Notes
Tool behavior, experiments, unfinished research, and things I needed to write down before I forgot them.
The bar is lower. Evidence is still required when I’m accusing something of being stupid.
-
NOTE
PHP critical release: defensive telemetry during reported active exploitation
PHP has shipped fixes for CVE-2026-109618 and CVE-2026-109619. What the advisories confirm, where vendor packages stand, and what the YARA rules can and can’t see.