PHP2Shell Flaws Prompt Polyglot Teams to Audit Every Runtime, Not Just PHP

·1 views

A development team that mainly uses Django, React and Flutter initially dismissed the PHP2Shell advisories as irrelevant, then realized the real question is whether they run PHP anywhere. Two critical PHP core bugs, CVE-2026-109618 and CVE-2026-109619, are rated CVSS 9.2 and can be exploited without authentication before application code executes. Patched PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released October 21, and CISA added both flaws to its exploited vulnerabilities catalog on October 26. Reports indicate attackers chained PHP2Shell with a Linux kernel bug to gain root on servers, including PAN-OS firewall management interfaces that were running an end-of-life PHP branch. The authors argue the episode shows that runtime-level flaws need fast inventory of where each runtime lives, regardless of a team's primary languages.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Check Agent Config Files in Cloned Repos Before Opening Them With Claude Code or Codex

A developer guide warns that cloned repositories can contain configuration files that alter how AI coding agents such as Claude Code, Codex, and Gemini CLI behave. Files like .claude/settings.json, .mcp.json, and .gemini/settings.json can define shell-command hooks, MCP servers, and helper commands that run on the user's machine. The article notes that each agent applies its trust checks differently, and in some cases, such as non-interactive mode, those prompts are skipped entirely. It recommends inspecting these files with tools like git grep and jq before launching an agent in an unfamiliar project. The guide also outlines specific flags and settings that can limit what project-level configuration is allowed to run.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

LiteLLM 1.107.0 cleanup: what a stable security baseline should verify

A host-level cleanup can look finished while an exposed service, cached artifact, or stale credential remains active. LiteLLM's incident guidance calls for removing compromised artifacts from registries, rebuilding affected environments, rotating credentials, and confirming old releases cannot return through caches. External scans, such as ZoomEye queries on the LiteLLM title and default port 4000, show where services are visible, while internal records show which deployments exist, their owners, and the artifacts they run. The two views should be joined at the level of owned assets rather than summed, since one host or owner can appear across several queries. Closure requires verified ownership, confirmation that the compromised release is absent, correct authentication and ingress settings, and, where the payload could have run, credential rotation and a persistence check. Evidence must be timestamped, since earlier clean scans or newly created keys do not by themselves prove the final state.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Identity verification timeouts should not be treated as approval or rejection

When an identity verification provider times out or its callback arrives late, the check has not completed, so the outcome is neither approval nor decline. The article warns against letting users through or rejecting them by default and recommends recording the technical failure separately from the decision. It describes a synthetic SQLite-based example in which a session has a deadline, late or unrecognised events are marked expired or unknown, and recovery occurs locally without polling a provider. In the hypothetical scenario, an expired session routes to human review or an authorized provider refresh rather than an automatic retry. The example is a dependency-free fixture and not a live provider integration.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Phone lookup APIs can inform signup steps but cannot prove number ownership

A phone lookup API answers only a narrow question about a number, not about the person entering it. The article argues that developers should decide which signup decisions a basic lookup result can support before integrating one. Rejecting users whenever a lookup is inconclusive, or treating a lookup as proof of ownership, are both presented as design errors. A synthetic four-branch example maps normal, unknown, provider failure and OTP outcomes to caller-owned next steps such as continuing signup, review, bounded retries or an existing OTP provider. The author notes that unknown and provider failure results both should avoid automatic rejection, since they signal different problems that call for different handling.

0 comments Read more at DEV Community