PHP released emergency updates for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two related critical remote-code-execution flaws: CVE-2026-109618 is an out-of-memory corruption where hitting memory_limit at a precise moment can leave partially initialized internal structures that later corrupt memory, enabling RCE on Apache/mod_php and via application paths on PHP-FPM; CVE-2026-109619 is a stale-state error where a fatal error can leave internal pointers referring to memory from a previous request, producing use-after-free, crashes and demonstrated RCE on Apache/mod_php. Both bugs sit in core memory management and error-handling code touched by nearly every request, making fixes difficult without compatibility, performance, or ecosystem impacts. Users are urged to update immediately.
An external audit program and expanded security investments exposed the full impact: Quarkslab’s 2024 audit and subsequent findings by Calif, OpenAI, Wiz and others in 2026 made the OOM root cause clear and pushed the issue to top priority. Fix development stalled earlier due to hard trade-offs and limited expert capacity; the PHP Foundation has since reorganized security workflows, created an Ecosystem Security Team, hired specialists, adopted AI-assisted tooling and coordinated multiple audits. Disclosure was disrupted by leaked CVE identifiers, a mistakenly published proof video and an early embargo break by a distributor, accelerating PoC circulation. The Foundation calls on companies, hosting providers and governments to sponsor sustained core security work.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A PHP vulnerability currently has no working exploit, despite many fake PoCs circulating online. LLMs have falsely been portrayed as able to develop exploits, but practical testing shows no effective attack exists yet. (eliastaylor.com)
The Trump administration denaturalized two individuals who obtained U.S. citizenship by hiding their criminal activities. The move aims to revoke citizenship from those who gained it through fraudulent means. (justice.gov)
Meta's new enterprise terms state that if its AI makes a mistake, the customer is legally responsible. The terms also expand liability to content from partners and give Meta rights to scrape and use user content. (cio.com)
A vulnerability in HTTP/3 implementations allows remote clients to cause servers to allocate excessive memory by exploiting QPACK header compression. Seven of ten tested implementations are vulnerable, with some already patched to prevent resource exhaustion. (foxio.io)
Oracle has issued a security alert for CVE-2026-91403, affecting multiple Java and GraalVM products. Patches are available for supported versions, and Oracle recommends upgrading to ensure security. (oracle.com)
Help desks are increasingly targeted by social engineering attacks to reset MFA accounts. Effective verification methods for remote staff and contractors are being explored to prevent breaches. (news.ycombinator.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.