PHP Flaws CVE-2026-109618 and CVE-2026-109619 Forced Government Sites Offline Across Europe

·1 views

Two PHP vulnerabilities, both rated 9.2 and allowing code execution without authentication, led to attacks beginning on October 21, 2026, before any fix was available. Government services were disrupted in several European countries, including the Netherlands, Finland and France, with some sites taken offline as a precaution. Researchers had reported the bugs to the PHP project in August, but details leaked on October 20, prompting an earlier release. Fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 shipped at 14:00 UTC, while PHP branches 8.1 and older received no official patch because they had reached end of life. The episode highlights the added risk for organizations still running unsupported PHP versions.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Where Wealth Is Moving in America

A Hacker News post links to an article titled "Where Wealth Is Moving in America" published on thestatedtruth.com. The submission has drawn 6 points and 2 comments on the Hacker News discussion thread. The provided material contains only the link and engagement metrics, without the article's body text. As a result, the specific findings, data, and conclusions about wealth migration across the United States cannot be confirmed from this source.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Microsoft Links ConnectWise Cloud Backup Supply-Chain Attack to Storm-0940

Microsoft has attributed a supply-chain attack on ConnectWise customers' Microsoft 365 environments to a threat group it tracks as Storm-0940. The intrusion path ran through ConnectWise's hosted Cloud Backup service. ConnectWise temporarily shut down services and began restoring them in phases, advising customers to keep connections disabled during the process, which it said would take several days. Microsoft said successful authentication does not necessarily mean the group accessed or stole data. Reporting does not state how many tenants were compromised.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Mistral Large 4 Weights Due Oct 31; Local Use Would Need Roughly 400GB of Memory

Mistral has announced Large 4, a 1.05 trillion parameter mixture-of-experts model with 52 billion active parameters, which it describes as open-weight. As of October 22 the weights are not yet downloadable, and the Hugging Face page points to an October 31 release. Mistral's documentation leaves the license unnamed, unlike its other recent models, which are listed under Apache 2.0. Self-reported benchmarks show mixed results, and commenters have questioned performance and pricing relative to rival models. Running the model locally would require memory for all of its parameters, with quantized estimates falling in the range of about 400GB or more.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Defense Contractors Urged to Shift From Snapshot to Continuous NIST 800-171 Evidence

Ahead of a Cyber AB Town Hall on October 27, the CMMC Reform Task Force's findings remain unpublished. Presenters at September's Town Hall speculated that the Department of Defense may move away from point-in-time assessments that quickly become outdated. Cybersecurity advisors recommend that contractors generate evidence on a regular schedule, such as monthly MFA and access reports, dated vulnerability scans, and centralized audit logs. They also suggest mapping each of NIST SP 800-171's 110 requirements to its proof, refresh cadence, and owner within the System Security Plan. Regardless of reform outcomes, contractors handling CUI under DFARS 7012 must still meet NIST SP 800-171 and maintain an accurate SPRS score.

0 comments Read more at DEV Community