this https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html

You are right, I am wrong. I am deleting my comment. Even if I was right this should still be patched ASAP regardless of what the exploit was.

deleted by creator

I was planning on doing other work beside patching servers today.

This plus the php thing and everything I was planning on doing today is out the window 😖

anytime friend

The real research: https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

Here is the boiled down points from this

1. you open a page that has an ad served from Discovery-Tech ad inventory

2. the ad has a standard script in to that calls back to the home server and passes your advertising ID (cookie ID on desktop or mobile ID on mobile) plus your IP

3. there is a third party that has compiled a list of ad ID + IP that effectively de-anonymizes users. This is used to target specific people. The info passed by the ad is compared against the target list. If there is no match to the target nothing further happens.

4. if a match is found it returns javascript that runs on the page. It finger prints the device then it checks for an exploit.

5. if the exploit it is looking for is found the exploit corrupts memory in the rendering engine, achieves native code execution, escapes the sandbox, and installs the spyware.

And, yes, ad blocker software would stop this. If the ad cannot render it cannot call back to the mothership. The only exception to this would be if the ad was served first party, like the website you were visiting was also hosting the ad. Or if you are on a device using a browser that is part of a app that does not have ad blocking, like the built in browser for instagram.

Here is what they did not say

We don’t know which browser, OS, or application vulnerability was used at Al Jazeera. It could be a unknown zero day one or a one that is known but only works on certain older versions of software.

Adding in a standard YSK how to delete your advertising ID from your mobile device.

The irony of linking to an article about forced identification that requires you to login and pay to read it without trackers or a giant banner that covers the article.

With our Pur subscription you can use heise.de without tracking, external banner and video advertising for €4.95 / month. Subscribers to our magazines or heise+ only pay €1.95 per month. You can find information on data processing in the Pur subscription in our privacy policy and in the FAQ.

Yea, once a post is up on reddit for even 3 hours its not worth interacting with because no-one will see what you have to say anyways. Honestly its what makes Lemmy better to me.

217 comments on this in 24 hours says to me that there must at least a few people using lemmy

Yes if someone made a mod that allowed you to torture hookers in GTAVI, I might question the motivations behind that mod.

This logic doesn’t line up tho, you are talking about the guy who thinks video games make people violent, I did not say that. I said think people who develop things that emulate torture, it says more about the person who is trying to replicate torture in such a convincing way it seems real than any machine emulating pain. There is no video game ever made that even comes close to emulating torture.

said this in another thread

I do not think AI can feel pain at all, these are mimicking suffering, not experiencing it. But I do think that the act of cruelty toward things knowing that it will make them convincingly replicate suffering says more about the person doing it than the machine.

There is two people in this thread

1. people who read “bringing your phone in the shower” as having the phone in the same room as the shower.

2. everyone else who seems to think that people are putting their phones directly under the shower nozzle.