Tech Brief

Thursday, October 22, 2026

PHP's runtime got two critical RCE bugs on a day when three other pieces of trusted infrastructure, a CA, a Python package and a hosting platform, also lost your trust.

Opening note

Almost everything today is a supply-chain story. PHP shipped emergency patches for two remote code execution bugs in the runtime itself. A certificate authority turned out to have generated private keys that were one byte long. A LiteLLM release on PyPI carried a credential stealer. Railway disclosed that customer environment variables were accessed. Separately, GitLab and Node.js each shipped security releases.

If you run PHP anywhere, including inside Nextcloud, WordPress, OPNsense or a vendor appliance, patch before anything else. If you used LiteLLM 1.107.0 or keep secrets in Railway, rotate credentials today. The rest of the brief covers AI product launches, a hardware squeeze that is starting to hit local-model people, and one live Shopify checkout-hijack campaign.

The big story

PHP2Shell, two critical RCEs in the PHP runtime

3 min read

What happened. On October 21 the PHP Foundation released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619, both unauthenticated remote code execution bugs. The Foundation puts the real CVSS at 9.2 (a leaked early listing said 10.0). Cloudflare says PHP runs on almost 70% of websites. AWS's bulletin lists PHP 5.4 through 8.1 as end of life with no planned fix.

Mechanism. Both bugs live in memory management and error handling, code that nearly every request touches. - CVE-2026-109618: if a request hits memory_limit at the wrong moment, PHP leaves partly initialized internal data that later gets treated as valid. On Apache with mod_php this can fire before any application code runs. The Foundation says RCE was demonstrated with default settings. - CVE-2026-109619: a fatal error at the wrong point leaves internal state pointing at memory from a previous request, so a later request on the same worker uses freed memory. - Calif's write-up says PHP-FPM is also exploitable, but the fatal must happen after startup and the app must decode something, for example session_start(), unserialize() or WordPress's maybe_unserialize(), with session upload progress enabled. Calif lists pre-auth RCE against WordPress, Drupal, Joomla, MediaWiki, Roundcube, Magento, phpMyAdmin, Nextcloud, Laravel, Symfony and WHMCS.

Timeline. - 2024: an OSTIF/Quarkslab audit flagged an out-of-memory exploit as theoretical. The security team then weighed competing fixes for months. - Aug 11, 2026: Calif and OpenAI independently reported the same root cause. Wiz followed on Aug 24. - Oct 20: CVE ids leaked with the wrong date and score. Calif accidentally published a PoC video. The Foundation moved the release up a day. - Oct 21: Chainguard published fixed images more than six hours early. Cloudflare says it saw attack traffic and payload tweaks to evade its rules. The Foundation says it had found no functional exploits at release time. Those two statements are in tension, and I would trust the one that comes from observed traffic.

What is disputed. One HN post (58 points, 10 comments) argues the public PoCs fail on a vanilla PHP and depend on a separate local-file-inclusion bug. Calif claims default-config exploitation. I could not run either, so treat "easy to exploit" as unverified in both directions. Do not use that post as a reason to wait.

Unknown. How many appliances embed PHP (commenters name Palo Alto Panorama, NetScaler and Aviatrix, unverified), and whether the EOL branches will get any backport.

Assessment. The Foundation's own post calls the delay "a structural failure": the OOM problem sat unfixed for roughly two years. Disclosure also leaked at three separate points. Expect a long tail of unpatched hosts. Cloudflare's WAF rules buy time but are not a fix; a top commenter in r/cybersecurity (sha256md5) notes they are easily bypassed in many apps.

What to do. - Upgrade to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, or your distro's backport. Rebuild container images. - Stopgap if you cannot patch: session.upload_progress.enabled=0 and memory_limit=-1 (the latter raises memory-exhaustion risk). AWS also suggests blocking request bodies over 8 KB via the CRS SizeRestrictions_BODY rule. - Inventory what embeds PHP: Nextcloud, OPNsense, vendor admin panels. - Sources: PHP Foundation, Calif, Cloudflare, AWS 2026-143. Discussion: HN 657 pts / 326 comments, r/selfhosted 776 / 213, r/cybersecurity 643 / 60.

AI / LLM

Claude Duet: Anthropic's always-on agent, in research preview

1 min read

Anthropic released Claude Duet, a proactive agent app that checks your connected accounts every few hours, messages you only when something needs attention, and runs on its own VM and browser. It is a waitlist preview for US Pro and Max users, uses your normal usage limits, and lists over 6,000 connectors, including Shopify. It can pay through Stripe Link virtual cards and check out with Shop Pay. Anthropic says it asks approval before sending, paying, signing or deleting, and never sees raw passwords. That is the vendor's description; the page itself admits it may misjudge urgency. The HN thread has 298 points and 254 comments, and r/ClaudeAI has 793 points on the launch post. Verdict: for builders, the Shopify and Stripe connectors matter more than the assistant. Agents that check out on your customers' behalf will show up in your analytics soon. Anthropic, HN, r/ClaudeAI.

