Devin agent skills that patch the GitLab CVSS 10.0, PHP and Node.js RCEs
1 points, 0 comments on Hacker News
??????? #php
115 headlines
Unicorn Benefits of Rust/Go Tooling in PHP
1 points, 0 comments on Hacker News
BBC interview with Ondřej Surý, Debian/Ubuntu PHP package maintainer
1 points, 0 comments on Hacker News
An animated explainer of the PHP2SHell vulnerability [video]
1 points, 0 comments on Hacker News
PHP2Shell exploitation observed: packet-to-process RCE evidence
3 points, 0 comments on Hacker News
Two Accepts and One Reject: How Bricksforge CVE-2026-85097 Turned a Form Upload into a Webshell
Two Accepts and One Reject: How Bricksforge CVE-2026-85097 Turned a Form Upload into a Webshell A CVSS 10. 0 unauthenticated file upload leading to remote code execution invites a simple reading: an attacker uploads a PHP file and the site executes it. CVE-2026-85097 in the Bricksforge WordPress...
PHP Foundation 'under-funded' with one full-time staff member, director says
72 points, 24 comments on Hacker News
There's a third PHP2Shell bug, but it won't get an emergency fix
2 points, 0 comments on Hacker News
I Replaced 50 PHP Workers with One Go Process
2 points, 0 comments on Hacker News
Politico reconstructs the global scramble after the PHP2Shell leak
2 points, 0 comments on Hacker News
PHP-ocalypse: How two critical web bugs almost broke the internet
Two critical bugs in the PHP web programming language, used by the majority of the internet, threatened to upend the internet — and it's unlikely to be the last major software scare.
PHP2Shell, Node.js, GitLab & LiteLLM Vulnerabilities: October 2026 Patch Guide
Four of the most-used stacks on the internet got hit in the same week . PHP, Node. js, GitLab and LiteLLM all shipped critical fixes or suffered a serious incident between Oct 12 and Oct 22, 2026 .
The PHP Meltdown Shows How AI Makes Bugs More Exploitable
Security researchers used AI tools to help uncover years-old vulnerabilities in the PHP web scripting language. Then the AI-assisted attacks began.
AI found the flaw. Hackers found the leak: The race to save 'PHP2SHELL'
AI discovered a vulnerability in part of the internet's architecture, called PHP2SHELL. Security researchers rushed to fix it, but news of the vulnerability leaked and hackers have swooped in.
I woke up to panicked text messages about the PHP attacks. As a cybersecurity expert, here are the 3 things I tell people to do right away.
A cybersecurity product manager explains why two PHP flaws sparked mass panic — and shares 3 steps website owners can take to protect their sites.
PHP advisory: disable session upload progress to prevent another unlikely RCE
Informational advisory: Session upload progress We suggest you set session. upload_progress. enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector.
PHP bug "about as bad as it can get," cybersecurity reporter says
A bug in the PHP programming language could put up to 70% of the world's websites at risk, experts say. Reuters cybersecurity reporter Raphael Satter explains more about this critical vulnerability.
AI's 'Black October': Critical PHP flaws set off global security scramble
Governments and businesses around the globe are scrambling to contain the fallout after the PHP vulnerabilities leaked online.
PHP 8.2.12 Is Vulnerable: How I Patched PHP2Shell RCE by Upgrading to PHP 8.2.35
I Found My XAMPP PHP Was Vulnerable — Here's How I Patched It On October 21, 2026, the PHP project released an urgent security update for two critical vulnerabilities that can potentially allow unauthenticated remote code execution (RCE) on vulnerable PHP installations. The affected PHP branches...
Inside CVE-2026-109618: how PHP's out-of-memory path became a remote code execution bug
Inside CVE-2026-109618: how PHP's out-of-memory path became a remote code execution bug PHP's memory limit is meant to protect a server from a runaway script. On 21 October 2026 the PHP project shipped fixes for a flaw that turns that safety mechanism into an attack primitive. CVE-2026-109618 i...
This Week in Security: Record Patch Tuesday, PHP’s Bad Time, The Oldest Vuln, AI Armies, and More
It’s no longer a proper month without Microsoft breaking its own record for security fixes, and October’s Patch Tuesday was no exception.
The system mostly worked: notes on the PHP and eMudhra disclosures
1 points, 0 comments on Hacker News
Cloudflare sees millions of attempts to exploit critical PHP flaws
Cloudflare has recorded millions of attempts to exploit two critical PHP vulnerabilities since details became public on Wednesday, according to CEO Matthew Prince. The flaws affect PHP, a programming language used to power much of the web. Some stats on #php2shell.
Php2shell Scanner
2 points, 0 comments on Hacker News