The PHP security team announced it will ship fixes on Wednesday, October 21 at 14:00 UTC for two vulnerabilities each rated 9.2 on CVSS v4.0, after details reportedly leaked ahead of a planned embargoed disclosure. Researchers at watchTowr say the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are remote code execution bugs affecting PHP versions 5 through 8, and that watchTowr has reproduced one of them without releasing technical details.
bleepingcomputer.com
· 2026-10-20
At RustConf 2026, Rust language team lead Tyler Mandry presented a year-long effort called 'Beyond the &' aimed at giving user-defined smart pointers the same flexibility as built-in references. Mandry illustrated the current limitations with an example involving Rust's map-entry API and a shared cache, showing how code that works with built-in mutable references runs into borrowing restrictions with smart pointers.
lwn.net
· 2026-10-20
A cybersecurity opinion column argues that 2026 will be remembered as the year of 'vulnerability' in the industry's lexicon, pointing to the April disclosure of Anthropic's Claude Mythos and the ensuing fear-driven reaction. CISA reported more than 67,000 CVEs published by mid-September 2026, with an expected total of 96,000 by year-end, yet the author contends the industry wrongly equates this rising volume with actual risk.
darkreading.com
· 2026-10-19
F5 released out-of-band security updates fixing multiple NGINX vulnerabilities, including three critical-severity bugs in the ngx_http_v3_module and the map directive. The flaws allow unauthenticated remote attackers to trigger heap overflows or use-after-free conditions in NGINX worker processes, potentially causing crashes or code execution on non-default configurations. Affected products include NGINX Plus, NGINX Open Source, Ingress Controller, Gateway Fabric, and Instance Manager.
bleepingcomputer.com
· 2026-10-19
Security researchers and Japan's JPCERT/CC report that attackers are actively exploiting CVE-2026-106931, a critical OS command-injection bug in the statistics feature of SiteGuard Server Edition, a web application firewall used on roughly 500,000 to 1.5 million sites. The flaw lets attackers run commands with root or SYSTEM privileges on hosts where the default-enabled statistics function is active, and the vendor has released patches for multiple affected versions, including some end-of-life builds.
bleepingcomputer.com
· 2026-10-18
Drupal has released fixes for two critical remote-code-execution vulnerabilities, CVE-2026-108097 in the core Field UI module and CVE-2026-108099 in the contributed Entity List module, affecting all currently supported versions of the CMS. The project's security team urged administrators to update before October 14, warning that attackers could build exploits within hours or days of disclosure. Exploitation of either flaw generally requires interaction with contributed modules or custom code rather than core alone.
bleepingcomputer.com
· 2026-10-17
BeyondTrust disclosed that the China-linked group Mandiant tracks as Armory Castle exploited a critical zero-day vulnerability, CVE-2026-102764, in its Remote Support appliances starting August 29, 2026. The flaw, rated 9.3 CVSS, stemmed from an internal messaging component failing to validate message origin, letting attackers deploy a custom PHP webshell called SAWFLY within 11 minutes of exploitation.
darkreading.com
· 2026-10-16
Sansec has disclosed CVE-2026-103849, dubbed BlockStrap, a maximum-severity vulnerability in Adobe Commerce, Magento Open Source through 2.4.9, and Adobe Commerce B2B through 1.5.3 that could let attackers execute arbitrary PHP code via a second-pass injection in the email template engine. No active exploitation has been observed yet, but Sansec says it found four potential attack paths within a day of analysis and is urging merchants to apply Adobe's October patch or isolated fix rather than relying on a standard Composer install.
bleepingcomputer.com
· 2026-10-16
Tom's Hardware reviewed Gigabyte's X870 Aorus Infinity, a limited-edition 40th-anniversary motherboard built for extreme overclocking with a two-DIMM layout, onboard voltage read points and OC buttons. The board includes eight rear USB ports, three M.2 slots, four SATA ports, 5 GbE networking and Wi-Fi 7, and Gigabyte lists support for DDR5-11400 with manual tuning. In testing with a Kingston DDR5-6000 kit, it delivered average-to-above-average results in productivity and gaming benchmarks.
tomshardware.com
· 2026-10-16
BeyondTrust has issued a patch for CVE-2026-102764, an authentication bypass flaw in its Remote Support software that attackers exploited since late August to run unauthorized file operations on unpatched appliances. SaaS customers were automatically patched on October 8, while self-hosted users must update manually. Mandiant and GTIG attribute the attacks to a suspected China-nexus group called Armory Castle (also tracked as Warp Panda by CrowdStrike), which used the bug to gain root access, deploy web shells and tunneling malware, and move laterally across victim networks.
bleepingcomputer.com
· 2026-10-16
At FOSSY 2026, Chromium developer Sharon Yang described her move from a six-year engineering role at Google to her current position at Igalia, an employee-owned cooperative. Her talk, titled 'From Corporate to Co-op,' compared how the two organizations approach Chromium development despite both contributing to the same open-source codebase and working with overlapping teams.
lwn.net
· 2026-10-16
Intero Biosystems, a Denver-based startup spun out of the University of Michigan, won the Startup Battlefield Cup and $100,000 at TechCrunch Disrupt 2026. The company, founded by Charlie Childs and Madeline Eiken, makes lab-grown human intestinal 'organoids' sold under the product name GastroScreen to test how drugs and other compounds affect the body. Apate, an Australian startup using AI agents to combat scammers, took runner-up honors among five finalists selected from 20 competitors.
techcrunch.com
· 2026-10-15
GoKawiil