PHP2Shell: Two Critical PHP Flaws Patched, But Running Servers May Still Be Exposed

·2 views

The PHP project released fixes on October 21, 2026, for two remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both scored 9.2 on CVSS v4.0. Details reportedly leaked a day earlier, and Amazon's honeypots reportedly recorded exploit attempts as early as October 17. The flaws affect the PHP runtime itself, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, so Composer updates will not resolve them. PHP 8.1 and older have no official release, leaving teams on those branches to upgrade or rely on source backports. Security experts stress that organizations must confirm the patched version is actually running in production, not just available.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Back Up Cyber Insurance Questionnaire Answers With Verifiable Evidence

A security consultant argues that cyber insurance questionnaire answers such as MFA coverage and EDR deployment should be backed by documented evidence rather than assumptions. The piece cites a 2022 case in which an insurer and a manufacturer agreed to rescind a policy after the insurer said MFA protected only the firewall, showing how unsupported answers can void coverage. It recommends using command-line exports and audits to find accounts lacking MFA, comparing EDR agents against asset inventories, checking email authentication records like DMARC, and keeping dated backup restore logs. The author suggests organizing evidence into dated folders starting about 90 days before policy renewal, and advises consulting a broker and coverage lawyer about rescission rules in one's state.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why DMARC fails even when SPF and DKIM pass: the role of domain alignment

A common situation after moving a DMARC policy beyond p=none is a message where SPF and DKIM both pass yet DMARC still fails. DMARC requires that at least one of these checks passes for the same domain shown in the visible From: header, a requirement known as alignment. Relaxed alignment, the default, accepts subdomains that share the organisational domain, while strict mode demands an exact match. Third-party services such as invoicing tools, CRMs and newsletter platforms often sign with their own domains, which causes this failure, and enabling custom domain authentication with the vendor usually resolves it. Forwarding and DKIM selector or key rotation problems can also break alignment, so administrators should review DMARC aggregate reports regularly and ramp enforcement gradually.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Four Tests to Run Before Taking a Polymarket Trading Bot Live

A profitable backtest does not guarantee a trading bot will perform well in live markets, since flawed assumptions can inflate simulated results. The article recommends checking four areas, starting with whether the strategy relies only on information that was actually available at decision time, to avoid look-ahead bias. It also warns that historical prices may not reflect executable fills, so entry prices and order liquidity should be tested for sensitivity. Results should remain positive after accounting for fees and other trading costs, especially for strategies built on frequent small gains. Finally, the author advises validating the strategy on out-of-sample data kept separate from development to reduce the risk of overfitting.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Calculate Average Order Value from Shopify Orders via the Admin GraphQL API

A developer explains how to compute average order value (AOV) from Shopify data by pulling orders through the Admin GraphQL API and calculating it in Node.js. The approach requires a custom app with an access token and the read_orders scope, which by default covers only the last 60 days of orders. The guide filters out test and cancelled orders and uses current price fields so refunds are already reflected in the totals. It reports two figures, one including shipping and taxes and one based on product subtotals alone. The post notes that the author works on a Shopify cart app, which is mentioned only at the end.

0 comments Read more at DEV Community