Spotify confirmed on its Q3 earnings call that it is rolling out QR code verification for Family Plan members, requiring them to scan a code from the plan manager's phone to prove they live together. Members who miss the seven-day verification window lose access and must wait 12 months before joining another Family or Duo plan, or switch to an individually paid plan. Co-CEO Alex Norström described the change as a routine update to existing verification tools rather than a crackdown.
A modder known as pepsipu (Sammy Hajhamid) created a software-only, tethered jailbreak for the Nintendo Switch 2, dubbed 'ns2jb,' with help from OpenAI's Codex tool. The exploit relies on the game SmileBASIC 4 and must be re-run each time the console restarts; a demo shows a modified Mario Kart World with added characters like Cinnamoroll, Peter Griffin and Steve from Minecraft.
Security researchers discovered that Indian certificate authority eMudhra issued six TLS and two code-signing intermediate certificates whose private keys were weak enough to be guessed or recovered. An attacker exploiting this could impersonate trusted websites such as banks or tech firms, or sign malware to appear as legitimate software from companies like Microsoft or Google. The affected certificates now need to be revoked and removed from trust stores across operating systems and browsers.
Amazon Threat Intelligence reports that attackers began targeting the two critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) on October 17, four days before PHP released fixes on October 21. The PHP team had to move up its disclosure timeline after details including the CVE IDs and mitigation guidance leaked online two days early, and researchers say functional exploits appeared within hours of the patch release.
GitLab has released patches for CVE-2026-110264, a critical integer overflow vulnerability in its Regular Expression Compiler that could allow unauthenticated attackers to execute arbitrary code on vulnerable servers. The flaw, reported by researcher 'joaxcar' via HackerOne, has been fixed in CE and EE versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. GitLab.com and GitLab Dedicated tenants on patched internal builds are already protected, but self-managed installations must upgrade immediately.
Security firm Calif uncovered two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale, that allow unauthenticated remote code execution via memory corruption and stale global state issues. WatchTowr researchers confirmed they could reproduce both flaws after a proof-of-concept tool called PHP2Shell leaked ahead of a planned coordinated disclosure, and PHP's maintainers have released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
A new feature spotlights open source games sourced from small, lesser-known repositories rather than popular rankings. The selection aims to surface playable projects that might otherwise go unnoticed by mainstream audiences.
Linux kernel maintainers have decided to remove the requirement that patches created with help from large language models carry an 'Assisted-by' tag in the changelog. Instead, developers agreed that information about AI involvement in a patch should go into the cover letter rather than the permanent changelog record.
A newly described project called Rust off Rails presents itself as an opinionated Rust web stack built specifically for AI coding agents rather than human programmers. It replaces Rails-style 'convention over configuration' with what its creators call 'convention over deliberation,' using a scaffolding binary and Markdown-based recipes to generate code instead of relying on a programmer's judgment calls.
Researchers disclosed PHP2Shell, a set of memory-safety vulnerabilities in PHP's core, covering two CVEs related to out-of-memory corruption and stale global state persisting across requests. The flaws affect any site running vulnerable PHP versions, even simple applications with secure code, and are not tied to any specific CMS. WordPress, Drupal and Joomla were used only as demonstration targets for unauthenticated remote code execution, and the PHP team has released fixes.
The PHP project has released updates 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let unauthenticated attackers achieve remote code execution. The flaws stem from out-of-memory handling and stale global state issues affecting PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed deployments. PHP versions 8.1 and earlier no longer receive official fixes, so users on those versions must seek vendor backports or upgrade.
Wiz Research disclosed multiple critical vulnerabilities in the core PHP engine, grouped under two CVEs with severity up to CVSS 9.2, which could let attackers remotely execute code, disclose memory, steal data or deface sites without authentication. PHP, which underpins roughly 70% of websites including WordPress, Joomla, Drupal and MediaWiki, has been affected since version 5.4, and a patch was released on October 21, 2026 following a coordinated cross-industry disclosure effort.
GoKawiil