Recursive Flint: a 40B open model that activates 2.5B parameters

1 min read

RecursiveSI released Flint under Apache 2.0, aimed at coding agents. The model card lists 39.8B total and about 2.5B active parameters, 256K context, a BF16 checkpoint of about 80 GB, and developer-reported scores of 74.2% on SWE-bench Verified and 54.9% on Terminal-Bench 2.1. Those scores are self-reported and eval setups differ, so wait for independent runs. r/LocalLLaMA gave it 396 points and 153 comments; a second thread (61 points) asks if it is "the Qwen3.8 35B we've been waiting for." A related Qwen 3.8 Flash Next post has 281 points. No hosted provider serves Flint yet. Verdict: worth a weekend on your own coding-agent harness if you have a 80GB-class GPU; do not swap production on a model card. Hugging Face, discussion.

Samsung's 2027 HBM is sold out, and local-LLM people are doing the math

1 min read

A r/LocalLLaMA post (670 points, 250 comments) claims Samsung sold out all 2027 HBM capacity, with HBM prices expected to jump 200% and DRAM up double digits. This rests on the post and its linked reports; I did not open the underlying article. The thread splits. One side says the break-even for owning hardware has moved out and cloud is now cheaper for light use. The other says agentic coding at volume is still far cheaper locally; one commenter reports running 12 agent slots on a single RTX 5090. A separate post says ByteDance, Alibaba and Tencent ordered over $35B of Nvidia chips (749 points). Verdict: if you plan GPU purchases for inference this year, buy before 2027 pricing lands, and treat per-token cloud prices as the thing most likely to move next. r/LocalLLaMA.

"How do you stay on top of code changes in an AI world?" splits ExperiencedDevs

1 min read

This r/ExperiencedDevs thread (38 points, 112 comments) had a top reply with 205 points saying you don't, you accept it and ship faster. Others argue back: make the author own on-call for what they ship, and use deterministic tooling (architecture tests, linters, ratchets) because skill files and agent rules are only suggestions. One engineer reports 13 PRs a day landing in their team's repo. Verdict: the practical answer in the thread is the unglamorous one. Put review cost in the metrics, and let the bot generate the checks that bind the bot. Thread.

Programming

DuckDB 2.0 LTS ships with a storage-format break

1 min read

DuckDB 2.0.0 "Cinnamon Teal" is an LTS supported until at least October 2027. It adds a client-server mode, async I/O for Parquet and CSV on object storage, a native VARIANT type, triggers, and a CLI agent mode that cut output the model must read by 59% in TPC-H tests (DuckDB's number). The costs: versions before 2.0 cannot read 2.0 database files, C++17 is now required, the single-arrow lambda x -> x + 1 is off by default and goes away in 2.1, and osx_amd64 is dropped in 2.1. The post gives no general speed benchmarks, only "dramatically faster" for object storage. Verdict: test on a copy first, since the file format is one-way. HN: 357 points, 43 comments. Announcement, HN.

GitHub is moving Git storage to Azure because of agent traffic

1 min read

GitHub's engineering post says 99.99999% of repositories are now copied to Azure, and Azure serves about half of Git traffic, driven by agent-related growth that hit data-center power and supply limits. The post gives no agent traffic numbers. The technical change: locks are now per reference rather than per repository, which gave 3 to 4x higher write throughput in internal tests, and object storage joins the quorum as a "virtual replica." Verdict: if your CI or agents hammer a single repo with writes to different branches, expect this to help. The missing agent-traffic figure is what I would want before drawing conclusions about the trend. GitHub blog, HN 55 / 15.

curl moves low and medium vulnerability reports into the open

1 min read

From October 26, curl asks for LOW and MEDIUM reports as public GitHub issues; only HIGH and CRITICAL stay private on HackerOne. Daniel Stenberg's reasons: a flood of reports is overloading maintainers, over 90% of submissions can be rated below HIGH quickly, and AI-assisted reviewers are already checking new CVE fixes in public. The post gives no report count. Verdict: expect other maintainers to copy this. If you maintain an open-source dependency, tier your intake by severity now. Post, Lobsters 55 / 2.

The Future of CSS: Josh Comeau's Interop 2027 picks

1 min read

Comeau lists ten proposals he voted for: @function, corner-shape, border-shape, scroll-triggered animations, reading-flow, interpolate-size, gap decorations and scroll-state container queries among them. These are proposals, not a final list, and most are not yet in Firefox or Safari. Verdict: interpolate-size (animating to height: auto) and gap decorations remove real JS and extra DOM; watch those two. Post, Lobsters 54 / 6.

