[分享创造] PHP2Shell 漏洞来了，宝塔用户可按官方说明修复
昨晚发布的 PHP 的 PHP2Shell 漏洞（ CVE-2026-109618 、CVE-2026-109619 ）让很多运维和安全部门睡不着觉了，属于严重的远程代码执行漏洞。如果服务器使用了受影响的 PHP 运行环境，可能存在较高风险。
宝塔官方已经发布修复公告，PHP 7.4 、8.0 、8.1 也有对应的宝塔修复版本，不一定非要立即迁移到 PHP 8.2 以上。
宝塔修复方法：
登录宝塔面板，进入「软件商店 → 已安装」。
点击右上角「更新软件列表」。
找到网站实际使用的 PHP 版本，检查并更新到对应的安全修复版本。
更新后确认版本，并重启相关 PHP 服务，检查网站运行是否正常。
官方公告及详细操作： https://mp.weixin.qq.com/s/pJ6mHOR01XEQlqLus2lwpg
另外，做了一个简单的在线初筛工具，可以辅助检查网站是否存在 PHP 相关特征： https://php2shell.cc/zh/
大家有空还是赶紧检查一下吧，能更新的尽早更新，别给自己留隐患了。
via V2EX (author: hx123)
昨晚发布的 PHP 的 PHP2Shell 漏洞（ CVE-2026-109618 、CVE-2026-109619 ）让很多运维和安全部门睡不着觉了，属于严重的远程代码执行漏洞。如果服务器使用了受影响的 PHP 运行环境，可能存在较高风险。
宝塔官方已经发布修复公告，PHP 7.4 、8.0 、8.1 也有对应的宝塔修复版本，不一定非要立即迁移到 PHP 8.2 以上。
宝塔修复方法：
登录宝塔面板，进入「软件商店 → 已安装」。
点击右上角「更新软件列表」。
找到网站实际使用的 PHP 版本，检查并更新到对应的安全修复版本。
更新后确认版本，并重启相关 PHP 服务，检查网站运行是否正常。
官方公告及详细操作： https://mp.weixin.qq.com/s/pJ6mHOR01XEQlqLus2lwpg
另外，做了一个简单的在线初筛工具，可以辅助检查网站是否存在 PHP 相关特征： https://php2shell.cc/zh/
大家有空还是赶紧检查一下吧，能更新的尽早更新，别给自己留隐患了。
via V2EX (author: hx123)
[推广] Bad Times AI Video: put your dog, cat or baby in the viral Bad Times trend with one photo
I recently built a small web tool for a meme that has been all over my feed for the past few weeks. If you've been on TikTok or Reels lately, you've probably seen it: French creator Bouuh Yachaka stages a furious argument with whoever is filming her in a kitchen, lip-syncing to "Bad Times" by Imael Angel. She grabs her head, throws up the "hold on" hands, turns away, then lunges at the camera. Since late September people have been remaking it with AI, putting their dogs, cats, babies and friends in her place. I tried a few general video tools to make my own and kept fighting with prompts, reference clips and dogs growing human fingers, so I built Bad Times AI Video to make it a one-photo job. Sharing it here in case anyone wants to join the trend, and I'd really appreciate feedback.
About Bad Times AI Video
Bad Times AI Video turns one photo of your dog, cat, baby or yourself into the viral Bad Times routine. The AI edits a performance clip and replaces only the performer: the scene, the camera moves, the timing and the song stay as they are, and the subject of your photo takes over every move, from the head grab to the lunge at the lens. You get a vertical 9:16 MP4 that's ready to post. If you're new to the meme, the Bad Times Trend page has the backstory and how it spread.
Features
● One photo, nothing else: no prompt to write, no reference clip to find, no editing timeline.
● Paws stay paws: the Pet template is driven by a real dog's performance, so when your pet shows its "palms" you get paws, not the human fingers most AI pet versions end up with. Works for dogs, cats and other pets.
● Templates for different photos: Pet, Baby and Original (a person). A Halloween version is coming soon.
● The song is already in: every video plays with "Bad Times", timed to the routine, so there's nothing to line up in an editor.
● Three lengths: a 5-second opening, 15 seconds through the turn and first lunge, or the full 30-second first half of the routine.
● Four quality levels: Lite 480p for quick tests, Standard and HD at 720p, and Ultra at 720p on the strongest model.
● Works in the browser: iPhone, Android or desktop, with no app to install.
● Failed renders are never charged: if a render fails or a photo is filtered, the credits go straight back to your balance.
● A free first clip: new accounts get 20 credits, enough for one 5-second Lite clip, so you can see your own photo in the routine before paying. After that, credit packs start at $4.99 for a 5-second Standard clip in 720p, paid once with no subscription.
How to use?
Website: https://badtimesaivideo.com
1. Open the site and upload one photo. One subject, clearly visible and well lit; a full-body shot works best.
2. Pick the matching template (Pet, Baby or Original), then choose the length and quality. You can see the cost before you generate.
3. Click Generate. A 5-second clip takes about 2 to 4 minutes, longer ones a bit more. Then download the MP4 and post it.
