#2026

An open format for writing agent-native software requirements https://lobste.rs/s/nexvnc #building-ai-tooling #practices #release https://slcr.dev/announcements#2026-10-29-slcr-launches

Update your PHP (if you can), folks. That is, install PHP 8.5.12 to fix critical vulnerabilities CVE-2026-109618 and CVE-2026-109619. https://www.php.net/archive/2026.php#2026-10-21-5 Until updates are available on your platform, I hear that setting in php.ini memory_limit=-1 session.upload_progress.enabled=0 fatal_error_backtraces=0 can mitigate some attacks. Also: Set a low post_max_size. For applications that don't require file uploads, set post_max_size = 8M. If file uploads are necessary, set post_max_size = 32M. Keep upload_max_filesize below post_max_size. Consider enforcing limits at the web server or proxy level for decoded request size, input field count, multipart part count, header count, and nesting depth. These limits must also cover requests without a usable Content-Length. More info from: Wiz Calif OpenAI Fastly claims to see evidence of exploitation ITW

Partial Order Precedence via @liberty@mathstodon.xyz https://lobste.rs/s/kiivg2 #zig https://ziglang.org/devlog/2026/#2026-10-24

Security release: Loops 1.0.0-beta.15 is out Security fixes · New features · Bug fixes Security and Notes: Our primary docker image was updated to 5.0.2 - github.com/serversideup/docker-php/releases/tag/v5.0.2 (this includes the PHP security patching for 2 CVEs). Details here: php.net/archive/2026.php#2026-10-21-5; ; Rebuilt release images… 23 of 22 Loops servers already run it. Release notes: github.com/joinloops/loops-server/releases/tag/v1.0.0-beta.15 fedidb.com/software/loops/versions

Set session.upload_progress.enabled=0 until the next PHP release to block an unlikely RCE vector (CVE-2026-115560).

We already recommended this for CVE-2026-109619 from Wednesday: keep it disabled.

Only applications with non-default serialize_handler switching it to php at runtime can be affected.

There is more information in the advisory on the PHP website by the PHP security team: https://www.php.net/archive/2026.php#2026-10-23-1

#php

PHP updates and mitigations are out:

@Alice@beige.party It's currently down for updates 😉

The PHP vuln advisory is a textbook example of how to do it right. Huge props to them!

https://www.php.net/archive/2026.php#2026-10-21-5

Specifically, it details:

• what went wrong

• what is and isn't known about who is affected (e.g. for the OOM one, Apache mod_php definitely is, FPM may be but isn't known)

• what mitigations are available if patching/updating is not possible, and whether they are partial or full

• sufficient information to roll your own further mitigations if needed (e.g. I think you could setup policies to terminate the process on OOM rather than letting it continue to the vulnerable OOM handler)

📣 Announcing the immediate availability of:

• PHP 8.2.35
• PHP 8.3.36
• PHP 8.4.27
• PHP 8.5.12

‼️ These address the following critical security issues:

• Remote Code Execution via Out of Memory corruption (CVE-2026-109618)
• Remote Code Execution via Stale Global State (CVE-2026-109619)

📝 https://www.php.net/ChangeLog-8.php 🎁 https://www.php.net/downloads?source=Y Windows: https://www.php.net/downloads.php?os=windows

Read more: https://www.php.net/archive/2026.php#2026-10-21-5

#PHP #Release #Security #CVE

Hugs and headpats to all the #PHP release managers today! Upgrade your PHP at 14:00 UTC today!

⚠️ We have been informed by CERT of an issue affecting PHP: https://cert.europa.eu/publications/security-advisories/2026-018 https://www.php.net/archive/2026.php#2026-10-20-1 This would affect all online PHP servers and operations including Nextcloud as well as WordPress and other popular services. The CERT recommendation is to turn off servers running PHP based applications until updates to PHP are available and can be applied. We will release an update as soon as more information is known about affected PHP versions and availability of updates.

@stux@mstdn.social Everyone's preparing to upgrade their PHP, right?

🚨 Gram.social & Pixey.org are offline for now We'll be waiting for patches and updating first before relaunching! https://www.php.net/index.php#2026-10-20-1#PHP

⚠️ #SW_ISAC_ADVISORY Service providers operating PHP-based platforms please take note of a PHP advisory addressing two critical vulnerabilities, both rated CVSS v4.0 9.2 A patch is scheduled for Wednesday, 21 October 2026 at 14:00 UTC https://www.php.net/archive/2026.php#2026-10-20-1 #WordPress #Pixelfed #Hubzilla #Friendica #Castopod #Drupal

Upcoming Critical PHP Security Release via @lobsters@mastodon.social https://lobste.rs/s/ekxoyt #php #security https://www.php.net/archive/2026.php#2026-10-20-1

PHP is releasing an update tomorrow to fix two major vulnerabilities. Admins are advised to update ASAP.

PHP releasing patches tomorrow for CVE-2026-109618 and CVE-2026-109619 Fixed versions will be 8.5.12, 8.4.27, 8.3.36, 8.2.35 All others are end-of-life but are still vulnerable - the vulns date back to versions from 2004 onwards.

<<前日： https://mastodon.social/@thessan/117027916149529936 . /* -------------------------------------------------------- 　　ロシアによるウクライナ侵攻 　日本時間：#2026年08月05日更新 [読み込みに少し時間がかかります] -------------------------------------------------------- */ - - 翌日>>： https://mastodon.social/@thessan/117039737320616123

📰 Bolsonaro e Aparecida: quando a trollagem volta para casa https://operamundi.uol.com.br/opiniao/bolsonaro-e-aparecida-quando-a-trollagem-volta-para-casa/ #Aparecida #Eleições #eleicao #Opinião #News #nossasenhora #Bolsonaro #2026

Qui e ora #28settembre #autunno #2026 #mondaymotivation @foto