October 21 Security Roundup: PHP2Shell's Backstory, Java, HTTP/3, Node, Railway and OVH
How PHP2Shell went from a 2024 audit finding to an emergency patch, how to apply the fix correctly (PHP-FPM, Debian changelogs, EOL branches), plus Java CVE-2026-91403, the HTTP/3 QPACK flaw, Node.js security releases, the Railway environment variable incident and the OVHcloud CLI supply-chain attack.
10 min read · #security #php #java #nodejs #cveTwo Critical RCEs in PHP: CVE-2026-109618 and CVE-2026-109619
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two vulnerabilities that can allow unauthenticated remote code execution. How they work, who is at risk, how to check your server, and the official mitigations until you can update.
11 min read · #php #security #server #cveI Wrote a Doctor for My Docker
I used Docker every day but had no idea what was inside it. DoctorDock scans your local Docker for security problems, misconfigurations, and reclaimable disk in under a second — entirely offline.
5 min read · #docker #open source #security