There are also pages with photo tips for a Bad Times dog, a Bad Times cat and a Bad Times baby.
It's an independent fan project, not affiliated with Imael Angel, Bouuh Yachaka, TikTok or their labels. Please only use photos of your own pets, yourself, or people who agreed (and photos of kids only if you're the parent). Feedback, bug reports and ideas are all welcome, thanks for taking a look!
via V2EX (author: wersero)
I recently built a small web tool for a meme that has been all over my feed for the past few weeks. If you've been on TikTok or Reels lately, you've probably seen it: French creator Bouuh Yachaka stages a furious argument with whoever is filming her in a kitchen, lip-syncing to "Bad Times" by Imael Angel. She grabs her head, throws up the "hold on" hands, turns away, then lunges at the camera. Since late September people have been remaking it with AI, putting their dogs, cats, babies and friends in her place. I tried a few general video tools to make my own and kept fighting with prompts, reference clips and dogs growing human fingers, so I built Bad Times AI Video to make it a one-photo job. Sharing it here in case anyone wants to join the trend, and I'd really appreciate feedback.
About Bad Times AI Video
Bad Times AI Video turns one photo of your dog, cat, baby or yourself into the viral Bad Times routine. The AI edits a performance clip and replaces only the performer: the scene, the camera moves, the timing and the song stay as they are, and the subject of your photo takes over every move, from the head grab to the lunge at the lens. You get a vertical 9:16 MP4 that's ready to post. If you're new to the meme, the Bad Times Trend page has the backstory and how it spread.
Features
● One photo, nothing else: no prompt to write, no reference clip to find, no editing timeline.
● Paws stay paws: the Pet template is driven by a real dog's performance, so when your pet shows its "palms" you get paws, not the human fingers most AI pet versions end up with. Works for dogs, cats and other pets.
● Templates for different photos: Pet, Baby and Original (a person). A Halloween version is coming soon.
● The song is already in: every video plays with "Bad Times", timed to the routine, so there's nothing to line up in an editor.
● Three lengths: a 5-second opening, 15 seconds through the turn and first lunge, or the full 30-second first half of the routine.
● Four quality levels: Lite 480p for quick tests, Standard and HD at 720p, and Ultra at 720p on the strongest model.
● Works in the browser: iPhone, Android or desktop, with no app to install.
● Failed renders are never charged: if a render fails or a photo is filtered, the credits go straight back to your balance.
● A free first clip: new accounts get 20 credits, enough for one 5-second Lite clip, so you can see your own photo in the routine before paying. After that, credit packs start at $4.99 for a 5-second Standard clip in 720p, paid once with no subscription.
How to use?
Website: https://badtimesaivideo.com
1. Open the site and upload one photo. One subject, clearly visible and well lit; a full-body shot works best.
2. Pick the matching template (Pet, Baby or Original), then choose the length and quality. You can see the cost before you generate.
3. Click Generate. A 5-second clip takes about 2 to 4 minutes, longer ones a bit more. Then download the MP4 and post it.
