PHP2Shell flaws put PHP runtimes at risk; CISA adds both CVEs to KEV catalog

·1 views

Two critical PHP interpreter vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can enable unauthenticated remote code execution under certain conditions. The PHP project released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026. CISA added both flaws to its Known Exploited Vulnerabilities catalog on October 26, 2026, signaling active exploitation. Separately, a session upload progress issue, CVE-2026-115560, was disclosed October 23 and is not fixed by the October 21 updates, with a configuration workaround advised. Experts urge organizations to inventory the PHP runtimes actually serving requests and restart workers after patching.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

New free tool combines multiple buy-now-pay-later plans into one view

A developer has built BNPL Stack Untangler, a free web tool that lets users combine their buy-now-pay-later plans into a single overview. Users enter each plan's provider, item, installment amount, remaining payments and due dates. The tool displays total amounts owed across all plans, upcoming payments by week and month, and a shared calendar of installments. It also highlights weeks when several payments fall due together and shows which plans carry late-fee risk. The creator designed it to work with any provider rather than connecting to individual company APIs, and it requires no account to use.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Are AI Assistants Challenging Google's Dominance in Search?

Google still dominates the search market with roughly 91% of global share, according to Statcounter data from October 2026. Yet many people are now turning to AI tools like ChatGPT, Perplexity, and Gemini for conversational, consolidated answers rather than clicking through multiple links. A Gartner survey reported that 51% of consumers had changed their research habits because of generative AI, often using more specific, conversational queries. The article argues that the shift reflects changing expectations around convenience, follow-up interaction, and personalization rather than simply a new platform choice. It also notes that market share measures only traditional search, not the broader ways people now discover information through social media and AI assistants.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How paid membership tiers model access: plans, products, and what they unlock

A builder of the TribeCrafter community platform describes how paid access works there, starting from what each tier unlocks rather than what it costs. Free, Monthly, and VIP plans are shown granting differing access to feeds, private groups, premium posts, and courses, so content can be moved between tiers without changing the content itself. Communities can sell recurring plans, one-time products granting lifetime or fixed-period access, or both, and access is removed automatically when a membership ends. Payments go directly to each creator's own Stripe account via Stripe Connect, with the platform taking no fees beyond Stripe's processing charge. Each community also runs on isolated infrastructure, including its own database, cache, search index, and storage, so member data is never shared across communities.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Wired Profiles the Partners of AI Enthusiasts Feeling Left Behind

Wired has published a feature titled "Meet the Sad Wives of AI," focusing on the spouses of people deeply involved with artificial intelligence. The piece appears to explore the emotional strain and sense of neglect some partners describe as their loved ones devote time and attention to AI tools. The article is linked from Hacker News, where it has drawn a small amount of attention so far. The supplied material includes only the link and metadata, so the specific people, experiences, and conclusions described in the piece cannot be confirmed here.

0 comments Read more at Hacker News