PHP Releases Fixes for Two Critical Remote Code Execution Flaws

·1 views

PHP published patches on October 21 addressing CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities that could allow unauthenticated remote code execution. The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12, or vendor packages carrying equivalent fixes. PHP-FPM users are also required to apply the update. The article advises administrators to confirm the PHP runtime actually serving web requests, not just the command-line version, and to check every deployed instance, including containers, staging servers, and forgotten applications. It also warns that vendors may backport fixes without changing version numbers, and that updating Composer dependencies does not install runtime patches.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Turning Mexico's FONE Pay Calendar PDF into Structured, Verifiable Data

Mexico's DGSANEF publishes the FONE education payroll calendar as an annex, a document written for human reading rather than machine use. Because hundreds of thousands of federalized teachers rely on these dates, the independent site PortalFone converted the annex into a structured, quincena-by-quincena calendar page. The project separated ordinary and extraordinary payroll dispersion from check delivery and bank deposit, since merging them into one payday field can spread confusion. Each entry keeps its source trail to the official annex, and a client-side CURP/RFC validator checks identifiers without sending data off the device. The result is one canonical, regularly updated page in place of recurring screenshots of the PDF.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Authtics Host Adds Built-In Developer Panel for Debugging Apps From a Phone

A developer built Authtics Host, also called HostJS, a TypeScript web framework inspired by Next.js that supports SSR, SSG, CSR, and a beta SRTWS mode. The framework includes a built-in Developer Panel, created because the author often develops on a phone and wanted to avoid switching between separate debugging tools. The panel offers eight tabs covering logs, route and page info, network requests, client details, the framework version, and server metrics such as heap and CPU usage. It also lets developers restart or shut down the running app and pause or resume incoming users, depending on access configuration. The author describes the setup steps, which require Node.js 22 and an npm install, and notes the framework is still under development.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Port 514 dominates ZoomEye syslog results, complicating FortiAnalyzer exposure measurement

ZoomEye queries run on 23 October 2026 returned 14,860 hosts fingerprinted as FortiAnalyzer, but none of them showed a matching TLS service. The port 514 query returned 994,157 results, a count inflated by the many syslog-emitting devices on the internet, while port 6514 returned just one. The analysis argues that the port-based count is the least meaningful of the four queries and the one most likely to be misquoted. Because FortiAnalyzer aggregates security logs and configuration records, the article stresses checking whether a specific firmware build appears in Fortinet's advisory affected lists, citing PSIRT advisories FG-IR-26-178 and FG-IR-25-246. It also recommends comparing log retention windows against organisational detection latency.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Bing Adds Topics Portfolio Beta to Show Gaps in AI Search Citations

Microsoft has launched Topics Portfolio, a beta feature in Bing Webmaster Tools that shows publishers where their content is cited in AI-generated search responses and where it is missing. The tool sits within AI Performance reports and groups grounding queries, the search terms Bing's AI uses for Copilot, Bing AI summaries and partner integrations, into broader themes. For each topic it shows approximate citation volume, the number of sites cited and the number of queries, while flagging high-potential queries where competitors are cited but the user's site is not. Microsoft presents the feature as a planning aid rather than an exact measurement system, and citation figures are shown as ranges. Users can start by opening the AI Performance report, selecting the Topics tab and choosing a one- to three-month window.

0 comments Read more at DEV Community