There are also pages with photo tips for a Bad Times dog, a Bad Times cat and a Bad Times baby.
It's an independent fan project, not affiliated with Imael Angel, Bouuh Yachaka, TikTok or their labels. Please only use photos of your own pets, yourself, or people who agreed (and photos of kids only if you're the parent). Feedback, bug reports and ideas are all welcome, thanks for taking a look!
via V2EX (author: wersero)
[电动汽车] 为什么总有一些人的回复莫名其妙
在问界榆木车祸的文章下面，为什么有人会费劲巴拉的写这些内容，不审题？不看题？我是甲方，看到你这个评论，一分钱也不给，带偏的方向一点都对。
做水军，这么没有水平
https://i.imgur.com/14cwgsI.png https://i.imgur.com/14cwgsI.png
via V2EX (author: rwecho)
在问界榆木车祸的文章下面，为什么有人会费劲巴拉的写这些内容，不审题？不看题？我是甲方，看到你这个评论，一分钱也不给，带偏的方向一点都对。
做水军，这么没有水平
https://i.imgur.com/14cwgsI.png https://i.imgur.com/14cwgsI.png
via V2EX (author: rwecho)
[Bitcoin] Liquid 黑客仍未归还剩余的 600BTC 侧链资金，占侧链总币量 15%
https://i.imgur.com/jEkBT7f.png
https://liquid.network/
没人讨论这事吗？
via V2EX (author: BugCheck7b)
https://i.imgur.com/jEkBT7f.png
https://liquid.network/
没人讨论这事吗？
via V2EX (author: BugCheck7b)
[程序员] 分享下这次修复 PHP 的漏洞
因为服务器都在国内，不太敢用 claude
主要是靠 codex
让 codex 连自己的服务器，因为我本地连服务器是免登录的 所以命令比较简单：
一. "连接 xx.xx.xx.xx 服务器”
然后就可以开始检查漏洞：
二. “https://www.php.net/archive/2026.php#2026-10-21-5 检查服务器是否存在该漏洞”
如果存在的话
三. “根据官方的修复方案帮我修复，先做好备份，尽量不要影响网站正常使用，修复后需要做测试，修复的慢一点没关系 这是线上在跑的业务”
----------------------
如果官方有明确的修复补丁修下基本都没什么问题，如果是低版本需要注意下升级到 8.x 之后的版本对现在代码兼容性的问题。
修复完之后，过一段时间 可以让 ai 再检查下访问日志，是否存在异常。
via V2EX (author: miya0923)
因为服务器都在国内，不太敢用 claude
主要是靠 codex
让 codex 连自己的服务器，因为我本地连服务器是免登录的 所以命令比较简单：
一. "连接 xx.xx.xx.xx 服务器”
然后就可以开始检查漏洞：
二. “https://www.php.net/archive/2026.php#2026-10-21-5 检查服务器是否存在该漏洞”
如果存在的话
三. “根据官方的修复方案帮我修复，先做好备份，尽量不要影响网站正常使用，修复后需要做测试，修复的慢一点没关系 这是线上在跑的业务”
----------------------
如果官方有明确的修复补丁修下基本都没什么问题，如果是低版本需要注意下升级到 8.x 之后的版本对现在代码兼容性的问题。
修复完之后，过一段时间 可以让 ai 再检查下访问日志，是否存在异常。
via V2EX (author: miya0923)
[职场话题] 一年时间到了 兄弟们 “软件工程师”的职位 完蛋了没有
一口新饭
@onenewbite
看完这一集会发笑的软件工程师大概率 6 ～ 12 个月会丢掉“软件工程师”的职位。I’m sorry ，这很残忍，但 the writing is on the wall. wish you all the best.
https://x.com/onenewbite/status/1959842650988954112
via V2EX (author: key001)
一口新饭
@onenewbite
看完这一集会发笑的软件工程师大概率 6 ～ 12 个月会丢掉“软件工程师”的职位。I’m sorry ，这很残忍，但 the writing is on the wall. wish you all the best.
https://x.com/onenewbite/status/1959842650988954112
via V2EX (author: key001)
[程序员] [招募] 高级网络安全研究员 / 渗透测试专家
寻找网络安全领域的技术大佬，长期合作，兼职或项目制均可。
主要研究方向：
1. 源站定位与溯源分析：熟悉 CDN 、WAF 、反向代理等架构，具备授权目标真实源站识别、源站暴露风险分析能力。
2. 网络层安全研究：熟悉 TCP/IP 、HTTP/HTTPS 、TLS 、DNS 等协议，能够分析复杂网络链路与异常流量。
3. 漏洞挖掘：具备独立发现网络架构、网关、代理、负载均衡及服务端安全漏洞的能力。
4. 安全防护研究：深入理解阿里云 ESA 、CDN 、WAF 、ALB/SLB 等技术及其安全机制。
5. 实战问题解决：能够针对复杂网络环境进行技术分析、验证与安全评估。
能力要求：
● 有真实攻防研究经验，而非仅会使用扫描工具。
● 具备较强的独立分析、逆向思维和技术研究能力。
● 熟悉主流网络安全工具，有独立漏洞研究成果优先。
● 有 SRC 、红队、攻防演练或大型互联网安全研究经验优先。
合作方式：
● 兼职、远程、项目合作均可。
● 技术能力优先，报酬根据能力及项目难度协商。
● 所有实际测试均在合法授权范围内开展。
不看学历，不看证书，只看真实技术实力。
有相关经验的朋友欢迎私聊，交流技术方向及过往研究案例。
QGthX2xpX2tj
via V2EX (author: SnowHall)
寻找网络安全领域的技术大佬，长期合作，兼职或项目制均可。
主要研究方向：
1. 源站定位与溯源分析：熟悉 CDN 、WAF 、反向代理等架构，具备授权目标真实源站识别、源站暴露风险分析能力。
2. 网络层安全研究：熟悉 TCP/IP 、HTTP/HTTPS 、TLS 、DNS 等协议，能够分析复杂网络链路与异常流量。
3. 漏洞挖掘：具备独立发现网络架构、网关、代理、负载均衡及服务端安全漏洞的能力。
4. 安全防护研究：深入理解阿里云 ESA 、CDN 、WAF 、ALB/SLB 等技术及其安全机制。
5. 实战问题解决：能够针对复杂网络环境进行技术分析、验证与安全评估。
能力要求：
● 有真实攻防研究经验，而非仅会使用扫描工具。
● 具备较强的独立分析、逆向思维和技术研究能力。
● 熟悉主流网络安全工具，有独立漏洞研究成果优先。
● 有 SRC 、红队、攻防演练或大型互联网安全研究经验优先。
合作方式：
● 兼职、远程、项目合作均可。
● 技术能力优先，报酬根据能力及项目难度协商。
● 所有实际测试均在合法授权范围内开展。
不看学历，不看证书，只看真实技术实力。
有相关经验的朋友欢迎私聊，交流技术方向及过往研究案例。
QGthX2xpX2tj
via V2EX (author: SnowHall)