SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

PHP2Shell: two unauthenticated PHP RCE bugs disclosed, with attacks already underway

0
·1 views

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, both enabling remote code execution without authentication and rated CVSS 4.0 9.2. Exploitation is already occurring in the wild. Upstream PHP fixed the issue only in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, so other users depend on their Linux vendors' backported patches. Because distributions such as Ubuntu keep the old upstream version number while applying fixes, checking php -v is unreliable; administrators should inspect package release versions instead. Testing of edge mitigations on Rocky Linux with NGINX and PHP-FPM found that default request buffering and a limited client_max_body_size help block some attack paths, while per-request PHP_VALUE settings did not work as expected.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Developer localizes a Django app into seven languages, including RTL support

A solo developer translated a large Django application into English plus six other languages: Arabic, Chinese, Spanish, French, Russian, and Bengali. The write-up explains the motivation, which centers on making free project management learning content accessible to non-English speakers and expanding the site's indexable pages. The app's translations for the six non-English languages are AI-assisted drafts, and the app labels them as beta. The article describes handling interface strings with gettext while storing long-form lessons as per-language Markdown files with English fallback. It also covers technical hurdles such as right-to-left layout using CSS logical properties and the language-tag mismatch between zh-hans and zh.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Sloth Brief: a local model turns scattered notes into a short restart checklist

Sloth Brief is an open-source tool that condenses a set of accumulated text notes into a brief, source-linked action list. It runs the Qwen2.5-0.5B-Instruct model locally via Hugging Face Transformers, so no paid API or cloud upload of notes is needed. The model writes one concise summary per note, and Python assigns source numbers from the notes actually supplied, though the author warns that summaries still need checking against the originals. Input files are never edited, and the demo of two synthetic notes passes eight automated tests that cover limits and file handling but not model accuracy. The author notes that no productivity gains have been measured, and that the prototype was built with Codex assistance.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

EU launches AI Act Service Desk offering multilingual expert answers for businesses

The European Commission has opened the AI Act Service Desk and a companion Single Information Platform to help companies understand how the EU AI Act affects them. Businesses can submit questions to experts working with the EU AI Office in any official EU language, after signing in with EU Login. The Service Desk handles specific inquiries, while the Single Information Platform offers self-service tools such as a Compliance Checker and an AI Act Explorer. The platform is currently available in English, French and German, with the rest of the EU languages expected in early 2026. The Commission suggests that companies prepare focused questions tied to particular AI systems and their roles to get the most useful guidance.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Arista warns of exploited SQL injection flaw in VeloCloud Orchestrator, CVE-2026-114625

Arista has published advisory SA-0199 confirming that attackers are already exploiting CVE-2026-114625, a SQL injection flaw in the VeloCloud Orchestrator, the management system for VeloCloud SD-WAN edges, which carries a CVSS score of 9.9. The flaw lets a crafted request alter the SQL statement the application runs, so a low-privilege account such as Enterprise Read Only can perform actions reserved for the operator-level superuser role. Exploitation requires network access to the VCO web interface, which Arista says is exposed by default and cannot be disabled, plus a valid login. Arista has patched its hosted and dedicated orchestrators, and it lists fixed releases for the 5.2, 6.1 and 6.4 trains, noting that the 7.0 train and VeloCloud Gateway and Edge are not affected. Customers on unsupported releases have been directed to Arista's Technical Assistance Center, and the advisory does not say when exploitation began or what attackers did afterward.

0 comments Read more at DEV Community