CypherBay

Two critical remote code execution vulnerabilities in the PHP engine (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) were disclosed on 21 October 2026 and were exploited in the wild before patches shipped. PHP 8.1 and older receive no upstream fix. The minimum required PHP version for self-hosting CypherBay is now 8.2.35 (or 8.3.36 / 8.4.27 / 8.5.12 on newer branches). The README and the docs page have been updated accordingly.

New /docs.html page with the complete source of every file in the repository, shown verbatim and explained inline. Covers the encryption layer, the session data format, all six API endpoints, the rate limit helper, and the cleanup cron script.

Replaced the monospace body font with a system sans-serif stack (-apple-system, Segoe UI, Roboto etc.). Code blocks, the terminal prompt line, and the CypherBay header keep their monospace faces. The site reads more naturally while preserving the terminal aesthetic where it matters.

The donate page shipped a CSP that blocked its own inline styles and theme script, so it rendered unstyled with a dead theme toggle. Page styles and the shared theme toggle now live in external files (css/ and js/theme.js), and the same strict CSP the app already uses was added to the blog and changelog pages, which previously had none.

The Start Chat and Join buttons could stay stuck on Connecting… after a successful join. Fixed. The landing page also no longer disables pinch to zoom, restoring accessibility on mobile.

New /blog.html section for posts on privacy, encryption, and policy affecting CypherBay. Launched with two posts covering the EU's Chat Control vote and a practical guide to protecting yourself against it and against Chat Control 2.0.

The format info block was written in reversed bit order, so every generated QR code failed its checksum on real scanners. The encoder was also capped at 53 bytes, too small for a full session URL on most domains, silently corrupting the code. Both fixed and verified against an independent decoder.

Key derivation hardened from 100,000 to 310,000 PBKDF2-SHA256 iterations. Brute-forcing a session password now costs 3× more compute per guess. Salt prefix updated to CypherBay-v2- to prevent cross-version key collisions.

Files are now encrypted with AES-256-GCM in the browser before upload. The server receives and stores only an opaque binary blob: no filename, no MIME type, no readable content. Decryption happens in the receiver's browser using the shared session password. Anyone with a direct file URL sees random bytes.

Images now render directly in the chat bubble. While the encrypted file is fetched and decrypted, a loading spinner is shown. Once decrypted, the image appears inline. Click opens it full-size in a new tab. Videos and audio also play directly in-chat.

File uploads no longer go to the external service 0x0.st. Files are stored directly on the CypherBay server under data/uploads/ with a random 32-character hex ID. Files are automatically deleted after 7 days. No third-party involvement in any part of the communication.

Action buttons moved above the feature grid so they are immediately visible on load. Features now render in a 3-column grid on desktop, 2-column on tablet, single column on mobile. Cards show a green top-border accent on hover instead of a full border change.

The QR library previously only supported alphanumeric mode, which excludes the # character. Byte mode encoding was added so full URLs including the hash fragment can be encoded. Separately, the invite modal was passing only the session ID to the QR renderer instead of the full URL, so iPhone Camera saw plain text, not a link.

Sessions can be saved to a cypherbay_session cookie (opt-in via checkbox). A new Invite button in the chat toolbar opens a modal with a scannable QR code and copyable link and session ID. The resume-session widget on the landing page detects any saved session and offers to rejoin.

Typing events are excluded from rate limiting: previously they consumed the same bucket as messages, making it trivial to exhaust the limit without sending anything. Separate per-IP buckets now exist for send, upload, and delete. Rate limiting added to upload.php (5/min) and delete.php (10/min), which were previously uncapped.

Fixed header injection in upload.php: filename was passed raw into MIME headers. Added shared file locking (LOCK_SH) when reading session files to prevent race conditions with concurrent writes. Fixed a PHP falsy-empty-array bug in send.php: if ($saved) evaluates to false for an empty array, discarding valid session state. CSP headers tightened across all API endpoints.

Primary text changed from neon green #39ff14 to near-white #ddeedd, green is now reserved for UI chrome and accents only. Bracket notation ([COPY], [E2E]) replaced with inline SVG icons. Chat layout fixed with proper flexbox constraints. Added a live message counter showing remaining sends before the per-minute rate limit. Polling interval increased from 1 s to 2.5 s with exponential backoff on connection errors.