A critical PHP security release is scheduled for Wednesday, 21 October 2026 at 14:00 UTC to address two vulnerabilities, each rated CVSS v4.0 9.2. Users are urged to prepare now so they can upgrade as soon as the fixes are published; full details, affected versions, and the corrected releases will be disclosed at release time. The team reserves the right to publish sooner if exploit details are leaked or active attacks are detected, emphasizing the urgency for maintainers to monitor updates and plan immediate patching.
Recent development activity shows an active 8.6 release cycle with multiple test builds (Alpha, Beta, RC2, RC3) available for testing and a clear warning not to use pre-release builds in production. Several maintenance and security updates were rolled out in late September and July - including 8.4.26, 8.2.34, 8.5.11 and 8.3.35 - and routine bug-fix releases for other 8.5 and 8.4 branches. Testers are asked to report issues on GitHub, and community engagement items such as the State of PHP 2026 survey are open to gather user feedback for future development.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A PHP vulnerability currently has no working exploit, despite many fake PoCs circulating online. LLMs have falsely been portrayed as able to develop exploits, but practical testing shows no effective attack exists yet. (eliastaylor.com)
The Trump administration denaturalized two individuals who obtained U.S. citizenship by hiding their criminal activities. The move aims to revoke citizenship from those who gained it through fraudulent means. (justice.gov)
Meta's new enterprise terms state that if its AI makes a mistake, the customer is legally responsible. The terms also expand liability to content from partners and give Meta rights to scrape and use user content. (cio.com)
A vulnerability in HTTP/3 implementations allows remote clients to cause servers to allocate excessive memory by exploiting QPACK header compression. Seven of ten tested implementations are vulnerable, with some already patched to prevent resource exhaustion. (foxio.io)
Oracle has issued a security alert for CVE-2026-91403, affecting multiple Java and GraalVM products. Patches are available for supported versions, and Oracle recommends upgrading to ensure security. (oracle.com)
Help desks are increasingly targeted by social engineering attacks to reset MFA accounts. Effective verification methods for remote staff and contractors are being explored to prevent breaches. (news.ycombinator.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.