PHP Releases Fixes for Two Critical Remote Code Execution Bugs Leaked Early

·1 views

PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026 to fix two critical remote code execution vulnerabilities, collectively known as php2shell. Both bugs, scored 9.2, sit in memory management and error handling, and can be triggered by requests that need no credentials. The coordinated disclosure embargo broke about two days early after CVE identifiers circulated with an incorrect score, prompting PHP to move its release forward by a day. Distribution packages will follow on each vendor's own schedule, so PHP recommends interim mitigations such as removing the memory limit, lowering post_max_size and enforcing request limits at the proxy. Every PHP installation serving web requests is affected, with mod_php rated the highest risk because exploitation can occur before application-level defenses run.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

OpenCode Warns Console Users After Attacker Reaches Legacy System Holding Provider Keys

OpenCode, an open-source AI coding agent run from the terminal, emailed affected users of its hosted Console on 17 October 2026 about a potential breach. The company said an attacker accessed a legacy system it was decommissioning, and that third-party keys saved in workspaces, including OpenAI and Anthropic keys, may have been exposed. It later described the incident as a large-scale distillation attack affecting 1.4 percent of Console users, meaning those who had linked external providers. Affected users were told to revoke and replace their keys at the provider, update applications, and check recent usage. OpenCode has not said whether the exposed keys were stored in the legacy system itself.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Experts Propose Layered Spending Limits for AI Agents Making Payments

A Marketing AI agent's $220 ad purchase cleared automatically, but a second $150 purchase by the same agent was routed to the store owner for approval because combined spending crossed a $300 daily threshold. The article argues AI agents should receive layered spending controls like corporate cards: monthly budgets, per-payment caps, daily windows, approval bands, and blocked categories. The author, who works on a payments product, describes checking these limits on the server before payments execute, so they hold regardless of the agent's memory. A sandbox demo shows a coffee-roaster company configured with four agents, each sized to its role. The piece also notes limitations in the current engine, such as per-payment caps not being enforced as a standalone field.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Cerebras Details Weight-Streaming Design to Address Memory Limits in Trillion-Parameter AI

As AI models approach a trillion parameters, traditional GPU clusters face growing memory and interconnect bottlenecks that can make communication costs rival computation time. Cerebras has described a Weight-Streaming approach built on its Wafer-Scale Engine 3, which separates memory from compute by storing weights in an expandable external DRAM pool and streaming them onto the wafer layer by layer. The design treats a large monolithic compute fabric as a single device, which could simplify software compared with managing parallelism across thousands of GPUs. Independent benchmarks on cost, energy, and latency against GPU systems such as NVIDIA's H100 and B200 are still emerging, and migrating custom CUDA kernels may require extra engineering. Whether this model becomes mainstream will depend on further performance validation and ecosystem support.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Monitoring many WordPress sites without alert fatigue

Monitoring a fleet of WordPress sites is harder than managing one, since updates lag, hosts fail intermittently, and noisy alerts lead teams to mute them. A homepage returning 200 OK does not reveal vulnerable plugins, outdated PHP, expiring TLS certificates, or unauthorized administrator accounts. The approach described combines external uptime checks with an installed agent that reports site data, and automatically matches plugins against vulnerability information. Because shared hosting often blocks or caches incoming requests, the panel pulls data through several fallback routes rather than relying on heartbeats, and each request is authenticated with HMAC-SHA256 signatures, timestamps, and nonces to prevent tampering and replay.

0 comments Read more at DEV Community