Security

eMudhra's CA keys were one byte long

1 min read

Scott Helme showed that eight eMudhra intermediate CA keys had private scalars that were 47 zero bytes plus one byte (values such as 4, 56, 115, 156), so each was recoverable in at most 255 elliptic-curve steps. The intermediates date from April 2025, giving roughly 17 months of exposure. Chrome blocked them on October 17 via CRLSet, Firefox via OneCRL, with Apple and Microsoft following (per a daily.dev summary). eMudhra's account in a Mozilla bug blames a ceremony-script bug that created a second weak key pair. Browsers that enforce Certificate Transparency are likely fine; no matching certificates appeared in CT. The risk is everything else: Helme's tests had curl, Python and Node accepting a forged api.stripe.com certificate on default Linux and macOS setups. Verdict: update your CA bundles (OS ca-certificates, certifi, Node, base images). Node's October security release already includes the removal. Mozilla's own post returned 403, so Mozilla details here come from Helme and secondary coverage. HN: 829 points, 398 comments. Helme, HN, r/programming 598 / 98.

LiteLLM 1.107.0 on PyPI carried a credential stealer

1 min read

SafeDep reports that LiteLLM 1.107.0 (all wheels and the sdist) was uploaded to PyPI at 11:39 UTC on October 21 and removed by 13:40 UTC. A cook.pth file runs on every Python startup, even in processes that never import litellm. It steals SSH keys, cloud and CI credentials, shell history, browser data and the proxy database's provider keys, then exfiltrates to www.litellm[.]dev. A hourly daemon could fetch second-stage code. SafeDep, with moderate-to-high confidence, thinks BerriAI's private release pipeline built from modified source; only BerriAI's logs can confirm. Version 1.106.2 is reported clean. A selfhosted post says the 1.107.0 Docker image and the latest/main-stable tags were affected too, and that claim is from that thread only. Verdict: any host that installed it is compromised; rotate everything it could reach. Check for cook.pth in site-packages and /tmp/remote_code_loader.lock. SafeDep, HN 421 / 131, r/selfhosted 137 / 25.

Railway: environment variables accessed, deployments paused

1 min read

Railway says it detected anomalous activity on systems storing customer environment variables, and an unauthorized party may have read encrypted variables, with decrypted contents obtained for "some." It calls this part of a series of attacks on platform companies aimed at AI inference providers, and has notified upstream providers to revoke keys. Deployments are paused. Not disclosed: affected account count, root cause, or which variables. Railway recommends rotating all env vars and registry credentials now. HN: 259 points, 118 comments. In r/webdev (46 points, 39 comments) users were already complaining about Railway reliability before the disclosure. Verdict: rotate first, then work out how many of your secrets belonged in a platform's env store at all. Railway, HN.

GitLab 19.5.1: unauthenticated RCE, CVSS 10

1 min read

CVE-2026-110264 is an integer overflow in the regular-expression compiler that could let an unauthenticated user run code, affecting versions from 7.0 up to the fixes (18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, 19.5.1). Two High issues cover LDAP account takeover (needs SAML plus LDAP auto-linking) and OAuth discovery cache poisoning. GitLab.com is patched. The release includes migrations, so single-node instances will have downtime. Verdict: self-managed users upgrade today and check GitLab's published detections ("Onigmo native worker crash"). HN: 231 points, 58 comments. GitLab, HN.

Node.js October security release

1 min read

Fixed in v22.23.4, v24.22.1 and v26.12.1: four High CVEs, including a Brotli decoder out-of-bounds write that permits RCE (CVE-2026-111497) and two TLS hostname-check bypasses involving IP-address parsing. The release also bundles the eMudhra CA update. Verdict: bump Node alongside PHP; this one is easy to forget. Node.js, Lobsters 13 / 0.

Shopify and e-commerce

Checkout hijacks through third-party Shopify apps

1 min read

A single-author blog post (romanzipp.com, 1 point on HN) reports that since about October 10, some Shopify stores redirected shoppers at checkout to fake payment pages on lookalike domains such as biliing[.]top. The script arrived through third-party apps, mainly HulkApps Product Options, with Swym Wishlist Plus and Selleasy also named; Privy, Boost, Consentmo and 17TRACK are reported but unconfirmed. The script ran once per shopper in session storage, then sent them on to the real checkout, so the theft was easy to miss. HulkApps and Selleasy say they removed the code; the root cause is still unclear and the post is a single author's account. Verdict: test your own checkout in an incognito window and audit every app that injects script into the storefront. Post.

