PHP Core Patches Fix Two Critical Unauthenticated RCE Flaws, CVE-2026-109618 and CVE-2026-109619

·7 views

On October 21, 2026, the PHP team released emergency patches for two severe remote code execution vulnerabilities in PHP core. Rated 9.2 on CVSS v4.0 by PHP and 10.0 by watchTowr, the flaws could let attackers run code on web servers without authentication. Details leaked a day before planned disclosure, which prompted the accelerated release. Fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with mod_php configurations facing the highest risk. A vendor-sponsored test reported on the Gardience blog patched 600 Debian web servers through a single approved action and verified the result with a rescan, though configuration changes alone are not considered a complete fix.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Boolflow flattens nested circuit blocks into one simulated netlist, with a pin-mapping bug found along the way

Boolflow is a free browser logic simulator in which each block stores its own definition as a nested node, and before simulation every block is replaced by a copy of that definition. The flattening step gives every inner element a path-based id, such as DIV2/D.Q, with a #2 suffix for repeated copies, so simulation state stays distinct. Pins are determined by their position in the definition, and wires crossing a block's edge are rewritten to match, with an output-mapping step restoring block outputs after simulation. The author describes a bug in an early version that tied wires to pin index rather than pin name, causing a renamed-and-reordered output to silently read the wrong pin. The fix keeps wires attached to pins by name, with the editor reporting how many wires were moved or dropped.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Toán tử trong Java: các loại toán tử và cách sử dụng

Toán tử là các ký hiệu dùng để thực hiện phép tính và so sánh trong lập trình, và Java cung cấp nhiều nhóm khác nhau. Bài viết trình bày sáu nhóm chính gồm số học, bit, so sánh, logic, điều kiện và gán. Toán tử số học xử lý cộng, trừ, nhân, chia và lấy dư, còn toán tử bit thao tác trực tiếp trên từng bit của số nguyên. Toán tử gán mở rộng kết hợp phép tính với phép gán, giúp viết mã ngắn gọn và dễ đọc hơn.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DRIFTLIGHT: A Learning Lab for Reverse Engineering an Undocumented Game Protocol

The article introduces DRIFTLIGHT, a small UDP arena game built as a legal practice target for learning to reverse engineer undocumented game protocols. It provides stripped binaries, a recorded capture of 1,976 packets, and no documentation. The author walks through identifying a recurring magic number, a version byte, and an opcode field in a sample packet, and explains how the payload length and header size were worked out. Grouping packets by opcode and timing reveals much of the game's architecture before any payload is decoded. The first lab is offered free, while the full five-lab pack is available as an early-bird pre-order at $29 with automatic refunds if it does not ship.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Moving AKS Workloads from AAD Pod Identity to Entra Workload ID

Azure Kubernetes Service clusters that still authenticate through the deprecated AAD Pod Identity system need to migrate to Entra Workload ID, which uses OIDC federation. The old setup relies on AzureIdentity and AzureIdentityBinding resources plus Node Managed Identity pods, which add CPU overhead and security exposure. The guidance stresses first inventorying existing bindings to learn each workload's real access needs, then mapping each one to a federated Kubernetes service account. Entra ID matches the federated subject string exactly, and a missing pod label stops the webhook from injecting credentials, so both must be verified. The recommended approach is a staged migration with token exchange tested beforehand, followed by deleting the old resources and confirming through Azure Activity Logs that only the new identity makes the calls.

0 comments Read more at DEV Community