Today's PHP security release, and how we're strengthening security

https://thephp.foundation/assets/icons/php_foundation.svg
The PHP project has released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities that allow unauthenticated attackers to execute code on servers running PHP.

Mistral Large 4

https://mistral.ai/_astro/artificial-analysis---deepswe-1.1%201_Z1nS7pb.webp?dpl=6ac4f7597a7b31848042d469
Mistral is launching a public preview of its ML4 model, a 1 trillion-parameter natively multimodal AI that achieves exceptional performance across various tasks. The model will be available for testing and feedback until the end of the month when weights are released.

Meta ordered to pay $25B penalty in New Mexico Cambridge Analytica case

https://image.cnbcfm.com/api/v1/image/108369714-1790707327000-gettyimages-2297223922-AFP_C9Q39NT.jpeg?v=1790707365&w=750&h=422&vtcrop=y
Meta ordered to pay $25 billion in penalties by a New Mexico court for violating state data privacy laws stemming from the Cambridge Analytica scandal. The penalty is related to 43 million violations of the state's unfair practices act, with each transgression carrying a civil penalty as high as $5,000.

GitLab Remote Code Execution - Integer Overflow issue

GitLab has released versions 19.5.1, 19.4.3, and others to fix security vulnerabilities and bugs in Community Edition (CE) and Enterprise Edition (EE). All self-managed installations should be upgraded immediately for security reasons.

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

https://safedep.io/images/hugo-paper-mevn-cli-forged-commit-preinstall-dropper-banner.jpg
A credential stealer and remote code execution backdoor were found in the LiteLLM 1.107.0 release on PyPI, which was later removed; versions 1.106.2 and rc releases are clean.

Why Windows 11 still ships with Windows 95's memory manager hidden inside it

https://www.windowslatest.com/wp-content/uploads/2026/10/How-Windows-95-code-survives-inside-Windows-11-696x392.jpg
Windows 11 still uses a part of the Windows 95 kernel, specifically EmulateHeap, to run old apps that rely on its forgiving memory management. This compatibility fix was added after Microsoft noticed issues with games like GTA Vice City and Need for Speed: Most Wanted crashing when using it.

Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds

https://storage.ghost.io/c/ee/88/ee889f88-37ef-43e5-9180-f9b88ee6261d/content/images/size/w600/2026/10/passkeys-trap.png
A security researcher reported that eight eMudhra intermediate certificates were compromised due to weak private keys, which can be easily factored. The affected certificates are still trusted by many non-browser software and devices until July 2039.

No More Icons in Every Menu by Default

https://cdn.jim-nielsen.com/blog/2026/macos-golden-gate-hig-icons.png
Apple has removed icons from default menus in macOS Golden Gate, reversing a decision made in Tahoe. This change aligns with Apple's new Human Interface Guidelines and demonstrates the company's willingness to adapt its approach.

Claude Duet

https://assets.claude.com/a1dfa29eb8cc8993f5a1b91b2cc420ce3eb24179.svg
Jenn has multiple meetings and tasks, including a partner meeting at Harbor on Thursday and reviewing the business's health with key metrics. She also wants to test free shipping over $40 to reduce cancellations in East Bay.

DuckDB 2.0.0 LTS “Cinnamon Teal”

https://duckdb.org/images/blog/thumbs/duckdb-release-2-0-0.svg
The DuckDB team has released version 2.0.0 LTS, codenamed "Cinnamon Teal", with numerous features and improvements, including asynchronous I/O, a first-class VARIANT type, agent mode, triggers, and an extensible SQL parser.

EA is shutting down BioWare

https://platform.theverge.com/wp-content/uploads/sites/2/2025/01/JAY_BLURPLE.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2400
BioWare, the legendary RPG studio behind Mass Effect and Dragon Age, is shutting down due to poor performance. EA has chosen not to continue development on the next Mass Effect game and laid off around 400 staffers, including 50 at BioWare.

Tiny possum and glider thought extinct for 6000 years found in remote West Papua

https://ichef.bbci.co.uk/news/480/cpsprodpb/d743/live/068cb000-191f-11f1-aabf-478e3f053ea7.jpg.webp
Scientists have discovered two extinct species, a possum and a glider, in West Papua after 6,000 years of thought to be extinct. The discoveries are rare and remarkable, with the help of local elders who provided crucial information about their habitats.

AWS rates PHP RCE as Important so Amazon Linux 2023 patch may take 20 days

https://opengraph.githubassets.com/19ae7fa8ec06cf562d4b1ba081410b85c5d4286619a8a54603dccac1e5567d36/amazonlinux/amazon-linux-2023/issues/1148
PHP is releasing a CRITICAL security update today (21.10.2026): https://www.php.net/archive/2026.php#2026-10-20-1 This update will fix two critical CVE: Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Patch the Planet: global response coordination as agents uncover vulnerabilities

https://images.ctfassets.net/kftzwdyauwt9/2PwBCyZF0Z5WLRtsbOpDdQ/338e19fbc39e5b9a63b1db664c006e74/Art_Card__5_.png?w=3840&q=90&fm=webp
A coalition of maintainers, researchers, and security providers addressed critical vulnerabilities in PHP using AI capabilities. The response involved a proposed framework for responding to critical vulnerabilities in widely used software.

Google's Rust Style Guide

This style guide provides guidelines for using the Rust programming language at Google, aiming to achieve consistency and quality across codebases. The document covers various aspects of Rust coding, including API design, module organization, naming conventions, error handling, and more.

New plastic pollution discovered: 'Plasticorals' coral rubble fused with plastic

https://www.oist.jp/themes/custom/server_theme/dist/images/logo.svg
‘Plasticorals’, coral rubble fused with plastic, are long-lasting reminders of human activity and highlight a potential threat to critical marine environments.

