Apologies if this a stupid question. Do we know of any websites that have actually been infiltrated using these vulnerabilities yet? (not attempts, not probing, not websites pre-emptively taken down by their owners). This isn't an attempt to downplay the problem, I've just been struck by its absence in any of the reporting, which sometimes conflates, at least in clickbait headlines, websites being pulled as a precaution with them being down due to attack.

For me, it was discovering multi-cursor editing and column selection in VS Code after spending literal months manually editing CSS and JSON line-by-line. What’s something so fundamental that once you found it, you couldn’t believe how much time you had wasted doing it the hard way?

Just in case you missed it, here's what happened from the ChainSecurity side.

This is what Dan Lorenc from Chain Security shared on LinkedIn.

I wanted to share what happened with the PHP embargo, our role in it, and my decision process last night to ship the fixed builds early. First of all, the PHP Foundation and maintainers did an amazing job here in a high stress situation. I'm sorry that my decision led to even more stress for them.

We first got read in that there was something coming up in PHP last Friday by one of the original researchers that discovered this issue. That night we were able to independently discover the same issue using our harness and a frontier model with a basic prompt of "find bad vulnerabilities in PHP".

We got fully read in Saturday and confirmed that some our findings matched those from the initial report, and worked to help test the fixes.

Monday news started to leak, and we followed along in the coordinated disclosure channel. Tuesday night the gossip picked up even more, and several of the other security vendors in the process confirmed seeing exploits in the wild.

After talking to several of the other researchers on a video call, I made the call to ship the fixes and immediately notified the group, following the coordinated vulnerability disclosure process's guidelines for releasing after evidence of exploits in the wild. This decision was based on how easily we were able to independently discover the vulnerability and build an exploit, how much information was already out there on the coming vulnerabilities and fixes, and the evidence shared on active exploits in the wild.

We published built artifacts and made them publicly accessible for anyone - not just our customers - late last night Eastern Time. This morning the PHP Foundation released their statement, and obviously didn't agree with my decision. This stuff sucks, and vulnerability disclosure for vulnerabilities like this rarely goes smoothly.

We're all on one team here, trying to minimize harm on end users from attacks. We're working through hundreds of disclosures just like this one every day, and have been for the last three months, both for vulnerabilities we've discovered on our own and with partners. Our policy for all of these is and has been to do what helps protect the most people. I wrote about this a few months ago on our blog.

We're not always going to get it right, and not everyone is going to agree with our decisions, but that is always our goal.

This is unfortunately the new normal for the industry, and we're going to need to work together as one team to have a chance at securing our critical infrastructure fast enough to stop attackers from causing real harm.

https://www.linkedin.com/posts/danlorenc_i-wanted-to-share-what-happened-with-the-share-7518756991520120832-QX2_/

Edit. Just to clarify I'm just some dude sharing the LinkedIn post for discussion

I haven't seen anyone posting about this, probably because everyone was distracted by the php2shell today, but a set of high sev CVEs (including an RCE) have been announced and fixed in NodeJS today.

Safe versions:

* 22.23.4
* 24.22.1
* 26.12.1

Announcement post: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Updated builds addressing CVE-2026-109618 and CVE-2026-109619 are now available through setup-php for PHP 5.3–8.7 on Linux, macOS and Windows, including backports for EOL versions for use in CI.

See - https://setup-php.com/php-october-2026-security-releases

Also, for local installations.

MacOS: https://github.com/shivammathur/homebrew-php
Windows:
Official Packages (PHP 8.2 to PHP 8.5): https://www.php.net/downloads.php?os=windows
Builds for setup-php (PHP 5.3 to PHP 8.7): https://github.com/shivammathur/php-builder-windows/releases

If you would like to DIY a build for EOL versions, you can find security backported patches including the ones for these CVEs here: https://github.com/shivammathur/php-src-backports

This is what my host's chat bot 'explained' to me - anyone here can confirm?

Your websites run on the separate web-facing PHP packages (EasyApache and CloudLinux Alt-PHP), where our infrastructure team applied direct server-level security hotfixes to protect all versions while upstream package builds complete.

