Urgent.News

What's breaking now, across thousands of outlets.

More in Tech

Always Set persist-credentials: false in actions/checkout

There's a default in actions/checkout\ that most teams never change — and that quietly leaves a GitHub token sitting in a readable file for every subsequent step in the job. The fix is one line.

  • Set persist-credentials to false in actions/checkout
  • Default action writes git credential config file
  • Deleting file after checkout prevents security risk

PHP2Shell: a practical patch and check guide for PHP servers

What happened PHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619. On October 21, 2026, the PHP project shipped emergency releases, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, to fix two…

  • PHP2Shell vulnerabilities discovered on October 21, 2026
  • CVE-2026-109618 and CVE-2026-109619 allow remote code execution
  • PHP urges immediate patching of all PHP installations

More from Friday 30 October →