Your Modifier Is Dangling
21899
Many young people are throwing off their generationâs reputation for slovenly language, and taking up the gauntlet for good grammar.
465740
As Christopher Kunz points out, Serendipity users should check out a new blog posting over on the CMS system's website concerning an immediate update they've released.   Serendipity 1.1.3 and 1.2-beta2 have been released due to a SQL injection attack reported by Dr. Neal Krawetz today. It is possible to abuse a 'commentMode' variable to inject SQL code that was targeted to the function that fetches comment information. This variable was introduced to Serendipity 1.1 - all prior versions are not affected.   They also suggest checking you access logs for a "commentMode" variable issued in requests to see if there were any kind of attacks made already. The fix is a simple matter of editing the functions_comments.inc.php file and replacing the line of code they give with the more secure versions. Again, this is recommended as an immediate upgrade for Serendipity users.
633181
Gareth Heyes has a new post today talking about one of the vulnerable values in the $_SERVER superglobal - PHP_SELF.   I thought it might be a good idea to gather a few test cases demonstrating the problem. Why PHP allows these URL's is beyond me and it wouldn't take much work to filter out these malicious URL's in the PHP code.   He provides four test cases to show how simple it is to abuse - one using a HTTP header, another pushing XSS through, the third mentions search pages and the fourth a direct code injection.   You can download the code here.
453306
Tycho:  I'm super depressed.  I thought I had invented a new word - mirthquake - and then I was going to say that you should prepare yourselves for the aforementioned, as today's comic strip was rated this or that number on the rictus scale.  I mean seriously, I've been excited all weekend.  A simple Google search put me in my place - the word is practically ubiquitous.  Expect it soon on Urban Dictionary, that mausoleum of once vibrant language.
697974
Secunia has released an advisory for PHP today related to an issue caused by an integer overflow that could allow for bypassing of security of an application.   A weakness and a vulnerability have been reported in PHP 5, where the vulnerability has unknown impact and the weakness can be exploited by malicious, local users to bypass certain security restrictions.   The issue is caused by issues with the chunk_split and realpath functions that can lead to a bypass of the open_basedir restriction on a server.   The issue is marked as "moderately critical" and it is suggested that users update to PHP 5.2.3 to correct the issue.
474461
php|architect has a new note today about a contest that PHP-Editors is putting on...
193834
By Anonymous  ANCIENT TEMPERATURE DROP M
261201
When something right can do you wrong.
507785
Here's a little trick that can make all the difference.
201244
Your RSS reader is abusing the Slashdot server. You are requesting pages more often than our terms of service allow. Please see the FAQ link for more information, and if you email us, include your IPID MD5: ef67720fd10524f6c714fba3a4a3a08a.
663754
Microsoft has confirmed the existence of a vulnerability affecting the Windows Shell. The issue exists in the WebViewFolderIcon ActiveX control, and exploitation could result in an attacker gaining the same rights as a local user.
516095
'The bell once rung cannot be unrung'
126013
On Dynamically Typed today, there's a new posting concerning the PHP Atom Server.
362505
On Pierre's blog today, there's a release announcement about the "long awaited for" version of his Filter extension - version 0.1.0.0.   This release will be included in the upcoming PHP 5.2.0RC3, which is likely to be the last RC. Please report any trouble you find, and post your feedback (here, on the pecl-dev mailing list or in the issue tracker), it will help provide the best possible extension in the 5.2.0 release. A stable filter release should still hit the road this year.   Feature additons for this release include an input_get_args method, support for PHP's pcre expressions, JIT support, and support for custom decimal spacers. Several behaviors were changed as well, including when a value is FALSE or NULL, updates to the integer/float parser, and the default filter now being set to "raw".   You can get the complete listing of updates on the project from the Changelog and check out the project and all of its documentation on it's PECL homepage.
48646
In this new post to the PHP Security blog, Stefan Esser points out that an issue that was previously marked as corrected - a problem with the chunk_split function - hasn't completely been corrected.   This [bugfix] fixes the chunk_split() overflow (found by SEC-CONSULT) that was according to the PHP 5.2.3 release notes already fixed. The original fix was however not only broken but complete nonsense. If you can read C you will see that the integer overflow was not fixed in PHP 5.2.3 but simply moved into a separate line and an additional bogus if clause was added.   Stefan includes a simple four line code example to illustrate his point.
313870
You are seeing this message because you are using an older or unsupported browser, or because your browser does not recognize stylesheets.
513433
Mistakes prompt a demand for grammar to be policed.