The European Space Agency's Euclid telescope, while surveying deep space far from the solar system's ecliptic plane, incidentally captured images of a previously unknown comet. Mikko Pöntinen of the University of Helsinki, working with the Solar System Objects Science Working Group, used software designed to detect moving objects to spot a streak across several images, later confirmed as comet C/2026 S1 (Euclid), located roughly 1.3 billion kilometers from Earth.
cnet.com
· 2026-10-21
Security firm Calif uncovered two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale, that allow unauthenticated remote code execution via memory corruption and stale global state issues. WatchTowr researchers confirmed they could reproduce both flaws after a proof-of-concept tool called PHP2Shell leaked ahead of a planned coordinated disclosure, and PHP's maintainers have released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
darkreading.com
· 2026-10-21
SpaceX's third-quarter earnings exceeded Wall Street expectations, producing an unexpected profit that analysts described as a blowout result. Elon Musk responded by declaring that a previously stated ambitious goal is now within reach, without detailing specific figures or timelines in the reporting.
fastcompany.com
· 2026-10-21
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released to fix CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities that could let unauthenticated attackers execute code on servers running PHP. One flaw involves memory corruption triggered when a request hits the memory_limit at a precise moment, while the other involves stale internal state left behind after a fatal error, both of which were shown to enable full remote code execution under common configurations like Apache with mod_php and PHP-FPM.
thephp.foundation
· 2026-10-21
The PHP Foundation released emergency updates on Wednesday to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let attackers remotely take control of affected systems. The flaws affect all PHP installations serving web requests dating back to PHP 5 from 2004, though only PHP 8.2 and newer will receive official patches, with some legacy fixes available through third-party vendors.
wired.com
· 2026-10-21
Security researchers at Calif.io, Wiz, OpenAI and Quarkslab disclosed two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, dubbed php2shell, affecting all web servers running PHP 5.4 or later. Cloudflare says it deployed WAF protections for free and paid customers by October 21 at 3:02 am UTC, roughly nine hours before the public disclosure, after coordinating with the PHP Foundation, OpenAI and Wiz.
blog.cloudflare.com
· 2026-10-21
The PHP project has issued version 8.5.12 to patch two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let an attacker achieve unauthenticated remote code execution. One flaw stems from out-of-memory handling corrupting partially initialized request data, while the other involves stale internal state persisting across requests on the same worker. The advisory says all web-facing PHP setups are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php deemed highest risk since a working exploit can trigger before any application code runs.
techspot.com
· 2026-10-21
Stern Pinball hosted a public tour of its Elk Grove, Illinois headquarters and factory floor ahead of the 2026 Pinball Expo in nearby Schaumburg. Founder Gary Stern and designer George Gomez led visitors through the facility, with Gomez stating that Stern currently controls about 90 percent of the pinball market. The tour coincided with a wave of new licensed machines from the company, including a Fallout-themed table.
arstechnica.com
· 2026-10-21
The PHP security team issued emergency updates fixing two critical remote-code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, found by researchers from Calif, Wiz, and OpenAI. Both bugs stem from memory corruption when requests end abnormally and affect nearly all PHP deployments that handle web requests, including PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with limited source backports offered for older 7.4, 8.0, and 8.1 branches.
bleepingcomputer.com
· 2026-10-21
Microsoft says it incorrectly marked an Always On VPN connection bug as resolved in its October 2026 Windows 11 cumulative update. The company has reverted the issue's status from 'Resolved' to 'Mitigated' and says a real fix will arrive in a future update. In the meantime, it recommends IT admins work around the problem by manually selecting a single VPN tunneling protocol instead of automatic protocol selection.
bleepingcomputer.com
· 2026-10-21
PHP maintainers announced Monday that patches for two vulnerabilities, each rated 9.2 out of 10 in severity, would be released within about 12 hours. The advisory followed leaked, unconfirmed details of an exploit tool called PHP2Shell demonstrated against popular PHP-based platforms including WordPress, Magento, Drupal, and Joomla. Security firm watchTowr said the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, appear to affect every PHP version since PHP 5 in 2004 and that it has confirmed they are genuine.
arstechnica.com
· 2026-10-21
A widely tracked measure of U.S. home-buying activity dropped sharply in September, falling to its lowest level in more than two decades. Analysts cited elevated mortgage rates as the main factor keeping prospective buyers out of the market.
fastcompany.com
· 2026-10-20
GoKawiil