponsor The PHP Foundation
From thephp.foundation
4
Nils Adermann
@naderman
Oct 22
The keyword here is *attempts* and this is getting a bit frustrating, @AWS threat intelligence put out a similar statement. But all this is, are requests trying to find a way in, trying to corrupt memory. They don't describe anyone who actually figured out the rest of a chain for
Matthew Prince 🌥
@eastdakota
Oct 22
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
1
Nils Adermann
@naderman
Oct 21
So I guess now is the moment where I start thinking about the fact I'm supposed to give a talk on PHP supply chain security at @MeetMagento_DE tomorow and in the midst of all this haven't really prepared a talk yet? 😆 Guess worst case it's an AMA
5