October 2026 - Roundtable

MUUG Meeting, Tuesday, Nov 3, 7:30pm (WSC, 598 St. Mary's Rd) -- Red Baron on FreeBSD
by Gilbert E. Detillieux 26 Oct '26

26 Oct '26

The Manitoba UNIX User Group (MUUG) will be holding its next monthly meeting IN PERSON, on Tuesday, November 3rd, at 7:30pm. Yes, that's the FIRST Tuesday of the month... Red Baron on FreeBSD Ken Wong will present and demo running Red Baron (Red Hat’s browser from 1997, that only shipped as a binary) on modern FreeBSD. It covers the browser’s history, installation, the startup problem encountered, and the hack that allowed it to run. He’ll also discuss how FreeBSD is even able to run Linux software, compare the installation with a modern Linux distro, and the trick to view modern sites with this ancient browser. AGM Plus, this month's meeting will be the MUUG annual general meeting, which includes the election of the MUUG board of directors for the 2026-2027 year (often by acclamation). Where to find the Meeting: **NOTE NEW LOCATION** Winnipeg Senior Citizens Radio Club, 598 St. Mary's Road, 2nd Floor WSC is located at 598 St. Mary's Road, 2nd Floor, a block South from the St. Mary's / St. Anne's fork, on the West side beside the Miller's Meats. It's in the old fire hall, so you really can't miss it! Look for the red door. There are a limited number of parking spaces for WSC around the building. If you arrive early you'll probably snag one. If not, there is parking available on the nearby streets, such as Mager Dr, or the streets off of St. Mary's such as Blenheim or Clonard Ave. Be careful not to park in nearby private parking lots unless otherwise indicated. There is no elevator, so attendees will have to be able to climb a flight of stairs. Apologies to anyone requiring accessibility. *Please Remove Your Footwear!* To keep the carpets clean and dry, please remove your outdoor footwear at the top of the stairs. Feel free to bring a pair of indoor shoes, sandals, or Crocs to use indoors. *Entry Log Book:* To support WSC operations, we ask all guests to sign the log book provided by WSC as you enter the meeting space. Online Meeting Option: For those unable or preferring not to attend in person, the meeting will also be available online, using BBB as usual. Stay tuned to our muug.ca home page for the official URL, which will be made available about a half hour before the meeting starts. (Reload the page if you don't see the link, or if there are issues with connecting.) The group now holds its meetings at 7:30pm on the *first* Tuesday of every month from September to June. (There are no meetings in July and August.) Meetings are open to the general public; you don't have to be a MUUG member to attend. For more information about MUUG, and its monthly meetings, check out their web server: https://muug.ca/ Help us promote this month's meeting, by putting this poster up on your workplace bulletin board or other suitable public message board, or linking to it on social media: https://muug.ca/meetings/MUUGmeeting.pdf -- Gilbert E. Detillieux E-mail: <gedetil(a)muug.ca> Manitoba UNIX User Group Web: http://muug.ca/

1 0

PHP2
by Tait Palsson 25 Oct '26

25 Oct '26

Hi all: I got this from the AxisOfEasy newsletter. I imagine everyone has already updated but I wanted to pass this along. Is Your Website Vulnerable to PHP2shell? (and what else) We've added a PHP2shell scanner to [DomainHelp here](https://mc.easydns.com/r/c993c9673833f25ff2fe1ec13?ct=YTo1OntzOjY6InN… which can tell you whether your website is vulnerable. It is based on Assetnote's [Git repo](https://mc.easydns.com/r/92f5764292c2771d1d287cf7f?ct=YTo1OntzOjY6InN… (be sure to give him a star when you clone it). PHP2Shell is just the beginning - we've scored a deal for AxisOfEasy readers on a comprehensive "after after PHP2shell" that you should be worried about (including the new Node.js remote shell! Huzzah). Use coupon code "AXISOFEASY" [order your vulnerability report here:](https://mc.easydns.com/r/9b23f70a589ddfb09e6d0df7a?ct=YTo1OntzOjY6In…

1 0

Ahem. Timezone change for Linux servers in MB?
by Grigory Shamov 24 Oct '26

24 Oct '26

Hi All! Perhaps a silly question. If I am running Linux in Manitoba, and relying, as it is, on NTP and TZ packages to get time for whatever. Log timestamps. Storage being in sync with compute. Does the decision to do away with winter time affect my systems? Where does TZ in RHEL clones like Alma comes from ? How does it get updated, i.e., any TZ authority out there to care what actually is Winnipeg/Northamerica wrt UTC starting come November? -- Grigory Shamov Site Lead / HPC Specialist University of Manitoba

