PHP Releases Emergency Patches for Two Critical Runtime Flaws Exploited in the Wild

·6 views

On October 21, PHP issued emergency security updates for two critical vulnerabilities, collectively called PHP2Shell, which can enable unauthenticated remote code execution under certain conditions. Both flaws sit in the PHP runtime itself, so patching application dependencies alone will not protect systems running a vulnerable interpreter. Exploitation has been demonstrated against Apache mod_php, and PHP-FPM is also affected. Both vulnerabilities were added to CISA's Known Exploited Vulnerabilities catalog on October 26, and fixed versions are available in the 8.2 through 8.5 branches. A separate, narrower PHP vulnerability disclosed on October 23 was not addressed by these releases, and PHP recommends disabling a session setting in affected configurations as a workaround.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Making Laravel Queue Jobs Retry-Safe with Unique Locks and Idempotency Keys

Queue jobs in Laravel can run more than once, through duplicate dispatches, concurrent workers, retries after partial success, or dispatch before a transaction commits. The article uses an invoice-sending job to Strike at a third-party e-invoicing provider as its example, since a repeated run there would send duplicate invoices. It recommends dispatching only after the database transaction commits, using the afterCommit option or the after_commit queue setting so rolled-back data never triggers a job. It then covers the ShouldBeUnique interface, which uses a cache lock keyed by uniqueId() to drop duplicate dispatches. The piece goes on to describe an idempotency key that keeps retries safe even after a crash, since no single tool covers all four failure cases.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Kubernetes Services Give Changing Pods a Stable Name and IP

Pods in Kubernetes are disposable and receive new IP addresses whenever they are replaced, which breaks any app that hardcoded an IP. A Service solves this by providing one stable name and virtual cluster IP that routes traffic to a changing set of matching Pods. The Service selects Pods by label, tracks their current addresses through EndpointSlices, and uses kube-proxy on each node to forward traffic. Cluster DNS, served by CoreDNS, automatically creates records for every Service so applications can reach each other by name without configuration. The tutorial demonstrates this with a three-replica Deployment and a ClusterIP Service tested from a temporary client Pod.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Recursive grep returned one file instead of four due to a shell function

An AI agent searching a test folder for a word received only one matching file, though four contained it, with no error shown. The agent traced the gap to a shell function named grep that called ugrep and added options to skip ignored and binary files. Running the same search with the real grep binary returned all four matches. The agent also found that the same commands gave different results when run in a child shell, where the function was not present. The agent notes this is one environment and that the findings do not generalize, and it recommends checking the command type before trusting a search.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

What Hosting Drupal Actually Requires: PHP, Database and Memory Floors

Drupal's reputation for slowness often stems from hosting choices rather than the software itself, as sites are frequently deployed on plans built for simple brochure sites. Drupal expects a current PHP version, a recent database, a real cache backend, shell access and a proper cron setup, which cheap shared hosting often fails to provide. Its published PHP and database requirements differ by release, with Drupal 11 and 12 demanding newer versions than Drupal 10. Several PHP branches approach end of security support around late 2026, when Drupal 10 also reaches end of life and Drupal 12 is released. Drupal's documented minimum is 64MB of PHP memory, though 128MB to 256MB is typical in production.

0 comments Read more at DEV Community