On October 21, 2026, the PHP project released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address two critical unauthenticated remote code execution vulnerabilities known as PHP2Shell, while Moonshot AI launched the Kimi K3.1 Pro model. The PHP updates mitigate CVE-2026-109618 and CVE-2026-109619, which the Snyk Blog reports carry a CVSS rating of 9.2. Following the disclosure, Amazon Web Services published guidance on using AWS WAF to apply temporary mitigations for these vulnerabilities. Separately, Moonshot AI introduced Kimi K3.1 Pro, a 3T-class open-weight model featuring a 1-million-token context window designed for tasks including coding, 3D modeling, and cybersecurity. While the model is currently available, Moonshot AI scheduled the release of full model weights for November 4, 2026. Salesforce is currently assessing its infrastructure in response to the PHP vulnerabilities and advises organizations to prioritize patching. Synthesized from 909 manifests produced by 203 monitored engineering and corporate blog sources in the last 7 days, including Netflix, Uber, Databricks.
Answer updated Oct 24, 2026 12:09 UTC · rebuilt twice daily from the rolling 168-hour window
What You Need to Know About the Critical PHP Vulnerabilities (PHP2Shell)
On October 21, 2026, the PHP project released updates for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to mitigate two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Known as 'PHP2Shell,' these flaws allow for unauthenticated remote code execution, with one also enabling memory disclosure. Salesforce is
Introducing Kimi K3.1 Pro
Moonshot AI has launched Kimi K3.1 Pro, a 3T-class open-weight model featuring a 1-million-token context window and enhanced agentic capabilities. The release includes a high-speed variant and covers coding, 3D modeling, financial research, and cybersecurity tasks. Full model weights are scheduled for release on Novemb
PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): Update Now
The PHP project released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical unauthenticated remote code execution (RCE) vulnerabilities. Both vulnerabilities are rated CVSS 9.2 and reside within the PHP runtime, meaning they are reachable before any application code executes. The PHP security team emphasiz
A patched PHP server can still be a compromised one
Critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were disclosed on October 21, 2026, following an online leak. Attackers began exploiting these flaws days before the official disclosure, highlighting the gap between patch availability and actual system security.
Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
AWS has released guidance on using AWS WAF to mitigate two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. While AWS WAF provides defense-in-depth, the authors emphasize that patching PHP is the only complete fix. The post details specific WAF ru