PHP2Shell: Two Critical PHP Flaws Enable Unauthenticated Code Execution, Patched October 21

·4 views

PHP released fixes on 21 October 2026 for two critical vulnerabilities that could allow remote code execution without authentication. One stems from an out-of-memory failure that can interrupt initialization and leave invalid internal request data to be trusted during cleanup, while the other involves request-owned state outliving its memory so a later request can reuse stale data. Affected setups include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php flagged as the highest risk. Discovery, reporting and public disclosure occurred on separate dates, and the underlying bugs were traced to a 2024 audit finding and later research using AI-assisted searches. The article stresses that an affected runtime does not by itself prove a compromise, and recommends identifying the PHP runtime serving web requests and applying the patch.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Load tests show t3code's AI streaming holds below 50 users but degrades past 100

A developer benchmarked pingdotgg/t3code's streaming AI completion setup using k6 on an AWS t3.xlarge instance, ramping from 10 to 100 concurrent users over five minutes. Measured metrics included time-to-first-token, token throughput, SSE connection drop rate, and Next.js server memory use. Performance stayed stable under 30 users, with drops at about 2% near 50 to 80 users, mostly from client-side abort races. At 100 users, p95 time-to-first-token exceeded one second, connection drops reached 8.4%, and memory passed 1GB due to SSE connection bookkeeping overhead. The author recommends deploying as-is below 50 users and adding a Redis-backed pub/sub layer for larger teams.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Linux NAPI Shutdown Wait Analysis for Dedicated Threads Under PREEMPT_RT

The author examines whether the shutdown synchronization used for ordinary softirq NAPI polling still holds when NAPI runs in a dedicated thread in Linux 7.3. On non-RT kernels the BH-disabled poll region is covered by RCU, while under PREEMPT_RT the __local_bh_disable_ip() implementation calls rcu_read_lock() on outermost entry from a preemptible context. For RT receive processing via ksoftirqd, the enclosing ksoftirqd_run_begin() and ksoftirqd_run_end() provide the corresponding protection, though this does not cover every entry path such as userspace-driven busy polling. The author notes the NAPI guide does not specify how interrupt unmasking should synchronize with shutdown, leaving a gap for driver authors. The piece concludes by turning to Intel's igb driver, where a flag check against interrupts being re-enabled during shutdown raises a possible race.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Connect a Real-Time Currency API to an AI Agent via MCP

AI agents such as Claude and ChatGPT often lack access to live data, so their answers about exchange rates can be fabricated or outdated. The article presents a method for linking a real-time currency exchange API to an AI agent using the Model Context Protocol, a standard that lets agents call external tools when needed. The author has published an MCP server for this API, which can be added to Claude Desktop through a short configuration change. Once configured, Claude can query the server for current rates, such as USD to UAH, and return accurate figures. The project's code is open-source and available on GitHub.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Instancing Cuts Draw Calls for 1,000 Plants in Three.js, WebGPU Shows No FPS Lead

A test run by an AI tool compared Three.js rendering of 1,000 procedural grape hyacinth plants across classic WebGL, WebGPU, and WebGPU with a WebGL fallback, using Three.js 0.186.1 on Chromium 155 with an RTX 5070 Ti. Instancing reduced draw submissions on every backend tested. All nine rendering paths ran close to the display's 60 Hz ceiling, so the API choice made little difference to frame rate. Researchers found the more meaningful factor was how geometry was submitted and the work done inside the render call. An earlier run was discarded after a shader mismatch between the classic and node renderers was found and corrected. The results come from a single workstation under background load and do not certify long-duration frame pacing or performance on physical phones.

0 comments Read more at DEV Community