PHP Core Flaws Dubbed PHP2Shell Allow Unauthenticated Server Takeover

·14 views

Two critical vulnerabilities in the PHP runtime, nicknamed PHP2Shell, were leaked ahead of schedule on October 20, 2026. The PHP team moved its security release up by a day, shipping fixes on October 21. Both flaws, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 under CVSS v4.0 and can let an unauthenticated attacker run code on a vulnerable web server via a crafted HTTP request. They stem from memory handling during request setup and cleanup, so they exist below application code and are not fixed by updating apps like WordPress alone. CISA lists affected configurations including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed, with mod_php considered the highest risk.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why LLM eval score gains may be noise, and how paired bootstrap tests can gate changes

Teams often approve prompt or model changes based on small average eval score gains that turn out to be statistical noise, leading to production regressions. Eval results are affected by sampling noise in small golden sets, judge variability, and task-level factors like temperature and retrieval drift. Comparing baseline and candidate configurations on the same examples, rather than comparing raw averages, cancels out example difficulty and isolates the real change. The article explains that the required sample size depends on how often the two configurations disagree per example, and that small gains are often undetectable with a 200-example set. It proposes a simple stdlib Python paired bootstrap gate that ships a change only when the confidence interval of the difference clears zero.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

msiexec repair mode can resolve source paths from user-writable installer directories

A DEV Community article explains how Windows Installer's repair operation restores missing or modified files using source locations recorded in the installation database. When original media is unavailable, msiexec may fall back to cached package data or directories derived from the installation context. The author notes that per-user installs write into user-writable profile directories, while per-machine installs typically use administrative resolution paths. The piece advises checking whether affected products run services or tasks as SYSTEM and verifying resulting paths after deployment. It stresses that exploitability depends on each product's component registration, install scope, and source directory permissions, and makes no claim about any specific vendor.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Handling Failures in Healthcare AI Agent Workflows

Agentic healthcare systems coordinate several dependent operations, so a failure in one step can stop an entire workflow from reaching its goal. Common examples include rejected referrals, unavailable services, missing authorizations, incomplete records, and repeated communication breakdowns. The article argues that robust architectures should separate transient errors, which may warrant bounded retries with backoff, from recoverable failures needing more information or an alternative pathway, and from persistent or clinically serious failures that should be escalated. It stresses keeping workflow state observable by logging completed steps, failed operations, outstanding requirements, and attempted actions, which helps prevent duplicate execution and informs the receiving professional. Crucially, a technical failure should not be treated as resolving the underlying clinical task, so unresolved referrals must retain their status and be routed appropriately. The author closes by asking healthcare AI engineers and clinical informaticians which failure-handling patterns have proven effective.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Claude Code Deploys a Project, and a Live Console Shows It Update Without Refresh

A 26-second unedited recording shows an AI coding agent, Claude Code, deploying a Postgres database, an API, and a web service. On the adjacent screen, a live console updates on its own as each component restarts and turns green. The console receives no manual refresh and no pushed feed, since it re-reads status on a timer. The author says the motion was deliberately designed so developers can watch the deployment progress. The post is promotional for the gagarin.cloud platform, which lets users hand over a repository for deployment.

0 comments Read more at DEV Community