Any tech going down?

Type 1 & LADA
1

From the PHP CVE? PHP vulnerability 2026 CVE-2026-109619 patch: Why are government, school, hospital websites going offline, new PHP updates are live - The Economic Times

Details: PHP: News Archive - 2026

Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.

More details: Today's PHP Security Release, and How We're Strengthening PHP Security — The PHP Foundation — Supporting, Advancing, and Developing the PHP Language

Anything built using PHP?
Are we all OK?

https://www.reuters.com/world/asia-pacific/eu-agency-warns-websites-may-need-be-taken-offline-php-prepares-patches-2026-10-21/

Here’s most of our tech summarized in table form with an accompanying link:

image
image675×523 81.4 KB

We should ask chris. He’s a frontend guy. Should we be worried about anything, @spdif48. ■■■■. I can’t tag him. Maybe I summon him another way…

Nightscout XDrip

Github repo shows it is 100% a Java build. No PHP, no problem?

image

Tidepool

image
image277×205 11.8 KB

nodeJS means no PHP?

OpenAPS

repo: openaps · GitHub

image
image229×108 8.46 KB

OpenOmni

repo: GitHub - openaps/openomni: Documentation and library for decoding omnipod communications. · GitHub

image
image304×100 7.41 KB

Probably no one has used this in years.

AndroidAPS

Contains some PHP: GitHub - openaps/AndroidAPSdocs: Documentation for AndroidAPS · GitHub
image
We have got a little PHP in here. Most recent update was 2 days ago so people are using this.

Abbott Libre

I don’t know what Libre is built with, but they DO want you to update that beast as of OCT 12. https://www.librecheck.com/content/dam/adc/librecheck/en-us/pdf/Patient_Letter_Field_Action_1002-2026_App_Security_Update_US-EN.pdf

Notes:

Updating your apps to the latest version addresses a security vulnerability affecting the FreeStyle
Libre 3 app and the Libre by Abbott app. As of 12-OCT-2026, Abbott is not aware of any
unauthorized access to a patient’s app in relation to this vulnerability, and there have been no
reports of adverse events.

In the event that this vulnerability were to be exploited, the apps could display incorrect sensor
glucose readings, and alarms may not function as intended or may provide incorrect alerts, which
may lead people with diabetes to make inappropriate treatment decisions, such as taking too much or too little insulin or delaying necessary treatment.

This vulnerability impacts the FreeStyle Libre 3 app and the Libre by Abbott app only

1 Like
2

If you see a potential problem, I recommend NOT discussing it publicly outside of our forum so the developers have an opportunity to patch.

It can be helpful to contact the developers directly, but I’m sure they know by now.

If you talk about it, you may provoke an attack. There are attacks being launched from every dusty corner of the globe right now.

2 Likes
3

Strictly within the context of the questions you asked PHP runs on the servers; the other end of the communication channel. Node.js (NightScout, TidePool apparently) supports this as well but does not use PHP.

That said, Ubuntu reports similar issues within Node.js.

Similar issues are reported all the time; yesterday is nothing special in that regard.

There are issues here. AI systems can not only discover bugs like this but also manage to report them in ways that are immediately detectable in my experience: No spelling errors, no grammatical errors, beautifully formatted and, most important, normally correct. This is useful.

1 Like
4

Chris says we might be able to use an old tool called Shodan to investigate server side. Shodan (website) - Wikipedia I’ve only ever used Nmap

I’m sure the devs are working on stuff. Most everybody has patched. But we are pretty far down the priority list. If you try to connect to your sensor data via web based portal, that software might be impacted.

Just keep an eye out. Be safe.

5

I have a personal tech problem with my iPhone. It was with my daughter in law while I was in surgery. Photo if worked fine. The on the drive to lunch it stopped working. To do a bolus from the Tandem app I’d get repeated failures, finally it would ask for pass key.

No it’s like there’s no security. The phone just opens. When I do a bolus then photo id works.

I tried resetting it but can’t. I’m a hardware man. I really don’t like software when it decides to be stupid.

2 Likes
6

When they say, “remote execution (of code)” - that’s really bad.
That means that someone overseas can potentially operate that phone, as if they are holding it in their hand.

In general, the more apps you have installed on your phone, the more vulnerable it is. When I run insulin delivery off a phone, I don’t install apps on it.

Will you promise to keep a close eye on this and consider reporting it? You could report to FDA or to iPhone or to Tandem, just to be safe (maybe all of them).

Any funny business should be reported because there may be lose ends.

If you find and report funny behavior, be sure to tell them that you are operating a class III (high risk) medical device used to deliver insulin. That will get their attention. I would encourage everybody to just verify they have syringes and a backup way to deliver insulin in case they take a system down that you rely on. ITS ALWAYS IMPORTANT TO HAVE THAT. You really can’t verify those resources are at hand enough.

