PHP Security Release Sparks Panic Over Leaked CVEs and Misguided Advice

·1 views

A PHP security release prompted urgent patching advice across PHP 8.2 through 8.5, which the author recommends applying first. CVE numbers leaked a day early with an inflated CVSS score, and a proof-of-concept video circulated before being taken down. CERT-EU's guidance to patch or isolate internet-facing applications was reportedly oversimplified into a call to go offline, disrupting some government services. The author argues that widespread panic, amplified by AI-generated imagery and overshadowed by a critical GitLab vulnerability released the same day, distorted the actual risk. The PHP Foundation's post-mortem reportedly notes that one coordinated provider broke the embargo more than six hours early.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Anthropic Launches Claude Duet, a Lightweight Chat Model for Engineers

Anthropic has released Claude Duet, a smaller chat-optimized language model designed to run on a single GPU and accessible through a public HTTP API. Positioned as a coding co-pilot, it targets interactive assistance, data exploration, and low-latency inference rather than the heavier tasks of its larger Claude 3 sibling. The article highlights lower inference costs, since a roughly 7 billion parameter model fits in 16 GB of VRAM, along with reported response times under 300 milliseconds for 512-token prompts on a V100 GPU. It also notes that the API uses the same JSON schema as Claude 3, allowing existing tooling to be reused with minimal changes. The author walks through a sample setup that deploys a GitHub issue summarizer in Kubernetes using the official Python client.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Autonomous AI Agents Can Use Gas-Sponsored Transactions on Base L2 via ERC-4337

A DEV Community article argues that autonomous AI agents often fail in production because they hold private keys with native gas balances, which creates both operational stoppages and security risks. It proposes ERC-4337 Account Abstraction on Base L2 as a fix, separating transaction authority from gas payment through a Paymaster contract. Under this model, agents submit UserOperations that a Paymaster sponsors, letting them act onchain without holding ETH while treasury rules limit which transactions get covered. The piece includes a Python example that constructs, sponsors, and signs such an operation targeting a designated treasury address.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds 59 free browser-based dev tools in vanilla JS with no server or tracking

A developer has created Antigravity Tools, a collection of 59 free utilities for programmers that run entirely in the browser. The project was built with no dependencies, no backend server, and no telemetry, so user data never leaves the device. Its tools rely only on native browser APIs such as Web Crypto, Canvas, Web Audio, and IndexedDB. The collection covers areas like JWT decoding, key generation, PII masking, encoding, AI token cost estimation, JSON conversion, regex testing, and cron building. The author shares the project and the lessons learned while developing it.

0 comments Read more at DEV Community

ProgrammingHacker News ·

CVE-2026-111943 Reports a Compromised Intermediate Certificate Authority

A vulnerability identified as CVE-2026-111943 has been listed in the U.S. National Vulnerability Database, concerning a compromised intermediate certificate authority. The entry was shared on Hacker News, where it gained 17 points and drew 5 comments. The available source material provides only the vulnerability identifier, its database listing, and the discussion metadata, so the full technical scope, affected systems, and severity are not described here. Readers are directed to the NVD entry and the linked discussion for further details.

0 comments Read more at Hacker News