Forgot your password?
Close
typodupeerror

Submission + - Upcoming Critical PHP Security Release (php.net)

Submitted by mrspoonsi
mrspoonsi writes: The PHP security team would like to give advance notice of an upcoming security release.

It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.

It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.

All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.

We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.

Full details, affected versions, and the fixed versions will be published with the release.

Thank you for helping us keep PHP secure.

Submission + - PHP Warns It Plans to Release 2 Emergency Patches Imminently (arstechnica.com)

Submitted by Anonymous Coward
An anonymous reader writes: Website admins, brace yourselves. Fixes for what are believed to be uncommonly severe vulnerabilities are scheduled to drop in a little more than 12 hours for PHP, a programming language that powers websites and Web applications everywhere. PHP maintainers said Monday that they planned to release patches for two vulnerabilities, both with severity ratings of 9.2 out of a possible 10.

“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” the advisory stated. “We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.” The maintainers published the advisory following the leaking of purported details, which have yet to be confirmed. The report showed a video of an exploit tool dubbed PHP2Shell executing code on webservers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9, all of which use PHP. A video depicting the tool has been reposted here.

Attempts to locate the unconfirmed report were unsuccessful, but security firm watchTowr said it claimed to affect every PHP version from PHP 5, released in 2004, onward. The security firm went on to say it has confirmed that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are real. Researchers from separate security firm Sansec said they “expect mass attacks to start within 15 minutes of the release.” A third security firm, Webfence, also urged admins to prepare now. Huntress has also issued an advisory.

Submission + - Two unpatched Citrix NetScaler RCE zero-days face active exploitation

Submitted by Anonymous Coward
An anonymous reader writes: Warning: Two unpatched Citrix NetScaler RCE zero-days face active exploitation

“Security firm watchTowr says attackers are exploiting two unpatched remote-code-execution flaws in Citrix NetScaler ADC and NetScaler Gateway appliances. Citrix has not confirmed the vulnerabilities, issued a fix or published indicators of compromise, leaving administrators to choose between isolation and continued exposure.”

Submission + - FLOCK has installad 335,000 snooper-cans in the United States. (tomshardware.com)

Submitted by noshellswill
noshellswill writes: FLOCK has generated an invasion-level event, by the unsupervised installation of 335,000 cameras in the United States. As FLOCK Inc. has actively "partnered" for access with armed enforcement agendas both public and private ... while selling data to any paying customer .. their public safety threat exceeds prudent (re)publican standards.

Submission + - Inside Britain's Infrastructure Of Information Control (dailywire.com)

Submitted by Anonymous Coward
An anonymous reader writes: The term “Orwellian” is not supposed to be a compliment. But far too often in the modern world, governments behave as if George Orwell’s warnings against totalitarianism, notably in “1984” and “Animal Farm,” are instruction manuals for governance.

On September 22, Britain’s new (and unelected) Prime Minister Andy Burnham took to the stage at the U.N. and announced a new “National Centre for Information Defence” to “detect, attribute, and disrupt” hostile state information attacks.

But this announcement is so pernicious because there is actually some merit in highlighting the kind of information warfare that is being waged against Western populations. But none of us can trust our own governments, given their recent track records, to have such power over information.

Submission + - Complain about a watchlist? Go on a watchlist! (metro.co.uk)

Submitted by Shakes Fist
Shakes Fist writes: "Social media posts criticising government policy are being monitored and investigated by officials, Metro can reveal.

Negative X and Reddit posts from unsuspecting Brits attacking the UKâ(TM)s anti-terror programme Prevent were added to a database of critical online comments.

Metro has obtained a list of nearly 80 critical posts found and logged by the Standards and Compliance Unit (StaCU), which oversees Prevent, between March 2024 and February 2025.

One campaign group whose tweet was recorded in the database said the revelations raised âserious questions about freedom of expression and the right to dissent and protestâ(TM) in the UK."

  âoeIt is deeply concerning to see the Prevent duty being used to enable the monitoring of people and organisations simply because they are critical of the programme. That raises serious questions about freedom of expression and the right to dissent and protest.â

We denounce the âoetroubling lack of transparency about what happens to the information gathered through this social media monitoring [by the Standards and Compliance Unit]: how long it is retained, who it is shared with, and ultimately what the government is using it for.â

Weâ(TM)re clear that âoePrevent has expanded far beyond its stated aim of identifying people considered âoevulnerable to radicalisationâ, and has increasingly been used to justify extensive surveillance.â

Criticising the programme for its many faults shouldnâ(TM)t lead to getting put on a database.

ðY' Sarah Lasoye for ORG.

Submission + - US appeals court upholds Pentagon's supply chain risk label on Anthropic (cnbc.com)

Submitted by Anonymous Coward
An anonymous reader writes:
  • A federal appeals court in Washington, D.C., upheld the Pentagon’s blacklisting of Anthropic.
  • The DoW labeled Anthropic a supply chain risk in March, and Anthropic sued the Trump administration in an effort to undo that action.
  • The designation prevents the U.S. military from using Anthropic’s models and blocks defense contractors from using them in their work with the agency.
  • “We remain confident in our position and are considering all options, including further review,” an Anthropic spokesperson said in a statement.

Comment SaaS boosted Linux and open source usage,.. (Score 1) 356

by Selur (#59040428) Attached to: Ask Slashdot: Do You Prefer One-Time Purchases or SaaS Subscriptions?

Personally, like most others, I prefer to pay more and get a life-long version than the monthly payment stuff.
Like with most stuff I prefer one-time payment over monthly costs to have lower base costs.

That said, the whole software as a service thing seems to drive more and more users and companies to Linux and open source software.
At least in my corner of the world more and more companies are switching and or alt least experimenting with Linux alternatives since they prefer to donate to projects (one time or from time to time, to sponsor a feature) more than having more and more of the software they use changing to saas.

Slashdot Top Deals

Don't compare floating point numbers solely for equality.

Close