Urgent.News

What's breaking now, across thousands of outlets.

Friday, 30 October 2026 Reading Room

More in Tech

PHP2Shell: a practical patch and check guide for PHP servers

What happened PHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619. On October 21, 2026, the PHP project shipped emergency releases, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, to fix two…

  • PHP2Shell vulnerabilities discovered on October 21, 2026
  • CVE-2026-109618 and CVE-2026-109619 allow remote code execution
  • PHP urges immediate patching of all PHP installations

·dev.to

PHANTOM.EXE 👻 — The Spirit in the Machine

PHANTOM.EXE 👻 — The Spirit in the Machine Somewhere between the last line of code and the darkness behind the screen, something is waiting to answer.

  • PHANTOM.EXE is a haunted-terminal experience for Hacktoberfest AI Challenge
  • Retro-inspired terminal with atmospheric visual effects and spooky theme
  • Accessible via browser, uses HTML, CSS, JavaScript, and optional AI integration

·dev.to

LiteLLM 1.107.0 compromise: incident response guide

What happened The LiteLLM 1.107.0 compromise began on October 21, 2026, when a compromised litellm==1.107.0 was published to PyPI and to LiteLLM's container registries.

  • Compromised LiteLLM 1.107.0 released on PyPI and container registries
  • Attack chain lasted two hours, potentially accessing sensitive data
  • Response includes identifying and isolating affected packages

·dev.to

Always Set persist-credentials: false in actions/checkout

There's a default in actions/checkout\ that most teams never change — and that quietly leaves a GitHub token sitting in a readable file for every subsequent step in the job. The fix is one line.

  • Set persist-credentials to false in actions/checkout
  • Default action writes git credential config file
  • Deleting file after checkout prevents security risk

·dev.to

More from Friday 30 October →