PHP Engine Flaws CVE-2026-109618 and CVE-2026-109619 Allow Unauthenticated Code Execution

·1 views

Two critical vulnerabilities in the PHP engine, tracked as CVE-2026-109618 and CVE-2026-109619, were patched on 21 October 2026. Both permit unauthenticated remote code execution because the flaws sit in memory management and error handling that PHP runs before any application code. Keeping a CMS or plugin current does not protect a site if the underlying PHP runtime is unpatched, and the PHP project says updating is the only safe fix. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and administrators are advised to inventory every PHP instance, including containers and bundled vendor products, and restart services after patching. Some government platforms took sites offline or moved them behind a CDN as a precaution until the fix was verified.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Pwn.watch Launches Site Tracking Recent Security Breaches

A new website called pwn.watch has been shared on Hacker News, where it is listed as a resource for following security compromises. The submission linked to the site and received five points and one comment from readers. The available source material provides no details about which breaches the site covers or how it collects its information. Further specifics about the platform's scope and methodology are not included in the original post.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

The Lazy Python Tutor: A Chatbot That Answers Coding Questions in Plain Language

A developer has built a Streamlit-based app called The Lazy Python Tutor, aimed at people who want quick answers instead of a full course. Users ask a single question and receive a plain-language explanation along with one small example. The project was submitted to the Hacktoberfest 2026 DEV Challenge and is available as both a live app and open-source code on GitHub. Planned future features include an error-explanation tool for absolute beginners, voice input, and a feature that turns chat history into short recap cards. The creator describes the core goal as complete, with the focus now on possible extensions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

MagicRemover Explains Why Its AI Eraser Re-renders Entire Photos

A developer of the browser-based AI eraser MagicRemover found that two of its help pages gave conflicting accounts of how edits affect a photo. Tracing the pipeline showed that instruction-based editing regenerates the whole image from a text prompt, so the brushed area is not the only part that changes. The company switched from mask inpainting, which leaves untouched pixels identical to the original, to an instruction-following editor in June, improving shadow handling. Before any upload is sent, images are downscaled to about one megapixel, and a vision-language model labels the marked subjects from a red-filled copy. The post notes that some site copy still described the older behaviour.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Context-shrinking tool cut AI agent token use 78% but lost two answers

A developer tested Hexum, a hosted MCP server that trims code before sending it to an AI model, against sending full files and against no files. Across 10 questions about open-source Python and TypeScript libraries, the trimmed approach cut tokens sent to the model by a median of 77.7%. Accuracy fell from 9 of 10 with full files to 7 of 10 with Hexum. Analysis of the misses showed the answer files were shown only by bare filename without their folder path, causing the agent to search wrong locations. The author also reported a bug in which repeated requests returned empty views, which the founder fixed within two days.

0 comments Read more at DEV Community