PHP Releases Urgent Security Updates for Two Critical Remote Code Execution Flaws

·1 views

On 21 October 2026, the PHP project issued security updates for all supported branches after identifying two vulnerabilities that can permit unauthenticated remote code execution, each rated 9.2 under CVSS v4.0. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, reside in the PHP engine itself, so application code and frameworks offer no protection. Fixed versions include 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and PHP maintainers state that no complete workaround exists beyond updating. Installations that serve web requests, including PHP-FPM, Apache with mod_php and several other setups, are affected, with mod_php considered the highest risk. Administrators are advised to verify patch status through distribution changelogs, since Linux packages may contain fixes without changing their upstream version numbers.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Docker vs. Kubernetes: How the Two Container Tools Differ

Docker and Kubernetes are both widely used by application developers working with containers, but they serve different purposes. Docker creates and runs containers, packaging applications into reusable images that behave consistently across environments. Kubernetes is an open-source platform for automating the deployment, scaling, and management of containerized applications, grouping containers into Pods across clusters of machines. Kubernetes offers features such as autoscaling, self-healing, load balancing, rolling updates, and service discovery. Docker suits local development, testing, and smaller applications, while Kubernetes is designed for orchestrating containers at scale.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Where Wealth Is Moving in America

A Hacker News post links to an article titled "Where Wealth Is Moving in America" published on thestatedtruth.com. The submission has drawn 6 points and 2 comments on the Hacker News discussion thread. The provided material contains only the link and engagement metrics, without the article's body text. As a result, the specific findings, data, and conclusions about wealth migration across the United States cannot be confirmed from this source.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Microsoft Links ConnectWise Cloud Backup Supply-Chain Attack to Storm-0940

Microsoft has attributed a supply-chain attack on ConnectWise customers' Microsoft 365 environments to a threat group it tracks as Storm-0940. The intrusion path ran through ConnectWise's hosted Cloud Backup service. ConnectWise temporarily shut down services and began restoring them in phases, advising customers to keep connections disabled during the process, which it said would take several days. Microsoft said successful authentication does not necessarily mean the group accessed or stole data. Reporting does not state how many tenants were compromised.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Mistral Large 4 Weights Due Oct 31; Local Use Would Need Roughly 400GB of Memory

Mistral has announced Large 4, a 1.05 trillion parameter mixture-of-experts model with 52 billion active parameters, which it describes as open-weight. As of October 22 the weights are not yet downloadable, and the Hugging Face page points to an October 31 release. Mistral's documentation leaves the license unnamed, unlike its other recent models, which are listed under Apache 2.0. Self-reported benchmarks show mixed results, and commenters have questioned performance and pricing relative to rival models. Running the model locally would require memory for all of its parameters, with quantized estimates falling in the range of about 400GB or more.

0 comments Read more at DEV Community