Chained PHP Exploit Compromises 25 Servers, Including Some US Government Systems

·1 views

A chained exploit dubbed PHP2Shell was reported to have gained root access on 25 servers. The compromised machines reportedly include servers belonging to the US government. The source material is a brief Hacker News link post with limited detail, linking to a blog post from DreamGroup that describes the attack. Specifics such as the timing of the intrusions, the exact vulnerabilities chained, and the affected agencies were not available in the provided text.

Read the full story at Hacker News

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Exposing a local MCP server: tunnels are easy, access control is the hard part

A DEV Community article argues that making a local MCP server reachable is the simple step, while deciding who can call it and revoking access without redeploying takes most of the effort. It explains that stdio transport only works for one person on one machine, so remote use needs HTTP or SSE transport. The author outlines four needs: a stable address, transport, authentication, and revocation. Five approaches are compared, including ngrok, Cloudflare Tunnel with Access, exposing a port directly, and moving the server to a VPS. The piece ends by describing an outbound-relay model in which the server connects out to a relay and nothing listens on the local machine.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Prewarming a Voice Agent Cut Model Costs but Not First-Reply Latency

A voice agent team found that prewarming the LLM before calls connected accounted for nearly 60% of their model spend, even though many calls ended before any conversation began. Most calls failed at voicemail, no answer, or within a turn or two, and retries made up about a third of volume with a high failure rate. They disabled prewarm for retries, and latency for prewarmed and non-prewarmed calls turned out nearly identical, with p50 around 1.2 seconds in both cases. A controlled test reproduced the same result, and prompt caching was already hitting about 98% on prewarm replies, so the prompt was warm regardless. The finding suggested the expected speed benefit was not materializing, prompting a closer look at where the delay actually came from.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Ghost in the Terminal: A Local AI Storyteller Built for Hacktoberfest

A developer has created Ghost in the Terminal, a command-line program that answers questions in the voice of a spooky ghost. It is built as an entry for the Hacktoberfest Open-Source AI Challenge and is designed to tell eerie stories about abandoned servers and forgotten programmers. The app runs the Gemma 3 1B open-weight model locally through Ollama, using Python to communicate with Ollama's local API. Because it runs on the user's own machine, no cloud AI API key is needed and prompts stay on the device. The project's source code is available on GitHub for others to download and modify.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Linking an issue to a pull request with Closes #number so it closes on merge

The guide explains how to connect an issue and a pull request so the issue closes automatically when the pull request is merged. Writing a supported English keyword such as Closes followed by the issue number in the pull request title or description creates the link. The example uses issue #4 in the repository xlliu/test-pr-example, which is linked by pull request #9. Issue and pull request numbers are counted separately within each repository, so the number must refer to the correct item. The author recommends placing the keyword in the pull request description and refreshing the page to confirm that both sides show the link.

0 comments Read more at DEV Community