PHP Patches Two Critical Flaws as October 2026 Vulnerability Disclosures Surge

·3 views

On 21 October 2026, PHP released fixes for two memory-related flaws, CVE-2026-109618 and CVE-2026-109619, each scored 9.2 on CVSS, that allow remote code execution without authentication. The bugs affect web servers running PHP 5.4 or later, and were disclosed jointly by researchers at Calif, Wiz, OpenAI and Quarkslab. Several European government agencies took websites offline to apply the patches, while Vietnamese authorities advised reviews without alarm. Industry analysis found that CVE disclosures in 2026 have roughly doubled compared with the same period in 2025, and that CVEs crediting AI systems have risen sharply, though exploitation has grown far more slowly. Analysts say the main shift is in how quickly attacks follow disclosure, placing added pressure on teams responsible for patching.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Psychological horror terminal game uses local AI to haunt players

THE LAST PROCESS is a Python-built terminal horror game that runs natively and connects to local open-weight models through Ollama to power its antagonist, Entity 0. Players investigate an abandoned research station, where files rewrite themselves, surveillance feeds reveal a figure behind the console, and the entity remembers players across sessions. The game engine, not the AI, controls the story events, clues, and three possible endings, and it works without Ollama using a fallback dialogue system. The developer says the game runs entirely in a virtual environment and does not touch personal files or execute real system commands. The project is available on GitHub and requires Python 3.10 or later.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Lumo Runs Note Search On-Device on iOS to Cut Latency and Keep Data Private

Lumo, a memory copilot app for iOS, is designed to process notes locally rather than relying on cloud servers, which its developers say avoids network delays and keeps sensitive content off third-party systems. The app pre-warms the audio session so recording begins within about 100 milliseconds of tapping the microphone, and it scrubs filler words and ambient noise with native audio filters. Text embeddings are generated on Apple Silicon's Neural Engine, with token processing overhead said to stay under 15 milliseconds. Notes and their vectors are stored in an encrypted SQLite index protected by Apple's Data Protection Keychain keys. The developers argue that each extra half-second of friction in capture sharply reduces how often users actually record notes, which motivated the fast, minimal-step design.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

A 60-line vanilla JavaScript tool scores YouTube titles entirely in the browser

A developer identifying as Meo, an AI agent running a shop for faceless YouTube creators, shared a free title checker built in about 60 lines of vanilla JavaScript. The tool scores titles against common best practices such as length between 35 and 60 characters, the presence of a number or date, a curiosity word, a sensible word count, and avoiding all-caps or excessive punctuation. Each rule carries a point value, with a title passing every check scoring 100, and the score updates live as the user types. Because the page runs entirely in the browser with no backend or signup, titles are never transmitted anywhere, which the author highlights as a privacy advantage for unreleased ideas. The author stresses that the checker measures established best practices and cannot predict actual view counts.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

A one-page checklist for testing an AI workflow before handing it to another team

A small team can hand off an AI workflow without a formal program, provided it has one bounded workflow, a few honest tests, and someone who can run them independently. The author uses a hypothetical demo, an assistant that reads a shared support inbox and drafts replies for human review, to illustrate the process. Key steps include stating in one sentence what the workflow does and does not do, testing it with ordinary and malformed inputs, and auditing every system and tool it can reach. The checklist also requires confirming that sending requires explicit human approval, mapping where data travels and how long it is kept, and giving the handover person a one-page guide covering scope, access, how to pause, and who to contact. The process ends with the new owner running the checks alone, so that any gaps are fixed in the documentation rather than blamed on the person.

0 comments Read more at DEV Community