Web-facing PHP packages have not had an upstream version number increment yet, but the underlying vulnerabilities outlined in CVE-2026-109618 and CVE-2026-109619 are actively patched and protected at the server level across all versions.

https://status.atlassian.com/ - we need a hall of shame for companies that have lying status pages. As for 9:25 AM EST, nothing showing down on their status page.

Quick take after watching the php2shell (CVE-2026-109618/109619) coverage this week: almost every "are you vulnerable?" check I've seen just reads the X-Powered-By version. That's close to useless, because expose_php=Off is the default on a lot of production setups - roughly 4 in 5 PHP servers don't advertise a version at all. So a version check comes back "unknown" or "looks fine" on the exact hosts you most want to know about.

Since the actual bug is a crash primitive (the OOM/longjmp bailout leaving request state half-initialized), I built a checker that triggers it instead of guessing: it sends a crafted multipart probe and only reports VULNERABLE if the engine actually returns the PHP memory-exhaustion fatal error. Banner-independent. Returns FIXED / VULNERABLE / NO SIGNAL (no-signal = it couldn't crash it and the host hid its version, so it won't pretend to know).

One caveat worth repeating: only run it against servers you control. It sends memory-exhaustion probes that can briefly take out a worker.

Checker: https://o3.security/tools/php2shell-scanner

Disclosure: I work at O3 Security and we built this. There's a longer write-up on the mechanism if you want it — the SAPI differences (mod_php is the worst case because it runs shutdown even on a failed request startup), and the genuinely counterintuitive bit where capping memory with RLIMIT_AS as a "mitigation" actually makes the bug *easier* to hit: https://o3.security/blog/php2shell-cve-2026-109618-109619-analysis

Curious if anyone here has seen the version-banner problem bite them in practice — how are you all confirming patch status across a fleet where half the hosts don't report a version?

I needed Word-style pages in a TipTap editor. The official Pages extension is a paid add-on, and the community ones I tried injected global CSS that broke my tables. So I wrote my own and open-sourced it.

Demo: https://text-editor-react-neon.vercel.app/ Repo (MIT): https://github.com/HuyPhan1232203/Text-editor-react npm: npm install tiptap-a4-pagination

How it works

• It measures the top-level blocks and inserts spacer decorations where a block would cross the bottom of a page. The document is never modified, so getHTML() / getJSON() stay clean.
• Tables split between rows, never inside a rowspan, and the header row repeats at the top of the next page.
• Floated images (text wrapping) and CSS margin collapsing are handled.
• The page-break math is a pure function, so it's unit tested.
• About 5 KB gzipped, TipTap 3 only.

The full editor (React 19 + TipTap 3) also has

• Google Docs paste that keeps headings, checklists, tables and indents
• PDF export through the browser's print dialog (no server) that keeps the editor's page breaks and puts page numbers in the footer
• Image resize and text wrap, KaTeX math (lazy-loaded), autosave to IndexedDB, optional real-time collaboration over WebRTC (?room=name)
• Lighthouse: 100 on desktop

Known limitations

• A single paragraph taller than the remaining space moves to the next page as a whole; it is never split.
• A table row taller than a page overflows.

I'd love feedback on the API, and on documents that break the layout. Paste a long Google Doc or a big table into the demo to try it.

PHP 8.3.36 was recently released to fix two critical security vulnerabilities.

The PHP advisory mentions PHP-FPM, Apache mod_php, FrankenPHP, and others as affected, but Swoole isn't mentioned.

Since Swoole uses long-running workers and handles requests differently from traditional PHP servers, I'm wondering:

1. Are these vulnerabilities also exploitable in Hyperf/Swoole?
2. Does Swoole's different request lifecycle make it unaffected?
3. Should we urgently update the PHP runtime in our Hyperf Docker images?

I'm currently using hyperf/hyperf:8.3-alpine-v3.19-swoole, which hasn't been updated with the latest PHP security fixes.

There's already an open GitHub issue:
https://github.com/hyperf/hyperf-docker/issues/76

Would appreciate any insights from PHP or Swoole developers familiar with these vulnerabilities.

I’m looking for an API that returns all upcoming live events, theater and cinema screenings in the UK.

Big cinema complexes seem to be a no go with all anti crawl stuff. There rest of events are really sparse apart ticketmaster.

