The workshop lights are back on, gave machinery some attention, kept the iris closed for a bit, and corrected a small time-travel mishap.
Ubuntu upgrade
On the 21st of October, we upgraded our servers to Ubuntu 26.04 (as in the difference between going from Windows 10 to Windows 11), the latest long-term support (LTS) release, which receives standard security maintenance until May 2031. We have a policy to upgrade to the latest LTS release after Ubuntu has deemed it ready for automatic upgrade (usually Ubuntu does this in August).
Ubuntu is a "stable Linux distribution"; these distributions release with a specific version of software, and it doesn't change within that release's lifetime. Rather than continually upgrading to newer versions, which will both introduce new features and also potentially cause breakages because things change, the distribution instead takes bug and security fixes for newer versions of that software and puts them on the pre-existing, older versions. This is really helpful for us because it means the only time we should expect issues with the operating system software stack is when we're doing upgrades, not normal distribution software updates, which we perform weekly.
So, knowing that we have upgraded to a new version of Ubuntu LTS, that's brought us newer versions of the included software. For us, this meant newer versions of PHP ℹ️ for our website and MySQL ℹ️ for our database.
As expected, we had to make changes to keep everything running. The newer PHP version exposed deprecated code in how our website communicates with other web services, so we updated it. We also updated some older page-layout code that failed newer HTML checks for deprecated uses.
Overall, that upgrade went well, partly because we upgraded our local development environments to the new version of Ubuntu LTS before, so we could test our changes before we did the actual upgrade on the servers.
After upgrades, we kept the system offline
We kept Alpha-Fox offline while we waited for PHP security fixes, which PHP had unusually decided to warn about before releasing them.
The PHP security team would like to give advance notice of an upcoming security release.
All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.
While this might sound unusual, the Dutch National Cyber Security Centre similarly decided to keep their services offline until they were apply to deploy the fixes. The PHP's developers later announced fixes for two serious flaws on the 21st October.
RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.
In theory, an attacker could be capable of using either flaw to run code on an affected server without logging in, in some cases, before it even gets to the point of executing our website code, since the flaw was part of PHP itself and not our code.
We also performed an audit of the server after the fact, and we found no confirmed successful attack using these flaws previously.
Extra protection
Having seen the kind of vulnerability, we decided to implement additional measures against similar kinds of attacks in future. We added stricter limits on oversized and badly formed requests and require them to be processed through a security layer before they reach PHP.
TARDIS spelling
Thank you to Ikaros Alpha for spotting that TARDIS was misspelt in the taxonomy labels used when browsing gates.
Apparently, travelling through time is easier than keeping the labels in order.
Final Thoughts
Thank you for your patience with the slow progress and the time offline. I am glad to be back at it. Please keep reporting things that look wrong, whether they affect a whole gate or just a single label!