Elsewhere, r/shopify had nothing above 4 points in the last day (mostly admin-app complaints), and r/ShopifyDevs returned no posts. daily.dev's For You feed carried "Why Shopify Migrated From React Native"; I did not open it.

SaaS and indie business

Anthropic's draft IPO numbers, via WSJ

1 min read

A r/ClaudeAI post (181 points, 120 comments) summarizes WSJ's reading of Anthropic's draft IPO papers: $16.3B revenue in six months, an $80.7B paper loss, and about $450B committed for compute. I did not open the WSJ story, so treat the figures as secondhand. Verdict: if your product depends on one model vendor, those compute commitments are the line to watch for pricing risk. Discussion.

Quick hits

  • Meta was ordered to pay $25B in a New Mexico case tied to Cambridge Analytica; CNBC returned 403 so this is from the HN title only. HN 329 / 203
  • OpenAI models are coming to Google Cloud (title only, page returned 403). HN 226 / 98
  • OpenAI's "Patch the Planet" coordinates disclosure as agents find critical bugs; page returned 403, so this rests on the thread. HN 228 / 153
  • Mastodon 5.0 brings a pop-out composer and a tokenized theme system; the beta is for admins, release in a few weeks. Post
  • A musl libc CVE (CVE-2026-107891) covers integer overflows in regcomp that can cause out-of-bounds heap writes. Lobsters
  • Cloudflare turned on default PHP2Shell protections for Free and paid WAF plans. Cloudflare
  • Your MCU probably escaped the eMudhra issue, because most firmware trusts only a handful of roots. Post
  • A user used Claude Code to debloat a Samsung TV over 11 hours on a Max 100 plan (14M tokens read, per the thread). r/ClaudeAI 3,009 / 318
  • Firefox security patch tests are now private for at least a week. Lobsters

Worth a long read

  • Eight Bits of Trust by Scott Helme. A rare postmortem that shows the actual key values and tests which default clients accept a forged certificate. Read it to learn which of your tools skip Certificate Transparency.
  • The PHP Foundation's release post. It admits a two-year delay was a structural failure and lays out the staffing and decision-process changes. Useful as a template for any maintainer team under security load.

By the numbers

  • 9.2real CVSS of the PHP bugs; the leaked listing said 10.0. (PHP Foundation)
  • ~70%share of websites running PHP, per Cloudflare.
  • 255maximum steps to recover each eMudhra CA key. (Helme)
  • ~2 hourshow long LiteLLM 1.107.0 was live on PyPI, 11:39 to 13:40 UTC. (SafeDep)
  • $35BNvidia chip orders attributed to ByteDance, Alibaba and Tencent. (r/LocalLLaMA post, unverified)

Do this today

Sources and coverage
  • Reddit (MCP, get_top_posts, day, limit 15): 14 of 14 subreddits queried. r/ShopifyDevs returned "No posts found". Several returned fewer than 15 posts. Comment threads read for 5 posts: r/selfhosted PHP2Shell, r/ExperiencedDevs AI code changes, r/LocalLLaMA HBM, r/ClaudeAI Samsung TV, r/cybersecurity "PHP - As an IT person."
  • Hacker News: top 40 from Firebase read in full. Algolia queries (shopify, llm, vulnerability) failed once with a JSON parse error because the > in numericFilters was unencoded, then succeeded on the retry with %3E.
  • Lobsters: hottest.json, first 25 items read.
  • daily.dev: For You feed and Happening Now read. The ai, webdev and security tag pages loaded stale 2024 content, so I used only the For You feed.
  • X: failed. page.goto to x.com/home and the search URLs timed out ("page.goto timed out after 15000ms waiting for load", again at 45000ms, and "waiting for commit" at 20000ms on a second page), then page.evaluate timed out with "the Page is still unresponsive". No X content used.
  • Primary sources opened: PHP Foundation, Calif, Cloudflare, AWS bulletin, php-src release, eliastaylor.com, Helme, SafeDep, Railway, GitLab, Node.js, Claude Duet, DuckDB, Hugging Face (Flint), GitHub blog, curl, Josh Comeau, Mastodon, romanzipp.com, danielmangum.com.
  • Failed to open (403): Mozilla security blog, OpenAI (Patch the Planet, Google Cloud), CNBC.
  • Based on the discussion thread or title only: Meta $25B, OpenAI on Google Cloud, Patch the Planet, Samsung HBM and Nvidia orders (Reddit posts), Anthropic IPO figures (WSJ not opened), LiteLLM Docker tag scope, netsec "first exploit requests 5.5 hours early" claim (title only, not cited above), the Apple/Microsoft distrust dates in eMudhra (daily.dev summary).