PHP attacks and emergency runtime fixes put web application security first

PHP exploitation attempts preceded critical patches, and the response took websites and public services offline. Security fixes also landed for Node.js and .NET, while a reported certificate-key compromise and confirmed data theft at PingCAP widened the week's exposure.

Key developments

PHP exploitation precedes patches

PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two vulnerabilities allowing unauthenticated remote code execution, with all installations serving web requests at risk and the highest reported risk affecting mod_php. Amazon recorded an exploitation attempt four days before the fixes shipped, and operators took websites and public services offline during the response.

Exposed PHP applications face attempted compromise as well as service disruption during remediation.

Oct 21–25 · LWN.net · InfoQ · The New Stack

Node.js fixes Brotli execution flaw

Node.js released 26.12.1 Current, 24.22.1 LTS and 22.23.4 LTS with fixes for multiple vulnerabilities, including a remote-code-execution bug affecting programs using Brotli compression.

Applications using Brotli have a code-execution risk addressed by these runtime updates.

Oct 21 · Node.js Blog · LWN.net · Node.js Blog

Certificate keys reportedly compromised

Mozilla received a report that private keys for eight eMudhra intermediate certificates were compromised. The keys could allow attackers to issue fraudulent HTTPS certificates and impersonate websites if they can intercept connections.

Intercepted HTTPS connections could expose users' traffic to reading or modification.

Oct 20 · LWN.net

PingCAP confirms data theft

PingCAP confirmed unauthorized access to internal systems and theft of source code and customer-related data. FulcrumSec claimed it stole 10.6 TB, including API keys, customer SQL statements, TiDB Cloud control-plane records and 413 private repositories; those details remain attacker claims.

The confirmed theft raises exposure concerns for TiDB Cloud customer data, while the claimed credential losses remain unverified.

Oct 25 · InfoQ

.NET ships emergency updates

.NET released October 2026 out-of-band security updates addressing vulnerabilities in its Brotli decoder and tarball ownership handling.

The updates address security exposure in .NET decompression and archive-handling paths.

Oct 25 · .NET Blog

Linux 7.3 reaches release

Linus Torvalds released Linux 7.3 after a nine-week development cycle. It is expected to become the next long-term-support kernel, but that status is not yet confirmed.

Systems seeking a long-lived kernel baseline now have a final release to evaluate.

Oct 19 · LWN.net · LWN.net

Public GitHub fetches may need authentication

GitHub said it may temporarily require authentication for some HTTPS clones and fetches of public repositories during unusual traffic to protect service availability.

Unauthenticated CI jobs and repository-fetching automation could stop working during affected periods.

Oct 19 · Archive: 2026 - GitHub Changelog

Package firewall enters preview

GitHub introduced a public preview of its package firewall, targeting malware attacks during package installation that can harvest credentials from CI/CD hosts and developer workstations.

The preview adds a defense at the point where malicious dependencies can reach build and developer credentials.

Oct 20 · Archive: 2026 - GitHub Changelog

Structured concurrency becomes final

JEP 543 finalizes structured concurrency in JDK 28 after seven preview rounds, with no API changes from JDK 27. JDK 27 users need only remove --enable-preview and recompile, while code targeting JDK 25 or 26 requires API adaptations.

Java developers gain a stable concurrency API with a simpler migration from the latest preview.

Oct 19 · InfoQ

Native PyTorch stack opens for TPUs

Google open-sourced TorchTPU at PyTorch Conference North America 2026, making its native PyTorch stack for Google TPUs available.

PyTorch developers gain another hardware path beyond Nvidia for their workloads.

Oct 22 · The New Stack

Also this week

Security tooling

• CodeQL detailed compatibility changes for macOS 27, Xcode 27 and Swift 6.4 as Apple removes Intel code from some system binaries and libraries used to trace builds. Archive: 2026 - GitHub Changelog

• Apache Camel resolved 38 CVEs. InfoQ

• Anthropic launched free, opt-in OSS Scanner reports generated by models including Claude Mythos, leaving maintainers to validate findings and proposed fixes that receive no human review. InfoQ

• GitHub extended public secret monitoring to a preview for data-residency enterprises and added validity checks, alert dismissals, timelines, filtering, API access and webhooks. Archive: 2026 - GitHub Changelog · Archive: 2026 - GitHub Changelog

