On 20 October 2026 the PHP project announced an emergency security release to address two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Both are scored 9.2 under CVSS and are reported to allow unauthenticated remote code execution. The flaws are said to affect all supported PHP versions from PHP 5 onward. No technical details or exploit code have been published publicly so far, although several leaked posts flagged the issues ahead of the fix. The PHP team scheduled the security update for 21 October 2026 at 14:00 UTC.
CERT-EU warns organisations to treat these fixes as high priority: identify PHP-based applications now and be ready to apply patches immediately when the fixed versions are released. If immediate patching is impossible, CERT-EU directs isolating internet-facing applications from public networks until the update can be applied. The advisory lists the CVE identifiers, the CVSS severity, affected product range and the recommended mitigations, and provides official download and contact details for follow-up.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A PHP vulnerability currently has no working exploit, despite many fake PoCs circulating online. LLMs have falsely been portrayed as able to develop exploits, but practical testing shows no effective attack exists yet. (eliastaylor.com)
The Trump administration denaturalized two individuals who obtained U.S. citizenship by hiding their criminal activities. The move aims to revoke citizenship from those who gained it through fraudulent means. (justice.gov)
Meta's new enterprise terms state that if its AI makes a mistake, the customer is legally responsible. The terms also expand liability to content from partners and give Meta rights to scrape and use user content. (cio.com)
A vulnerability in HTTP/3 implementations allows remote clients to cause servers to allocate excessive memory by exploiting QPACK header compression. Seven of ten tested implementations are vulnerable, with some already patched to prevent resource exhaustion. (foxio.io)
Oracle has issued a security alert for CVE-2026-91403, affecting multiple Java and GraalVM products. Patches are available for supported versions, and Oracle recommends upgrading to ensure security. (oracle.com)
Help desks are increasingly targeted by social engineering attacks to reset MFA accounts. Effective verification methods for remote staff and contractors are being explored to prevent breaches. (news.ycombinator.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.