PHP Releases Fixes for Two Critical Unauthenticated RCE Vulnerabilities

·4 views

Two newly disclosed PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have drawn wide attention after details leaked early on Hacker News on October 20, 2026. Both were described as CVSS 10.0 flaws allowing unauthenticated remote code execution, prompting CERT-EU to advise organisations to take websites offline if they could not patch. Early exploit videos and proof-of-concept code circulated, but confusion persisted over which systems were affected and whether proposed configuration mitigations were effective. Many organisations, including parts of the Dutch government, temporarily took sites down while awaiting official fixes. PHP released patched Docker images on October 21, with downstream projects still rolling out updates over the following hours.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds Automated 14-County Property Data Pipeline Using Supabase and CrawlOS

A developer has described a system that pulls real estate records from 14 county databases, focusing on the Houston area's HCAD tax records. The pipeline is built on Supabase with CrawlOS, using a 17-table schema and an actor deployed for the Houston data source. Nightly runs are automated through pg_cron and reportedly generate about 125 qualified leads per execution. The approach runs on self-hosted infrastructure and avoids third-party data brokers. The article is aimed at real estate wholesalers who need current property information across fragmented county systems.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

MQTT Reconnects May Replay Queued or Retained Messages, Not Just New Events

An MQTT client reconnecting does not always find an empty inbox, since brokers can retain session data and deliver messages queued during an absence. Retained messages may also be delivered to a new subscriber, so a received message doesn't by itself show that a device produced a fresh event. This distinction matters for Home Assistant automations that react to messages after restarts, network drops, or broker maintenance. The article recommends a controlled lab test using a temporary topic, a known publisher and subscriber, and unique payloads to classify whether a delivery was new or replayed. It also notes that such a test does not establish whether a real device or service is healthy.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Building a Svelte input component with programmatic attachments

A DEV Community tutorial walks through building an in-house, validation-enabled input component for Svelte called OlInput. The goal is a simple, unobtrusive solution that binds to native HTML input fields and uses native Svelte binding. The author explains a Svelte limitation: projected snippet content is hard to reference from within the component, so a programmatic attachment is used to access the input node. The article covers wrapping the element in state, using untrack to avoid cyclic reactivity, and passing the input's ID back to its label. It also argues that the parent should remain explicitly responsible for assigning input IDs rather than generating them automatically.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Vedar's AI travel agent is barred from inventing Kamchatka tour prices

Vedar, a travel portal for Kamchatka, Russia, has built its AI agent so that it never generates prices, dates or availability itself. Those commercial facts are pulled as live data from local operators' databases, and the agent says so when no data exists. The agent helps travelers plan trips and creates requests that a human then confirms, rather than booking or taking payments. The portal also shows safety warnings from Russia's Emergency Situations Ministry and a volcano alert board based on KVERT and the Geophysical Survey. The company says it also allows third-party AI agents to access its data through MCP and A2A protocols.

0 comments Read more at DEV Community