PHP Releases Fixes for Two Critical RCE Flaws; Public Exploit Claims Only Partly Verified

·7 views

PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026, to address two critical vulnerabilities, CVE-2026-109618 (OOM corruption) and CVE-2026-109619 (stale global state across requests), both scored 9.2 under CVSS v4.0. A researcher testing a publicly circulated proof-of-concept found it did not reproduce the claimed use-after-free or remote code execution in several test builds, and found the official patches address different root causes. However, a chain combining the session.upload_progress feature with an application-level file inclusion vulnerability did achieve unauthenticated code execution in the researcher's lab. The researcher concluded that upgrading is the complete fix for the core CVEs, while applications using such a chain may remain exposed after upgrading.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

LLM Agents Tested in Pokemon Showdown Battles, Research Post Shared

A research write-up examining how large language model agents perform when playing Pokemon Showdown, a competitive online Pokemon battle simulator, was shared on Hacker News. The post is hosted on the author Oliver Grabner's personal research page. The available material provides only the headline, a link, and a small amount of community engagement, with three points and no comments at the time of capture. Details about the specific methods, results, or conclusions of the agent experiments could not be confirmed from the information provided.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Blended AI visibility score of 29.2 masks sharp differences by question type

An author's daily AI citation tracker recorded a blended visibility score of 29.2 on 21 October, with each answer from two web-grounded models rated 0 to 3 for how well it identifies the tracked entity. Broken down by question type, the entity performed well when asked about the author by name (88.9%) but almost never came up in open genre questions (16.7% for genre recommendations and 0% for genre, comparison and research prompts). The blended figure was driven largely by how many prompts fell into each bucket, so changing the question mix alone would move the score without any change in model behaviour. The author also cautioned that buckets of four or fewer answers are too small to support trends, and that the 12.5-point gap between the two models amounts to just two fully correct answers on a single day. The author plans to pool a week of results per bucket before drawing comparisons.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Agencies Should Audit Domain Control When Clients Keep Registrar Accounts

Domain names underpin DNS, website traffic, email routing, and SSL certificate issuance, making them a critical point of failure. Agencies often manage websites for clients who keep their domains in personal or legacy registrar accounts they cannot administer. This arrangement leaves agencies responsible for uptime and security without control over the asset that keeps the site reachable. The article proposes a 'Broken Chain of Custody' audit to map administrative gaps, strengthen account security, and set contractual boundaries for domain-related outages. It notes that this is operational guidance rather than legal advice, and recommends attorney review of any contract language.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Troubleshooting Failed Batch Silent Installs of GBase Database Across Multiple Servers

When a silent installation of GBase Database (GBase 8s) fails on several servers in a batch rollout, the guidance is to pause remaining deployments to avoid spreading the problem. Administrators should record which nodes succeeded, failed, or were not yet processed, and avoid altering verified nodes without cause. One failed server should be re-run using the same response file and parameters, with full output and logs examined to find the first error. The article advises checking the response file's presence, integrity, and contents, comparing failing nodes with a known-good node, and looking for leftover files, port conflicts, and differing disk space. Fixes should be verified on the selected server before the rollout resumes.

0 comments Read more at DEV Community