A GitHub issue opened on Oct 21, 2026 pushes Amazon Linux 2023 maintainers to deliver an urgent PHP update that fixes two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated CVSS v4.0 9.2. The reporter requests fast updates for PHP branches 8.2-8.5 after PHP released fixes the same day. The thread documents widespread community alarm, repeated pleas for an ETA, and concerns that administrators need time-based guidance to decide on mitigations or workarounds for exposed web services.
Amazon Linux maintainers acknowledge the CVEs and say they are working on a release but cannot commit to a precise timeline; official support replies describe the reachable scenarios as narrow and difficult to exploit while promising to incorporate PHP’s fixes into AWS services like Elastic Beanstalk and Lightsail. Participants criticize a recent 4.13.12 release that delivered only partial, configuration-dependent mitigations as misleading and potentially dangerous, and many users express frustration with slow, non-specific responses from support. The conversation centers on the gap between public fixes and Amazon Linux package availability, the need for clear timelines, and the risk that incomplete updates could lead to real-world exploits.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Tech workers in San Francisco face increased risks of espionage, with foreign spies targeting AI companies and employees. Experts warn that romantic or friendly interactions could be attempts at gathering intelligence, making trust difficult in the industry. (sfstandard.com)
Japan's Onamae Desktop Cloud was hacked, impacting up to 27,000 servers. The breach highlights ongoing cybersecurity threats in cloud infrastructure. (bleepingcomputer.com)
Node.js released security updates for CVE-2026-111497, a high-severity flaw in its Brotli decoder that can cause memory leaks or arbitrary code execution. Vercel has deployed WAF rules and is updating managed runtimes; users outside Vercel should upgrade to the latest patched versions immediately. (vercel.com)
Mitmproxy has added a --emudhra option to enhance its functionality. The update involves changes across multiple files, including the changelog and core scripts. (github.com)
A PHP vulnerability currently has no working exploit, despite many fake PoCs circulating online. LLMs have falsely been portrayed as able to develop exploits, but practical testing shows no effective attack exists yet. (eliastaylor.com)
The Trump administration denaturalized two individuals who obtained U.S. citizenship by hiding their criminal activities. The move aims to revoke citizenship from those who gained it through fraudulent means. (justice.gov)
Today's best Hacker News stories, summarized and screenshotted, one email a day.