PHP pushed maintenance releases for its two active development branches on July 1–2, 2026. PHP 8.5.8 and 8.4.23 are out. Neither is a major feature release, but they fix issues that can cause real harm to production servers. If you’re hosting PHP applications, patch now.
https://blog.kalfaoglu.net/posts/2026-07-05-php-8423-858-security-patches-en/
guys I broke my prescription glasses while in Germany . what's a good , not too expensive place near the north to get a new pair ?
On June 25, 2026, JFrog Security Research published a working exploit walkthrough for a Linux kernel privilege escalation they named DirtyClone. Tracked as CVE-2026-43503 with a CVSS score of 8.8, it lets any local user on an unpatched system escalate to root — and the attack leaves nothing on disk for forensic tools to find.
https://blog.kalfaoglu.net/posts/2026-06-28-dirtyclone-cve-2026-43503-linux-lpe-en/
lidl pay (android ) in Germany asks me to change the card which then rejects every credit or debit card that I have . which are greedily accepted in the store BTW ..
did anyone else have that problem ?
The original RFC 7489 was published as an Informational document, meaning it described what the industry was already doing, not what it was required to do. DMARCbis arrives as a Proposed Standard on the IETF Standards Track — the first formal step toward becoming an Internet Standard. In plain terms: DMARC just graduated from “strong industry recommendation” to “official protocol.”
https://blog.kalfaoglu.net/posts/2026-06-22-dmarcbis-rfc-9989-proposed-standard-en/
On June 4, 2026, the PHP team pushed two releases: PHP 8.4.22 and PHP 8.5.7, both routine bug-fix updates. Notice what’s missing: no 8.2 release, no 8.3 release.
https://blog.kalfaoglu.net/posts/2026-06-17-php-82-eol-countdown-en/
Apache HTTP Server 2.4.68 came out on June 8, 2026 — the first point release since 2.4.67 in early May, and per the project’s own download page, it’s “recommended over all previous releases.” If you run your own LAMP stack, this is the patch to schedule this week.
https://blog.kalfaoglu.net/posts/2026-06-15-apache-2-4-68-release-en/
I asked chatgpt to put an outboard engine attached to this boat.. nope. no matter how I tried they all ended up in weird places.
Rspamd 4.1.0 dropped on June 5 — a major release tagged “recommended upgrade for all users” by the development team. There’s enough in it that’s immediately relevant to anyone running a mail server to warrant reading the changelog before blindly upgrading.
https://blog.kalfaoglu.net/posts/2026-06-07-rspamd-410-security-mx-rework-en/
On June 3, 2026, researcher Quang Luong published a remote denial-of-service exploit called the HTTP/2 Bomb that can exhaust tens of gigabytes of server memory using nothing more than a home internet connection.
Details: https://blog.kalfaoglu.net/posts/2026-06-04-cve-2026-49975-http2-bomb-en/
IMHO, they should have known better.
As I mentioned, at our hosting servers we prevent attacks constantly, and I thought it might be of interest to everyone where these attacks originate from. Here is our current list since the last reset.
PS: Bigger or more computerized countries will have more IP's listed. Likewise VPN users' IPs cannot be determined. Some of these are genuine mistakes - too many attempts with the wrong password for example.
