
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
pafex
Advanced tools
Affected versions:
Minimal checksummed binary configuration handling for Python. Config
layers user settings over DEFAULT_CONFIG; load_config/save_config
persist to a strict binary format with optional gzip/xz/zlib compression.
Standard library only.
pip install pafex
from pafex import Config, load_config, save_config
cfg = Config({'strict_mode': True, 'allowed_tags': {'p', 'a'}})
cfg.get('strict_mode') # True
cfg.get('strip_whitespace') # default from DEFAULT_CONFIG
cfg.update({'max_depth': 3}) # new Config, original untouched
save_config(cfg, 'default.config', compression='gzip')
loaded = load_config('default.config')
loaded == cfg # True
Config file layout:
raw: [8-byte MD5 checksum][4-byte size][config]
gzip: [8-byte MD5 checksum][4-byte size][gzip.compress(config)]
xz: [8-byte MD5 checksum][4-byte size][lzma.compress(config)]
zlib: [8-byte MD5 checksum][4-byte size][zlib.compress(config)]
Writes are atomic (temp file + os.replace). With no explicit
path, load_config/save_config locate the caller's default.config
(caller's module directory first, then the package directory).
Errors raise PafexError subclasses: ConfigLoadError (read/parse
failures), ConfigChecksumError (integrity mismatch) and
ConfigDecompressError (corrupt compressed payload).
FAQs
Minimal checksummed binary configuration handling.
The pypi package pafex receives a total of 107 weekly downloads. As such, pafex popularity was classified as not popular.
We found that pafex demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.