A PHP vulnerability with a CVSS score of 9.2 that lets anyone execute code remotely without even logging in — and the official fix only covers 8.2 through 8.5. My server runs 5.6, which has no patch and no backport. This morning I only wanted to confirm how badly I was affected. But one thing led to another, and I ended up giving the site legacy — stacked up and steadily gaining entropy for over a decade — a thorough slimming down.

When you use httpService in Flex to read XML from a different domain (such as http://xml.weather.yahoo.com/forecastrss), you get a Security error accessing url error. But in the debug folder (bin-debug by default) it reads just fine. This is really annoying — I’m sure plenty of people have been tripped up by this security issue. Why does it only work in the debug folder? It turns out the bin-debug folder works only because [系统盘]:Documents and Settings[用户名]Application DataMacromediaFlash Player#SecurityFlashPlayerTrustflexbuilder.cfg sets it as trusted automatically. At actual runtime, it’s blocked by security. In other words, what we need to do is solve the security-block problem. So how do we fix it?