4 3

PHP2Shell discussion
by Trevor Cordes 22 Oct '26

22 Oct '26

So you may have heard about the new PHP2Shell PHP vulnerability already, or seen outages of web sites. As a guy who looks after maybe a dozen boxes with php this isn't a fun thing to wake up to. Strangely, Fedora 44 got an update pretty fast (though mirrors can take hours to days to get the file!), I don't see one for F43 yet (I'm on all the mailing lists, so I'll know when it's pushed). Not sure what Fedora is thinking. 43 is under full support still. RH9 / AL9 got the update immediately, as it appears Deb 13. I'm looking to pool ideas on hack detection. There's not much on the web/AI about that yet. Right now I'm looking for odd code-500 HTTP response codes, especially on POSTs. As well as memory-exhausted errors in the php log files. So far maybe 1 box seems to have been targeted, of course the "biggest" one I work on. I'm now doing rpm -Va type checks. As for damage, it may turn out better that all I run is php-fpm, not mod-php. Maybe. It might be harder to jig the hack to hit through the cgi interfaces. Maybe. And one thing no one mentions is all the hacker can do is get shell-type access as the same user as your php-fpm process. For me that's "php-fpm". Still bad as they could steal all the php source code, db passwords, etc; and possibly use that to then dump & steal all the db data. That would NOT be good for any company. They could also replace php source code with hacker stuff to have a backdoor for later. This is where git integrity checks can be really handy! However, it's not root, so that's good. They'd have to combine it with a root escalation, and if your server is kept updated they'd need a fresh zero-day for that. Please, anyone else working on this issue, add in more ideas for hack detection and fingerprints. The sparse info out there right now makes it sound like you can't even count on an "out of memory" error in the log. Ironically, even running/enforced selinux or apparmor wouldn't help at all here, except for maybe keeping them from steal /etc/passwd (which has no passwords...), and of course stopping them from trying to priv escalate. Also, apparently they've known of the hack for a while -- at least more than the few hours it took them to rush out the fixes. They chose to sit on it until someone leaked the hack? Also, wouldn't that indicate a mole inside the php dev sphere who leaked, probably for $$? None of this is good.

2 2

Time zone database and time zone configuration
by Kevin McGregor 08 Oct '26

08 Oct '26

If your time zone is set to America/Winnipeg and you want to change it to UTC-0500, you might try changing your time zone to Etc/GMT-5, which seems plausible. The result may not be what you expect. # date Thu Oct 8 07:35:45 AM CDT 2026 root@cowsvplsys21:~# timedatectl status Local time: Thu 2026-10-08 07:35:58 CDT Universal time: Thu 2026-10-08 12:35:58 UTC RTC time: Thu 2026-10-08 12:35:59 Time zone: America/Winnipeg (CDT, -0500) # timedatectl set-timezone "Etc/GMT+5" # date Thu Oct 8 07:36:52 AM -05 2026 # timedatectl status Local time: Thu 2026-10-08 07:36:58 -05 Universal time: Thu 2026-10-08 12:36:58 UTC RTC time: Thu 2026-10-08 12:36:59 Time zone: Etc/GMT+5 (-05, -0500) # timedatectl set-timezone "Etc/GMT-5" # date Thu Oct 8 05:37:36 PM +05 2026 # timedatectl status Local time: Thu 2026-10-08 17:37:42 +05 Universal time: Thu 2026-10-08 12:37:42 UTC RTC time: Thu 2026-10-08 12:37:43 Time zone: Etc/GMT-5 (+05, +0500) So GMT-5 is UTC+0500, and GMT+5 is UTC-0500. According to Wikipedia, In order to conform with the POSIX <https://en.wikipedia.org/wiki/POSIX> style, those zone names beginning with "Etc/GMT" have their sign reversed from the standard ISO 8601 <https://en.wikipedia.org/wiki/ISO_8601#Time_offsets_from_UTC> convention. In the "Etc" area, zones west of GMT have a positive sign and those east have a negative sign in their name (e.g "Etc/GMT-14" is 14 hours ahead of GMT). So be careful when using this.

1 0

MUUG Meeting, Tuesday, Oct 6, 7:30pm -- pivot_root
by Trevor Cordes 05 Oct '26

05 Oct '26

The Manitoba UNIX User Group (MUUG) will be holding its next monthly meeting in person and online, on Tuesday, Oct 6th, at 7:30pm. pivot_root Ready for the ultimate geek-out? How about manipulating your disk partitions on a running system? Now how about moving or shrinking your root filesystem on a running system? Now how about doing it all over a remote ssh connection, maybe because your box is in another city or country? Impossible you say? Not with Linux! And why on earth would you want to do this? How about your hosting company refuses to setup the partitions the way you want them on your new box? Or maybe your /boot partition is old and no longer big enough for all the latest kernel initramfs images? Trevor Cordes will guide you through the insanity of using pivot-root, in a demo-heavy slide-light manner, to make all of your wildest dreams come true. Where to find the Meeting: Winnipeg Senior Citizens Radio Club, 598 St. Mary?s Road, 2nd Floor WSC is located at 598 St. Mary's Road, 2nd Floor, a block South from the St. Mary's / St. Anne's fork, on the West side beside the Miller's Meats. It's in the old fire hall, so you really can't miss it! Look for the red door. There is no elevator, so attendees will have to be able to climb a flight of stairs. Apologies to anyone requiring accessibility. There are a limited number of parking spaces for WSC around the building. If you arrive early you'll probably snag one. If not, there is parking available on the nearby streets, such as Mager Dr, or the streets off of St. Mary's such as Blenheim or Clonard Ave. Be careful not to park in nearby private parking lots unless otherwise indicated. For those unable or preferring not to attend in person, the meeting will also be available online, using BBB as usual. Stay tuned to our muug.ca home page for the official URL, which will be made available about a half hour before the meeting starts. (Reload the page if you don't see the link, or if there are issues with connecting.) The group now holds its meetings at 7:30pm on the *first* Tuesday of every month from September to June. (There are no meetings in July and August.) Meetings are open to the general public; you don't have to be a MUUG member to attend. For more information about MUUG, and its monthly meetings, check out our web server: https://muug.ca/ Help us promote this month's meeting, by putting this poster up on your workplace bulletin board or other suitable public message board, or linking to it on social media: https://muug.ca/meetings/MUUGmeeting.pdf

1 0