FDA: Medical Device Reporting (MDR): How to Report Medical Device Problems | FDA

Tandem: https://tandem.zendesk.com/hc/en-us/articles/360045083472-I-think-I-ve-found-a-bug-what-should-I-do

iPhone: https://www.youtube.com/watch?v=jNsW5GAsSB0

I’m not a fan of this Tandem/iPhone behavior.

Let’s pretend you are filing a report with Tandem.

They want to know things like:

  1. What model of hardware is your phone?
  2. What version of the operating system are you running?
  3. What model of insulin pump?
  4. What version of the Tandem app?

Then you want to describe, in the greatest detail that you can, what buttons you push, what screens you see, what funny behavior is exhibited.

Here is an example of documenting software process in annoying detail:

image
image676×517 62.1 KB

image
image657×223 33 KB

image
image673×295 35.6 KB

image
image655×544 64.4 KB

image
image568×309 13.6 KB

image
image639×256 39.6 KB

7

I’ve fixed it. Toreset Face ID stolen device protection has to be turned off. Then I was able to reset an do Face ID again. Restored stolen device protection.

1 Like
8

YEAHHHH!

If anybody sees anything they want to report, it’s often easiest to just film the behavior using someone else phone.

I have some guys from Tehran and Russia floating around my social media, trying to connect with me. That’s a little unusual.

2 Likes
9

It’s easy to fake where you come from.

10

Here’s an article that presents some perspective on the way this really works:

Ya’ll probably get paywalled, or maybe not.

1 Like
11

They are crawling into my network because of a kid they are grooming to be an ambassador for Russia. I met him when the Finns were in town. Not fantastic, but we connected before I knew that.

I saw an apple bug yesterday - associated with login.

Are you trolling my LI, Bowler? :joy: Reveal yourself! What do you think about those hospital mergers in Minneapolis? It’s like they are all consolidating at once. They are making a play to merge A BUNCH of systems as fast as possible (I think), before Klobuchar comes home. They are bitching at the insurers, as if the want to be friends, but I don’t think they have honest intentions. Self serving.

Quest got hit. Quanum | Quest Diagnostics
They informed shareholers within 24 hours. Maybe in the next 60 days, they will also inform patients.

Chris recommended some additional resources for us.

" More up to date option than shodan with a fun dashboard: https://php2shell.censys.com/. Maybe somewhere they offer a free test you can point at some of the big D companies. I was listening to https://beerswithtalos.talosintelligence.com/2033817/episodes/20009436-the-guy-who-invented-pain and had to stop and explain why I was laughing so hard at their turkey_lurky_man bit."

12

There’s a part of modern evolutionary theory called, “Punctuated equilibrium.” Details are easiest to read in Gould’s work. When the ACA came in it initiated massive growth in the healthcare industry because it extended healthcare to massive numbers of people previously uninsured. This happened primarily because of the increased Medicaid funding. This was the speciation phase, the punctuation.

Now we are in the statis phase, equilibrium, in which hospital diversity decreases.

A week or so, not wanting to wait a couple of months to get our flu/covid shots through our GP organisation, AllCare Medical Group, we went to out local rural provider (well, in fact, someone certainly not associated with NoCare suggested we might get faster service if we went there and I’m deliberately conflating two stories here.)

We turned up, no appointment necessary, we got shot, we left happy. While there we observed hastily printed Letter Paper sized signs asking Patients to be patient; they had a new records system from Epic and it was taking some time to get it all up and running. Apparently this would give better access to patient information from local hospitals, who round here go by the name Asante.

Epic have the majority of the hospital records business. They don’t have a majority of other records, like local practitioner records, they’re just the elephant there; less than 50%, no need to worry.

Sometimes I wonder how much the artificial idiot gets paid:

Hospital mergers involve combining two or more health systems or hospitals into a single organization, a trend that has accelerated sharply across the United States. [1, 2]

KFF (link [1]) is believable, don’t know bout “bipartisanpolicy.org”, sounds like a carsalesmanship.

However according to the unpaid artificial slave:

Potential Benefits

  • Financial Stabilization: Mergers can rescue financially distressed or rural hospitals facing rising labor costs, inflation, and low reimbursement rates. [1, 2]
  • Operational Efficiency: Systems can centralize electronic health records (EHRs), administrative billing, compliance, and supply chain purchasing. [1]
  • Specialized Care Access: Larger networks can expand clinical service lines, recruit scarce specialists, and fund community health programs. [1, 2]

Like crime in the US was eliminated by imprisoning people for life if they stole three milk bottles one at once. Whatever.

1 Like
13

I’m gonna put some heat on them and see if I can get the gov to act in an ethical way that isn’t totally contrary to the public good. We passed laws to allow for that. That was a lot of work and they aren’t upholding their side of that responsibility. They are too lazy. They are collecting too much easy money.

1 Like