news
Programming Leftovers
-
Sandor Dargo ☛ C++26 Ranges: Better Infrastructure
C++26 ranges isn’t only about new view adaptors. Three changes landed that don’t give you new ways to compose pipelines but fix real problems: containers can now reserve space for lazy ranges that don’t know their exact size, finally works with ranges, and ranges::to no longer forces you into a | pipeline when a simple function call would do.
-
PHP ☛ PHP: News Archive - 2026
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.
Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.
The vulnerabilities: [...]
-
University of Toronto ☛ Chris's Wiki :: blog/web/FrameworksAndValidation
Why this happens is that like essentially every web framework and even web server, PHP is performing some actions for convenience before your application even starts. So PHP will try to handle some aspects of the file upload for your convenience before your application gets a chance to refuse to accept a file upload. This isn't bad as such but it is a tradeoff. The sooner the framework invokes the application and the more control it gives the application, the more complexity the application is potentially exposed to even if that complexity is just calling back to one of the framework's "do the right thing now" functions.
-
OMG Ubuntu ☛ Ubuntu rolls out php2shell, eMudhra certificate fixes
Ubuntu has released security updates for the php2shell PHP flaw that’s led to websites being taken offline, and a key compromise at the eMudhra certificate authority. Desktop Ubuntu isn’t directly affected by php2shell, since PHP isn’t installed by default. The certificate issue is more of a browser-based concern, though Google, Apple, Mozilla et al blocked the bad certificates on 17 October. Ubuntu’s ca-certificates package update removes two root certificates from the list Ubuntu trusts, both of whom had vouched for eMudhra. This will help protect tools like curl and wget that don’t use their own lists.
-
Security Week ☛ Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys
The private keys associated with eight certificates were compromised, and root programs and trust stores are blocking them.
-
Ubuntu ☛ php2shell (CVE-2026-109618 and CVE-2026-109619) – PHP critical vulnerability fixes available
-
The New Stack ☛ AI found flaws in the code behind 70% of the web. The fix took two months.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively called PHP2Shell, score 9.2 on the CVSS v4.0 severity scale. Researchers at Calif.io found one using OpenAI’s GPT-5.6 Sol, while Wiz independently found both using its Wiz Atlas tool alongside Google’s Gemini 4 Argon and GPT-5.6 Sol. Cloudflare also lists Quarkslab among the parties that disclosed the bugs.
-
Nick Heer ☛ PHP Warns Admins to Expect Emergency Patches Tomorrow
Word on the street is that these exploits have leaked, and that remote code can likely be executed all the way back to PHP 5. If you have access to your website’s php.ini file, it might be worth turning off multipart uploads for now.
-
Ruben Schade ☛ Case screws, PHP2Shell, and eMudhra⁴
I’ve taken my family hosted PHP sites down for now, and am delivering static cached versions of the ones I host for others until I have time to patch and validate.
-
Sergio Visinoni ☛ Be a loser
DHH doesn't offer any compelling argument besides the usual and weak because I said so.
But let's move on to another flaw: the pretended counter-arguments.
-
SQ Magazine ☛ PHP Readies Critical Security Update for Two 9.2 Flaws
The PHP security team will ship a security release on 21st October 2026, fixing two critical vulnerabilities, each rated 9.2 under CVSS v4.0. The team urged every PHP user to be ready to upgrade the moment it lands.
-
Wired ☛ Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
Wednesday’s release of fixes for two critical vulnerabilities in PHP caused administrators and security staff to race to identify and patch vulnerable websites and apps, while attackers inevitably reverse engineered the fixes to learn how to exploit the flaws. Some governments and other groups even proactively took key websites down in anticipation of the release, so they wouldn't be targeted before they could apply the patches.
-
Silicon Angle ☛ Critical PHP vulnerabilities send organizations scrambling to secure their systems
“This is not a theoretical vulnerability,” said Fastly Chief Product Officer Kelly Shortridge. “We observe many billions of PHP requests a day across Fastly’s global network, and we are seeing evidence of active attacks.”
The two exploits are together known as PHP2Shell. They enable hackers to deploy malicious code on vulnerable servers. The installation process takes only a few seconds in some cases. Once the malware compromises a website, it can read its database and launch cyberattacks against visitors.
-
Michael Tsai ☛ PHP2Shell
-
Earthly ☛ The limits of CI templates for standards enforcement at scale
CI templates and golden paths remain foundational platform infrastructure. They standardize build environments, accelerate new-service creation, and codify organizational opinion in a reusable form. The question is how much of the standards-enforcement load a template can carry, and where that work needs to live elsewhere.
Five recurring failure modes expose the limits. Understanding the visibility problem underneath them lets you keep the value of templates while enforcing standards across the whole organization.
-
Max Bernstein ☛ Rails is a JIT compiler
The change to the the code started off fairly mechanical: we should be able to do module_eval to generate a similar looking method: [...]
-
Max Bernstein ☛ Objects, attributes, maps, oh my! | Max Bernstein
In many dynamically typed programming languages, objects look like a big ol’ mapping of names to values. The languages encourage this flexibility. Consider for example Python: [...]
-
Michael Heap ☛ Your 12-month roadmap is fiction | michaelheap.com
Instead of building a list of dated deliverables, you can admit uncertainty in the future and build a roadmap comprised of objectives, confidence levels and horizons.
-
Steinar H Gunderson ☛ Steinar H. Gunderson: Decompilation patterns, part 18: Signed division
As promised, the last one (for now?), and this one blew my mind the first time I saw it: [...]
-
Rust
-
Rust Weekly Updates ☛ This Week In Rust: This Week in Rust 674
Hello and welcome to another issue of This Week in Rust!
-
Rust Blog ☛ The Rust Programming Language Blog: Announcing rustup 1.29.2 [Ed: Rust will fix all security issues... or NOT]
The rustup team is happy to announce the release of rustup version 1.29.2.
What's new in rustup 1.29.2
This is a small release which only updates the rustls-webpki and webpki-root-certs dependencies to address the problematic eMudhra intermediate certificates issue described in CVE-2026-111943.
-
-
Standards/Consortia
-
Jason W Comeau ☛ The Future of CSS ✨ • Josh W. Comeau
CSS Subgrid is a good example. Subgrid is a super-powerful extension to CSS Grid which enables entirely new layouts. It was implemented in Firefox back in 2019, but there wasn’t much movement with other browsers for years. It got added to Interop 2023, and by the end of that year, it was widely available across all modern browsers: [...]
-