PHP warns it plans to release 2 emergency patches imminently

Ars TechnicaOct 21, 2026Oct 20, 2026, 10:12 PM AST

PHP is the scripting language that builds pages for many of the web's sites and apps, so a flaw in it can be reached through WordPress, Drupal or Joomla. Maintainers plan emergency fixes for two bugs rated 9.2 out of 10, after an unconfirmed report of a tool that runs code on servers running PHP 5 or newer. Security firms expect mass attacks soon after the patches land.

Summary written with AI by HowTechMoves, based on reporting by Ars Technica.

All tech news

Cybersecurity
Ars TechnicaOct 20, 2026
The Internet goes on high alert after discovery of 8 compromised TLS certs
TLS certificates prove a site is genuine, and an intermediate certificate can sign new ones that browsers trust. Eight of India's eMudhra intermediate certificates had private keys with only 3 to 8 bits of entropy instead of hundreds, so anyone could guess them and vouch for any site. Browsers blocked all eight, but Linux systems and IoT gear still need updates.
Read original at Ars Technica (opens in a new tab)
Cybersecurity
TechCrunchOct 20, 2026
ChatGPT now lets you lock your chats
Locking a ChatGPT conversation moves it into a separate section that needs a four-digit PIN, Face ID or Touch ID, and it keeps its own memory, so details from it do not flow into normal chats. OpenAI says the point is privacy from people holding your phone, not storage: locked chats are not end-to-end encrypted and retention rules do not change.
Read original at TechCrunch (opens in a new tab)
Cybersecurity
Ars TechnicaOct 19, 2026
PSA: Patch your Plex media server before someone hacks it
A researcher chained four recently fixed Plex Media Server bugs into an exploit that can run commands on an unpatched machine. The chain uses an unauthenticated request, a loopback pivot, stolen security tokens and a delivered payload, and a honeypot saw attacks within a day installing a cryptominer and proxy software. Plex users should update to version 1.43.3.
Read original at Ars Technica (opens in a new tab)
Cybersecurity
The VergeOct 19, 2026
A hacker broke into John Deere and SharkNinja with an army of AI agents
AI agents can be given a goal and left to work through the steps alone, logging progress as they go. Security firm Norforge found more than 20 exposed instances of Cairn, an open-source problem-solving engine, including one attacker who used it to break into over 100 sites, about 23 hours per breach. Victims reportedly include John Deere, SharkNinja and Cummins.
Read original at The Verge (opens in a new tab)

Related stories