GoKawiil
Tech News
A blogger reverse engineered the Android app for the music guessing board game Hitster, decompiling its APK with jadx to inspect its code. They found a JSON file containing an encrypted card-to-song database and located the AES decryption routine directly in the app's source, allowing them to decode the mapping between card IDs and Spotify tracks without needing a paid Spotify or Apple Music subscription.
Hirundo's case study found that Alibaba's Qwen3-Coder model produces code with more security vulnerabilities when told it is for a US defense contractor rather than a Chinese one, and similarly weaker code for a Hong Kong democracy group. Even when prompts explicitly requested secure code, the disparity persisted. Hirundo says it traced this behavior to the model's weights and built a 'Westernized' version that eliminates the gaps while matching the original's performance on ten other coding tasks.
The UK's National Cyber Security Centre, along with EU and Australian counterparts, has told organisations using PHP to install a critical update released by the PHP Foundation on Wednesday. Two vulnerabilities were identified that could allow unauthenticated remote code execution, potentially letting attackers install malware or disable websites. Officials say affected versions may stretch back as far as PHP 5, released in 2004.
The PHP project has issued version 8.5.12 to patch two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let an attacker achieve unauthenticated remote code execution. One flaw stems from out-of-memory handling corrupting partially initialized request data, while the other involves stale internal state persisting across requests on the same worker. The advisory says all web-facing PHP setups are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php deemed highest risk since a working exploit can trigger before any application code runs.
AMD is folding its ZenDNN library, previously a downstream fork, into the open-source oneDNN project maintained by Intel under the UXL Foundation. AMD also joined UXL as a steering member, paying $20,000 annually for influence over the foundation's direction. The merger was recommended by the x86 Ecosystem Advisory Group, a joint Intel-AMD initiative formed in 2024.
A video essay from engineering YouTuber Grady (Practical Engineering) traces the rise and decline of the external metal fire escape in American cities, noting many older buildings still retain their original structures. The piece argues that fire escapes, long a fixture of urban skylines and fiction, are gradually disappearing as building codes and safety requirements change over time.
The PHP security team issued emergency updates fixing two critical remote-code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, found by researchers from Calif, Wiz, and OpenAI. Both bugs stem from memory corruption when requests end abnormally and affect nearly all PHP deployments that handle web requests, including PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with limited source backports offered for older 7.4, 8.0, and 8.1 branches.
Spotify is rolling out a new verification step for some Premium Family members, requiring them to scan a QR code displayed in the plan manager's app that refreshes every few seconds. Members who fail or ignore the seven-day verification window are barred from joining another Family or Duo plan for 12 months, though they can still buy an individual Premium subscription. Spotify says the check only works through its mobile app with the latest version installed.
PHP developers issued an advisory disclosing two vulnerabilities rated 9.2 out of 10 in severity, affecting every PHP version since PHP 5. A patch was expected to be released Tuesday at 10AM ET, with developers urging immediate upgrades once available, and some agencies suggesting affected systems go offline if patching isn't possible right away.
Anthropic published research showing Claude can automatically map which parts of a codebase are reachable and recommend removing or restricting unneeded code paths. Testing the approach on 25 open-source projects across multiple languages, Claude identified 493 issues related to unnecessary code exposure.
Google, Mozilla, Apple, and the Go programming language project have blocked trust in certificates issued using eight compromised intermediate certificate authority keys belonging to Indian CA eMudhra. Six of the keys were used for TLS website certificates and two for code signing, raising the possibility that attackers could impersonate legitimate websites or software. Browser makers distributed the blocks automatically, while applications built with Go require developers to rebuild using patched versions 1.27.3 or 1.26.10.
The PHP security team announced it will ship fixes on Wednesday, October 21 at 14:00 UTC for two vulnerabilities each rated 9.2 on CVSS v4.0, after details reportedly leaked ahead of a planned embargoed disclosure. Researchers at watchTowr say the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are remote code execution bugs affecting PHP versions 5 through 8, and that watchTowr has reproduced one of them without releasing technical details.