The PHP security team issued an advisory for CVE-2026-115560, a remote code execution vulnerability that only affects systems with a specific non-default configuration involving session serialize handlers and session upload progress. No patch exists yet; PHP maintainers instead recommend disabling session.upload_progress as a temporary mitigation, with a full fix expected in a future regular release. This follows closely behind PHP's patching of two other critical flaws collectively called PHP2Shell.
bleepingcomputer.com
· 2026-10-23
A Hacker News user named petecooper publicly apologized after posting details of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, ahead of a coordinated disclosure embargo. They said contacts had told them no embargo existed, and that they only wanted to warn others following PHP's four-week release cycle. The PHP Foundation had to move up its official announcement after multiple leaks, including one from Chainguard, surfaced before the planned release.
tomshardware.com
· 2026-10-23
The TDM Neo, unveiled at CES 2026, is a headphone that twists and folds into a Bluetooth speaker using magnets and a flexible headband. After CES buzz, awards, and a Kickstarter that beat its funding goal, a reviewer who tested the device for two weeks found the transforming mechanism impressive but raised doubts about whether the hybrid design delivers strong performance in both modes.
wired.com
· 2026-10-23
TechCrunch's Disrupt 2026 Startup Battlefield 200 concluded with Intero Biosystems winning the $100,000 equity-free prize and Disrupt Cup, with Apate as runner-up. The event narrowed thousands of applicants to 200 startups, then 20 finalists, before five companies pitched live for the top prize. TechCrunch also highlighted standout Showcase Stage pitches across categories including Built World, Sustainability, Enterprise, Health, and Consumer, plus a Best Booth award for Legali AI.
techcrunch.com
· 2026-10-22
Amazon's Threat Intelligence team says it detected an attempt to exploit two critical PHP vulnerabilities on October 17th, using a honeypot monitoring system, days before an official patch was released this week. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could let attackers remotely execute malicious code on PHP-based systems including WordPress sites. The PHP Foundation's executive director Elizabeth Barron says there's no known successful remote code execution so far, but urges all affected systems be updated immediately.
theverge.com
· 2026-10-22
Amazon Threat Intelligence found an exploitation attempt against the PHP2Shell vulnerability (CVE-2026-109618/CVE-2026-109619) in its MadPot honeypot telemetry dated Oct. 17, 2026, four days before the embargoed flaw was publicly disclosed. The attempt came from an IP tied to a commercial anonymization service. After the embargo lifted on Oct. 21, Amazon observed multiple proof-of-concept exploits and additional attacks from varied anonymized infrastructure within hours, and the vulnerability is now reportedly being exploited broadly in the wild.
aws.amazon.com
· 2026-10-22
A Hacker News user has publicly apologized for prematurely disclosing details of two upcoming PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, before the coordinated disclosure embargo lifted. The poster says they were told by a contact that no embargo existed and only meant to warn fellow PHP users who build from source about the urgency of upcoming patches.
news.ycombinator.com
· 2026-10-22
Amazon Threat Intelligence reports that attackers began targeting the two critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) on October 17, four days before PHP released fixes on October 21. The PHP team had to move up its disclosure timeline after details including the CVE IDs and mitigation guidance leaked online two days early, and researchers say functional exploits appeared within hours of the patch release.
bleepingcomputer.com
· 2026-10-22
Birdbuddy has released two smart bird feeders first shown at CES 2026, now renamed the Birdbuddy Nook (formerly Birdbuddy 2 Mini) and Birdbuddy Home (formerly Birdbuddy 2). The Nook starts at $99 with a 2K HDR camera and 135-degree field of view, with solar and extended-perch versions priced at $159 and $199, while the $219 Home adds dual solar panels and a larger reservoir. Both are available now on Birdbuddy's site, with wider retail availability later this month.
theverge.com
· 2026-10-22
GitLab has released patches for CVE-2026-110264, a critical integer overflow vulnerability in its Regular Expression Compiler that could allow unauthenticated attackers to execute arbitrary code on vulnerable servers. The flaw, reported by researcher 'joaxcar' via HackerOne, has been fixed in CE and EE versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. GitLab.com and GitLab Dedicated tenants on patched internal builds are already protected, but self-managed installations must upgrade immediately.
bleepingcomputer.com
· 2026-10-22
Tesla reported Q3 2026 revenue of roughly $28 billion, nearly unchanged from a year earlier, as automotive revenue dipped 3% and solar/storage revenue dropped 16% to $2.9 billion. Services revenue grew a third to $4.6 billion, but operating expenses jumped 39% to $4.8 billion, pushing operating margin down to 2.6% from 5.8% a year earlier, with net profit falling 43% to $787 million.
arstechnica.com
· 2026-10-21
Security researchers have disclosed two PHP flaws, CVE-2026-109618 and CVE-2026-109619, affecting PHP web runtimes, along with a suggested AWS WAF rule named 'PHP2Shell' to help block exploitation attempts. The rule targets POST requests that combine PHPSESSID cookie or body values with the PHP_SESSION_UPLOAD_PROGRESS parameter, a pattern associated with session-based remote code execution attacks against PHP applications.
aws.amazon.com
· 2026-10-21
GoKawiil