PHP Announces Emergency Security Release for Two Critical Flaws on October 21

·1 views

The PHP security team has scheduled an emergency release for October 21, 2026, at 14:00 UTC to fix two vulnerabilities, each rated 9.2 under CVSS v4.0. Users are urged to prepare for rapid upgrades, and the team says the release could come sooner if details go public or exploitation is observed. As of now, PHP has not published the affected versions, fixed version numbers, or technical details of the flaws. CERT-EU has identified the issues as CVE-2026-109618 and CVE-2026-109619, and cites possible unauthenticated remote code execution, though it has not published technical analysis. Security agencies advise identifying all PHP deployments, prioritizing internet-facing systems, and confirming update procedures until official fixed versions are released.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Study Argues Most Advice Reflects the Giver's Own Circumstances

An essay on coached.com contends that much of the advice people offer is well-suited to the person giving it but not necessarily to the recipient. The piece suggests advisors often draw on their own experiences, strengths, and situations without fully accounting for differences in the listener's context. As a result, guidance that worked for one person may fail when applied to someone with different resources, goals, or constraints. The argument encourages people to weigh advice with that mismatch in mind. The source article's full details beyond this framing were not included in the provided text.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Japanese Filenames Broke a Mac App's Code Signature After DMG Copy

A Mac app was reported as damaged after distribution, with codesign verification failing on a sealed resource. The developer traced the problem to four Japanese filenames containing voiced sound marks, which were converted from NFC to NFD normalization when the app was copied from a DMG. Because the altered names no longer matched those sealed during signing, the signature check failed even though the names looked identical on screen. The fix bundles the Japanese-named files into a single ASCII-named file that is extracted on first launch with NFC-normalized names. After this change, code signature verification passed following the copy.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Local AI Tool That Writes and Verifies CTF Reverse-Engineering Challenges

A developer created SlothCTF, an open-source tool that uses a locally run open-weight model to generate reverse-engineering CTF challenges from a short text prompt. Early attempts failed because language models repeatedly miscalculated byte-level XOR encoding, so the design was changed to have the model write C programs while the compiler performs the exact arithmetic. Each generated challenge is compiled, executed, and checked to confirm the flag is recoverable, that correct input is accepted and wrong input rejected, and that the plaintext secret does not appear in the binary's strings. The developer reported that all 20 of their planned challenge prompts produced valid challenges, each including source code, a compiled binary, a player README, and an organizer walkthrough. The project was submitted to a Hacktoberfest open-source AI challenge.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Modder's Endless Legend 2 automation tools expose solved city-layer mechanics

A modder has released Endless Legend 2 mods that automatically choose the best population growth, swap jobs, and buy foundations, aiming to reduce tedious micromanagement in wide and late-game play. Players praised the time savings, with one reporting hundreds of fewer clicks. The author argues this reflects that many city-layer decisions have a computable optimal answer, making them data entry rather than meaningful choices. Others counter that the dense adjacency puzzle is a deliberate depth that fans enjoy, though the mandatory nature of district management means solved tasks crowd out the decisions that remain open. The author concludes that the real issue is manual repetition of solved decisions, and suggests Amplitude should incorporate such automation into the game.

0 comments Read more at DEV Community