PHP Patches Two Critical Flaws That Allow Code Execution Without Login

·1 views

PHP released fixed versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21 to address two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell. Both carry a CVSS v4.0 score of 9.2 and allow attackers to execute code on a server without authentication. Because the flaws sit in PHP itself, updating WordPress or its plugins will not remediate them, and even fully updated WordPress installs remain exposed on unpatched PHP. Versions 8.1 and older are past end of life and receive only source backports or patched distribution packages, while 7.3 and older have no fix at all. Site owners are advised to verify their PHP version, confirm patches with managed hosts, or update through their Linux distribution, and to move to PHP 8.3 or newer.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Arc Browser to Be Sunset on December 22, 2026

The Browser Company has announced that its Arc web browser will be discontinued on December 22, 2026. The news was shared through the company's release notes, which are linked from the Hacker News discussion. The source material provided is limited to the headline and links, so the reasons behind the decision and details about any user migration path are not stated here. Readers seeking the full rationale and transition guidance should consult the original release notes.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Storing User Documents: Database Blobs Versus Object Storage for Large Files

For most SaaS document uploads, the recommended approach is to keep file bytes in object storage while saving searchable metadata in a relational database like Postgres or MySQL. This separation tends to scale more cheaply and keeps the database smaller and faster, with a clearer audit trail. Large files such as scanned contracts can turn a database-blob design into a backup and replication burden. The article suggests the database row act as the source of truth, storing ownership, status, checksum, and an object key, and it advises using unique keys per upload so originals are never silently overwritten. It also compares options including Postgres bytea, Amazon S3, Cloudflare R2, and MinIO, noting that Postgres can still suit small, tightly coupled files.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Hammock condenses WhatsApp group chats into two lines using an in-browser Gemma model

Hammock is an open-source tool that turns an exported WhatsApp group chat into a short digest: what happened, and what needs the user's attention. Code first filters out noise such as greetings, forwards, stickers, and deleted messages, and keeps only messages after the user's last reply that mention their name or nickname. Gemma, a small language model, then writes the summary and phrases each item needing action as a to-do, with one-tap reply drafts. Everything runs inside the browser with no server or account, and the model is downloaded once and cached for offline use. The project is MIT-licensed, with the first model download being about 0.8 GB.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Delayed JavaScript Broke a WordPress Mobile Menu Despite Strong PageSpeed Scores

A WordPress site scoring in the high 90s on mobile PageSpeed Insights had a hamburger menu that failed to respond reliably when tapped on a real phone. The site used the Kadence theme and LiteSpeed Cache, with JavaScript deferral enabled to reduce initial page load work. Desktop and emulated mobile checks did not reproduce the issue, but bypassing LiteSpeed's Page Optimization layer made the menu work again. The author then excluded the Kadence navigation scripts from delayed loading, noting these filename-based exclusions depend on the specific theme and setup. The author stresses this was not a controlled experiment and that the exact cause was not fully confirmed.

0 comments Read more at DEV Community