PHP patches two critical RCE flaws, CVE-2026-109618 and CVE-2026-109619, urging immediate updates

·2 views

On October 21, 2026, the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities that can enable unauthenticated remote code execution. The PHP Group rates both at CVSS v4.0 9.2, and CISA added them to its Known Exploited Vulnerabilities catalog on October 26, 2026, though it is unclear whether public exploit code exists. One flaw stems from memory exhaustion that corrupts partly initialized request data, while the other arises from stale global state that lets a later request read freed memory. All PHP releases before the patched versions are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and versions 8.1 and older no longer receive official updates. The project says updating and restarting PHP workers is the only complete mitigation, with interim configuration limits only reducing exposure.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Giving AI Agents Access to Data Raises Security Risks Developers Must Address

A DEV Community article argues that AI agents with tool access to databases, email, and business systems create new security challenges for developers. It uses a customer-support CRM example to illustrate excessive agency, where an agent is exposed to far more capabilities than its task requires, such as deletion or bulk export. The piece explains that external content like customer notes can carry hidden instructions that redirect an agent, a risk known as indirect prompt injection. It recommends limiting tools to the minimum needed per role, using narrowly scoped credentials, and treating all external data as untrusted. The article frames these measures as essential as developers move from chatbots to autonomous workflows.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five NGINX flaws patched; exposure depends on config directives, not version alone

A set of five NGINX vulnerabilities has been addressed in a single release, but each depends on a specific configuration directive being present. The article uses a ZoomEye search returning about 313 million NGINX-fingerprinted assets to illustrate the scale of the problem, while stressing that this counts hosts exposing an nginx fingerprint rather than confirmed vulnerable servers. A separate CVE-based search returned zero results, showing that CVE indexing cannot replace product and configuration review. The author recommends enumerating fingerprinted hosts, then checking their configuration output for the five triggering conditions. Vendor advisories from NGINX and F5 are linked for the affected cases.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Homelab security console warden adds a five-minute demo setup

The developer has released warden, a homelab security console that reads logs, scans machines, and proposes bans and patches that the user must approve in Discord. A setup guide lets users try it on demo data in about five minutes, without connecting it to any real systems. The guide is tested weekly via a GitHub job on fresh Ubuntu machines, with support for Ubuntu 24.04 and Debian 13. Warden also offers a REST API and MCP endpoint that let AI agents query its status, though every tool is read-only and cannot ban or patch anything. A check command reports which features are working and what to fix, and the full guide is available on GitHub.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Reshapes Software Hiring, Hitting Entry-Level Developers Hardest

Software developer employment has not collapsed, but hiring is shifting toward senior and AI-related roles. US software job postings remain well below their February 2020 level yet have risen roughly 15% since early 2025, with most of the gain in senior positions. Research from Stanford economists using ADP payroll data finds employment of workers aged 22 to 25 in AI-exposed jobs is about 19% below its expected trend, mainly through fewer hires rather than layoffs. The Bureau of Labor Statistics still projects 10% growth for software developers over the next decade, while the narrower computer programmer role is expected to decline. Analysts continue to debate how strongly AI is driving these changes.

0 comments Read more at DEV Community