PHP2Shell exploitation predates patches; Linux kernel flaw CVE-2026-46300 adds privilege escalation risk

·11 views

Attacks exploiting the two critical PHP flaws, dubbed PHP2Shell, reportedly began about four days before PHP released emergency fixes on 21 October. Researchers at TU Delft say they tracked more than 50,000 exploitation requests from over 600 IP addresses across 70 countries, though no reliable count of compromised servers exists yet. CISA has added both PHP flaws to its Known Exploited Vulnerabilities catalog, with a 29 October deadline for US federal agencies. On 28 October CISA also listed a Linux kernel local privilege escalation flaw, CVE-2026-46300, which CISA says can be chained with the PHP flaws to gain root access. The kernel flaw affects kernels built before 13 May 2026, and servers that have not been rebooted onto a patched kernel remain exposed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Psychological horror terminal game uses local AI to haunt players

THE LAST PROCESS is a Python-built terminal horror game that runs natively and connects to local open-weight models through Ollama to power its antagonist, Entity 0. Players investigate an abandoned research station, where files rewrite themselves, surveillance feeds reveal a figure behind the console, and the entity remembers players across sessions. The game engine, not the AI, controls the story events, clues, and three possible endings, and it works without Ollama using a fallback dialogue system. The developer says the game runs entirely in a virtual environment and does not touch personal files or execute real system commands. The project is available on GitHub and requires Python 3.10 or later.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Lumo Runs Note Search On-Device on iOS to Cut Latency and Keep Data Private

Lumo, a memory copilot app for iOS, is designed to process notes locally rather than relying on cloud servers, which its developers say avoids network delays and keeps sensitive content off third-party systems. The app pre-warms the audio session so recording begins within about 100 milliseconds of tapping the microphone, and it scrubs filler words and ambient noise with native audio filters. Text embeddings are generated on Apple Silicon's Neural Engine, with token processing overhead said to stay under 15 milliseconds. Notes and their vectors are stored in an encrypted SQLite index protected by Apple's Data Protection Keychain keys. The developers argue that each extra half-second of friction in capture sharply reduces how often users actually record notes, which motivated the fast, minimal-step design.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

A 60-line vanilla JavaScript tool scores YouTube titles entirely in the browser

A developer identifying as Meo, an AI agent running a shop for faceless YouTube creators, shared a free title checker built in about 60 lines of vanilla JavaScript. The tool scores titles against common best practices such as length between 35 and 60 characters, the presence of a number or date, a curiosity word, a sensible word count, and avoiding all-caps or excessive punctuation. Each rule carries a point value, with a title passing every check scoring 100, and the score updates live as the user types. Because the page runs entirely in the browser with no backend or signup, titles are never transmitted anywhere, which the author highlights as a privacy advantage for unreleased ideas. The author stresses that the checker measures established best practices and cannot predict actual view counts.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

A one-page checklist for testing an AI workflow before handing it to another team

A small team can hand off an AI workflow without a formal program, provided it has one bounded workflow, a few honest tests, and someone who can run them independently. The author uses a hypothetical demo, an assistant that reads a shared support inbox and drafts replies for human review, to illustrate the process. Key steps include stating in one sentence what the workflow does and does not do, testing it with ordinary and malformed inputs, and auditing every system and tool it can reach. The checklist also requires confirming that sending requires explicit human approval, mapping where data travels and how long it is kept, and giving the handover person a one-page guide covering scope, access, how to pause, and who to contact. The process ends with the new owner running the checks alone, so that any gaps are fixed in the documentation rather than blamed on the person.

0 comments Read more at DEV Community