Country Unique IPs
-------------------------------------- ----------
US, United States 269
TR, Turkiye 164
IP Address not found 156
IN, India 41
DE, Germany 34
GB, United Kingdom 34
DK, Denmark 29
RO, Romania 25
CN, China 24
NL, Netherlands 20
IR, Iran, Islamic Republic of 19
AU, Australia 17
RU, Russian Federation 17
JP, Japan 15
FR, France 15
CA, Canada 12
ES, Spain 12
BR, Brazil 11
VN, Vietnam 9
BG, Bulgaria 9
PH, Philippines 8
ZA, South Africa 6
IT, Italy 6
LT, Lithuania 6
ID, Indonesia 5
UA, Ukraine 5
SG, Singapore 4
AE, United Arab Emirates 4
PK, Pakistan 3
BD, Bangladesh 3
TW, Taiwan 3
BE, Belgium 3
PT, Portugal 3
SE, Sweden 3
MX, Mexico 3
KW, Kuwait 3
EG, Egypt 3
GR, Greece 3
TH, Thailand 2
MN, Mongolia 2
DZ, Algeria 2
KR, Korea, Republic of 2
NZ, New Zealand 2
CL, Chile 2
AR, Argentina 2
LA, Lao People's Democratic Republic 2
IL, Israel 2
PL, Poland 2
MY, Malaysia 1
MA, Morocco 1
LU, Luxembourg 1
BA, Bosnia and Herzegovina 1
JO, Jordan 1
EU, Europe 1
NO, Norway 1
SO, Somalia 1
CH, Switzerland 1
TG, Togo 1
LK, Sri Lanka 1
AF, Afghanistan 1
PS, Palestinian Territory 1
HN, Honduras 1
AO, Angola 1
TZ, Tanzania, United Republic of 1
NP, Nepal 1
IQ, Iraq 1
QA, Qatar 1
PA, Panama 1
MK, Macedonia 1
RS, Serbia 1
LB, Lebanon 1
You need to check your DNS/Email settings to ensure your mail goes through..
Google and Yahoo dropped their email authentication hammer in February 2024. Microsoft watched that unfold, nodded slowly, and then did the same thing on May 5, 2025. If your domain hasn’t sorted out SPF, DKIM, and DMARC by now, a chunk of your outbound mail is already being rejected — silently, with no bounce to show for it.
https://blog.kalfaoglu.net/posts/2026-05-31-microsoft-outlook-dmarc-enforcement-en/
Not sure if this belongs here but..
Google and Yahoo dropped their email authentication hammer in February 2024. Microsoft watched that unfold, nodded slowly, and then did the same thing on May 5, 2025. If your domain hasn’t sorted out SPF, DKIM, and DMARC by now, a chunk of your outbound mail is already being rejected — silently, with no bounce to show for it.
https://blog.kalfaoglu.net/posts/2026-05-31-microsoft-outlook-dmarc-enforcement-en/
hi. was anyone able to find suitable lockable lug nuts for our cars? I'm afraid of losing my tires while it's parked on the side of the road.
MariaDB patched CVE-2026-35549 on April 3, 2026. Seven weeks later, the fixed packages haven’t landed in the official repositories of RHEL 8, 9, and 10, Ubuntu LTS releases, or CentOS 8. If you’re running distro-packaged MariaDB and have the caching_sha2_password authentication plugin in use, your database server can be crashed by any authenticated user with a single oversized packet.
https://blog.kalfaoglu.net/posts/2026-05-24-mariadb-caching-sha2-dos-cve-2026-35549-en/
If you run WHMCS and haven’t updated in the past week, stop reading and go do that first. Back? Good. Here’s what you just patched.
https://blog.kalfaoglu.net/posts/2026-05-17-whmcs-cve-2026-29204-idor-en/
On May 7, 2026, the PHP team released simultaneous security updates across all four supported branches: PHP 8.5.6, 8.4.21, 8.3.31, and 8.2.31. The release is classified as a security update for every branch.
https://blog.kalfaoglu.net/posts/2026-05-11-php-may-2026-security-releases-en/
On May 7, 2026, the PHP team released simultaneous security updates across all four supported branches: PHP 8.5.6, 8.4.21, 8.3.31, and 8.2.31. The release is classified as a security update for every branch.
https://blog.kalfaoglu.net/posts/2026-05-11-php-may-2026-security-releases-en/
A heap buffer overflow in MariaDB’s JSON_SCHEMA_VALID() function went unnoticed for years — until AI-assisted code analysis flagged it earlier this year. The flaw, now tracked as CVE-2026-32710, was disclosed on March 19, 2026, and patches landed the same day. If your server runs MariaDB 11.4.x or 11.8.x and you haven’t applied the update yet, this is the one to prioritise this week.
https://blog.kalfaoglu.net/posts/2026-05-09-mariadb-cve-2026-32710-json-schema-en/