PHP2Shell: Critical PHP Flaws CVE-2026-109618 and CVE-2026-109619 Found Using AI

·1 views

Two critical vulnerabilities, dubbed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed in the core PHP runtime, each rated 9.2 under CVSS v4.0. The flaws affect PHP releases from 5.4 through 8.5 and sit in memory management and error handling code that nearly every request uses. An out-of-memory issue behind them was first noticed in 2024 during a security audit, but a patch stalled for about two years because no working exploit had been shown and fixes risked breaking compatibility. Researchers at Calif and cloud security firm Wiz used AI models from OpenAI and Google to find and weaponize the bugs, with Calif producing a pre-authentication remote code execution chain. Several government portals, Wikimedia systems and other public services temporarily went offline as a precaution while patches were prepared.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to turn a GitHub project into resume bullets recruiters find credible

A common resume mistake is listing a project's technologies without explaining the problem it solved or what the author personally did. The author recommends answering three questions: what problem the project addresses, which parts the candidate built, and what evidence a reviewer can verify. Using a hypothetical shift-swap app built for a café, the piece shows how a vague stack-focused bullet can become a specific, checkable one. It also argues that projects without real users can still be presented credibly by describing the engineering, tests, and documented decisions instead of invented metrics. The article closes with a checklist for reviewing project bullets and mentions a free resume-checking tool built by its author.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to test a data breach claim before believing or sharing it

Breach claims often spread on social media and forums within hours, frequently before anyone has verified them. Many are old leaks repackaged, scraped public data, or stitched-together lists, so a claim should be treated as an allegation until the organisation, CERT-In, a regulator or a credible researcher confirms it. Experts advise checking the source's track record and whether the record counts and fields are internally consistent. They also warn against downloading leaked samples, which carry legal risk and malware dangers. Individuals can check their own exposure through Have I Been Pwned and should change reused passwords and enable two-factor authentication. Under CERT-In's 2022 directions, specified cyber incidents must be reported within six hours of being noticed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Small Businesses Can Move to the Cloud Step by Step Without a Risky Overhaul

A guide argues that moving a small business to the cloud should be broken into small, sequential projects rather than one large migration. It recommends starting with cloud email and file storage for remote access and automatic backups, then migrating business tools such as accounting, CRM, booking, and inventory one at a time while running old and new systems in parallel. The article stresses proper account setup, including individual logins, two-factor authentication, and role-based access, since misconfiguration causes most small-business cloud incidents. It also advises enabling automated backups and updates, testing a restore once, and reviewing cloud spending monthly to avoid rising costs. The piece is published alongside promotion of the author's cloud services firm, Cloudlift Tech.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Multi-Platform Publishing Pipeline Gains VS Project and Bluesky Support

A developer extended an automated content pipeline so a new project, VS, could publish its daily markdown to Medium, Substack, and Bluesky in a single CI run. The pipeline had skipped the VS batch because its metadata flags were still set to false, which left no posts on any platform and triggered a Slack alert. An initial hard-coded workaround in the publishing script worked once but undermined the pipeline's declarative design. The fix restructured content into dated folders with per-platform files and made platform detection data-driven through metadata flags. A new Bluesky flag defaults to false so payloads can be validated before posting.

0 comments Read more at DEV Community