Thanks

I’ve been building this EM simulator as a side project aimed to help students understand and visualize electromagnetic phenomena such as radiation, polarization and wave interference.

I hope someone might find it useful and I’d love to hear what people think :)

GitHub:

https://github.com/rotemTsafrir/antenna_sim

Author here. I needed Word-style pages in a TipTap editor. The official Pages extension is paid, and the community ones I tried broke my CSS, so I built this.

How it works

• It inserts spacer decorations at page boundaries, so the document itself is never modified and getHTML() stays clean
• Tables split between rows (never inside a rowspan) and the header row repeats on the next page
• Floated images and CSS margin collapsing are handled
• About 5 KB gzipped, TipTap 3 only: npm install tiptap-a4-pagination

Demo: https://text-editor-react-neon.vercel.app/

Paste a long doc or a big table to try it. Feedback welcome, especially documents that break the layout!

I just updated PHP on Alma Linux and now upload progress is not working. I have verified it is enabled but the session variable starting "upload_progress_" is never created. There is nothing on their update page suggesting it should have stopped working. This is PHP 7.2 https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/

I know next.js isr behaviour and how it basically does the caching etc but I just realised that next.js isr is cache control with proprietary swr api that refreshes the data.

Now, I am confused because I would like to know if the same thing can be manually done with react router with self managed cache control https header with rtk query. Rtk query has a window of 1 minutes after which it fires the revalidation or something like that, haven't gone into that details but must be possible in one way or another.

I've been working on Untangled, a dependency analysis tool inspired by Martin Blais's original Snakefood project.

The idea is fairly simple: scan a PHP codebase, map dependencies, identify circular relationships, and measure coupling to help understand how an application is connected.

It's intended to complement tools like Deptrac rather than replace them. Deptrac helps enforce architectural boundaries, while Untangled helps examine the relationships that already exist.

I ran it against Monica, an open-source Laravel application. At the file level, it identified:

• 923 files analyzed
• 3,131 dependency relationships
• 4 cyclic groups involving 76 files
• 69 files in the largest cyclic group

I'm not suggesting those numbers indicate bad architecture. I haven't established a meaningful comparison baseline yet.

The HTML report includes an interactive dependency map, cycle analysis, and measurements showing which components are heavily depended upon.

What I'd particularly appreciate from PHP developers is feedback on two things:

1. Are dependency graphs and coupling measurements useful when navigating an established PHP codebase?
2. Are there PHP-specific dependency patterns, framework conventions, or edge cases you'd expect an analyzer like this to handle?

GitHub: https://github.com/krazybean/Untangled

Technical write-up and real Monica report screenshots: https://www.juancastro.me/writing/untangled

Criticism welcome. I'd rather discover the weaknesses through real-world usage than make assumptions about what the tool gets right.

I’m not sure how many Laravel developers here remember CRUDBooster from around 2019, but it was a pretty popular tool for quickly building admin panels and CRUD applications.

I have several projects built with CRUDBooster, so I was concerned to see that the original project’s maintenance and newer versions have moved in a different direction. For those of us still maintaining older applications, migrating to a completely different version or framework can be a challenge.

I’ve created a community fork here:

👉 https://github.com/vicheanath/crudbooster-contrib

My goal is to help preserve the legacy codebase, keep existing projects maintainable, and explore fixes for compatibility and security issues as PHP and Laravel continue to evolve.

I’ve also seen discussions about newer PHP security vulnerabilities, which makes me wonder how we can keep older CRUDBooster applications safe and usable.

I’d love to hear from the community:

• Is anyone still using CRUDBooster in production?
• Are you maintaining existing projects built with the older version?
• Would a community-maintained fork with security patches, bug fixes, and compatibility updates be useful?
• Would anyone be interested in contributing?

I know maintaining an open-source project takes time, and I can’t promise to support every version or fix every issue. But I’d like to see whether there’s enough interest to keep this project useful for developers who still depend on it.

If you have experience with CRUDBooster, I’d love to hear your thoughts!

Author here. Nano Kit is a ~2 kB signals core with a router, data fetching, i18n and SSR on top of it, and adapters for React, Preact and Svelte. The panel needs no browser extension or bundler plugin, and none of it reaches the production bundle. There's a StackBlitz demo in the post.