Oregon lawmakers approve money to buy an iconic waterfall listed on Redfin

https://dims.apnews.com/dims4/default/ca8658c/2147483647/strip/true/crop/3658x2505+0+0/resize/599x410!/quality/90/?url=https%3A%2F%2Fassets.apnews.com%2F3b%2F64%2F9ef89769eeba8d9f367e9e5cc800%2Fff2566596d18409f9c347cb06245d1d2
Oregon has purchased Abiqua Falls, a 92-foot waterfall, for $2.1 million to protect and preserve it for future generations. The falls will be managed by the Oregon Parks and Recreation Department or another state agency after completing due diligence on environmental and archaeological information.

OpenAI models are coming to Google Cloud

https://images.ctfassets.net/kftzwdyauwt9/7zjGwFPBZMvK6zwFSMVWRm/6721ac33e5b1aaf88a9b705a3d10c90a/OAI_Oracle_Partnership_1x1_Art_Card.png?w=3840&q=90&fm=webp
OpenAI and Google Cloud are partnering to bring OpenAI's frontier models into Google Cloud's Model Garden, giving customers native access to these models for complex agentic workflows. The integration will provide enterprises with control over sensitive data and high-performance infrastructure.

PHP 8.2.35

https://opengraph.githubassets.com/2602a9a4a520163a27b3e1eb61fab07ee249811792054547aaa01eb213dcce20/php/php-src
The PHP development team has released PHP 8.2.35 to fix two critical security vulnerabilities, urging all users to update immediately as it's the last release before end of life on December 31, 2026.

A Place Among the Fiddlers

https://i0.wp.com/longreads.com/wp-content/uploads/2024/12/longreads-logo-sm-rgb.png?resize=512%2C512&ssl=1
A writer attended the Old Fiddler's Convention in Galax, Virginia, where he immersed himself in old-time music and met locals who shared their stories and traditions. He learned about the convention's history and its unique culture, which values community and participation over commercialism.

Using thousands of AI agents to uncover new leads in biological data

https://images.ctfassets.net/kftzwdyauwt9/5nGzHT5se0oEzcJbDGqwyz/5aafc7c71c35b11d713436e853f0b4b0/low-resource-programming-languages-cover.png?w=3840&q=90&fm=webp
Researchers from OpenAI, PerturbAI, and Scripps Research used thousands of AI agents to analyze data from millions of mouse brain cells in 32 minutes. The agents connected gene disruptions with scientific literature findings, uncovering unexpected biological connections that can help scientists understand disease and identify new treatments.

Potential third critical PHP CVE

https://cdn.masto.host/mwebtools/cache/media_attachments/files/117/479/570/140/387/323/small/095a1981c7cb6a12.png
Sign in to follow profiles or hashtags, favorite, share and reply to posts, or interact from your account on a different server. ok thinking more about this, there's no way this is the same vuln, this is another one. webtoo.ls webtoo.ls is a small server dedicated to Open Source tools in the Web ecosystem and their maintainers, collaborators, and close community members.

Canary Tokens

https://canarytokens.org/nest/assets/web-CYHNWdqG.png
Get an alert when an attacker visits your URL (then redirect them and collect more info). Get an alert when an attacker uses your Azure Service Principal certificate to login with. Get an alert when an attacker opens a fake app from your Identity Provider dashboard.

Drupal is now light-years ahead of its reputation

https://dri.es/files/cache/drupalcon-rotterdam-2026/driesnote-1280w.png
The author's DrupalCon Rotterdam keynote focused on closing the gap between Drupal's reputation and its capabilities, showcasing improvements in multilingual sites, JavaScript front-ends, headless Canvas, and AI.

9 Mothers (YC P26) Is Hiring in Austin, TX

https://storage.googleapis.com/ployai/dd1475f0-2410-4ca9-b24e-7883c3bddc93/user/570ba5d4-mounted-edda-stylized.png
The team ships hardware on software tempo, focusing on real deployment, short iteration loops, and hands-on ownership of specs. They prioritize user needs, iterating based on data and affordability, not just roadmaps.

The bridge to agent-scale Git infrastructure

https://github.blog/wp-content/uploads/2026/01/generic-mona-github.png?resize=1600%2C850
GitHub has migrated 99.99999% of its repositories to Azure, with the remaining ones held back by a 25ms round trip latency issue. The company is now working on a new storage architecture that minimizes coordination and decouples storage from compute, allowing for more efficient scaling and read traffic management.

Claude Duet

https://assets.claude.com/9273e22b909074c1c2d42ca3514a239623f8af40.svg
Claude Duet is a new app that helps professionals and small business owners prioritize tasks, complete tasks automatically, and stay organized. It uses AI to make decisions on what needs attention and when to check with users first.

Your MCU likely escaped the eMudhra intermediate CA compromise

https://danielmangum.com/images/twitter-card.png
A software engineer should update IoT devices with MCU capabilities that use public key infrastructure, as an eMudhra CA compromise allows for MITM attacks on unpatched devices. Most MCU-based systems are not impacted due to resource constraints and the need for a specific trust chain.

Way to Play Super Mario 64: On Apple Vision Pro

https://www.pagetable.com/docs/diorama64/around.jpg
Super Mario 64 is recreated as a living diorama on Apple Vision Pro, allowing players to walk around and interact with the game world in real space. Nintendo responded to similar technology by issuing DMCA takedowns and a lawsuit against Yuzu for its Super Mario 64 port.

Launch HN: Alter (YC S25) – Access control for multi-user agents

https://alterauth.com/logos/alter-logo-dark.svg
Combinator's agent-based system controls user actions, enforces policies and keeps credentials private. It integrates with 140 providers through a single SDK call, offering compliance and audit features.