• AWS made Continuum for code vulnerabilities generally available to find and validate repository bugs, claiming it fixes 89% of bugs. The New Stack

• Vercel gave Marketplace vendors until January 2027 to change credentials as it seeks to eliminate long-lived API keys, while developers also questioned Vercel's own deployment token. The New Stack

• GitHub CLI opened a public preview of expiring OAuth credentials with automatic refresh. Archive: 2026 - GitHub Changelog

• GitHub added a version_requirement field to dependency objects in Dependabot alerts REST API responses. Archive: 2026 - GitHub Changelog

Runtimes and frameworks

• NestJS 12 introduced ESM core packages, Standard Schema validation and an observability SDK, requiring Node.js 20.19+ or 22.12+ and offering CLI choices for CJS or ESM projects. InfoQ

• OpenBSD 8.0 added arm64 hibernation, a 512GB amd64 kernel virtual address space and qwx driver improvements for Qualcomm WiFi 6 devices. LWN.net

• Linux 7.2.12, 6.18.58, 6.12.114 and 6.6.160 shipped important fixes, with users advised to upgrade. LWN.net

• Cilium 1.20 expanded Kubernetes Gateway API support and eBPF extensibility, advanced sidecarless mutual TLS and eased netkit adoption across mixed-kernel fleets. InfoQ

• TornadoVM 7.0 brought automatic acceleration of Java programs on multicore CPUs and GPUs while supporting mainstream JDK distributions. InfoQ

• Linux 7.4 accumulated 6,753 non-merge changesets during its still-open merge window, including a merged 48-part series removing the superseded __get_user() and __put_user() primitives. LWN.net · LWN.net

• NgRx 22 added experimental resource extensions, dynamic deep signals for union types and ESLint v10 support, requiring Angular 22 and TypeScript 6.0. InfoQ

• Visual Studio Code released version 1.143.0. VS Code Releases

GitHub operations

• GitHub copied 99.99999% of its repositories to Azure and described per-reference quorums for moving the remainder and object storage that scales reads independently. The GitHub Blog

• GitHub made enterprise-level App installations generally available, expanding API support so Apps can replace classic personal access tokens in more automation. Archive: 2026 - GitHub Changelog

• GitHub disclosed that some Enterprise Managed User accounts deprovisioned through SCIM between June 1 and June 13, 2026, were incorrectly deleted rather than suspended and obfuscated. Archive: 2026 - GitHub Changelog

• Dependabot added support for npm 12, pnpm 11 and 12, and Bun 1.4. Archive: 2026 - GitHub Changelog

• GitHub added one-action conversion of all branch protection rules in a repository to rulesets. Archive: 2026 - GitHub Changelog

• GitHub added Actions blob storage endpoints to its meta API as part of capacity and reliability improvements. Archive: 2026 - GitHub Changelog

• GitHub's Copilot usage metrics API began capturing model usage from additional tools, including OpenCode. Archive: 2026 - GitHub Changelog

CI and infrastructure

• Buildkite added pipeline-scoped secrets, MCP troubleshooting tools, Linux arm64 support in its GitHub Actions compatibility layer and expanded OpenTelemetry data in Agent v4.1.0. InfoQ

• GitHub released Actions Runner Controller 0.15.0 with reliability, scalability and observability improvements for self-hosted runners on Kubernetes. InfoQ

• AWS introduced Lambda Web Functions for Node.js applications using frameworks such as Express and Hono, with concurrent requests and response streaming. InfoQ

• Cloudflare cut its internal load-balancing service's memory footprint by more than 100 TB through compacted pingora-ketama hash-ring entries and about 90% fewer hashes per backend. InfoQ

Open AI infrastructure

• DeepSeek open-sourced the inference engine used to serve its models in production. The New Stack

• OpenAI announced the donation of Open Responses, its common LLM API specification, to the Agentic AI Foundation. The New Stack

• Google released ML Drift, an Apache 2.0-licensed engine for on-device GPU inference supporting OpenGL ES, OpenCL, Metal and WebGPU. InfoQ

Coding agents

• Cloudflare began spearheading a Rust port of TypeScript written by agents for agents to reduce code-checking compute demands, saying it is not forking TypeScript. The New Stack

• Google made Data Agent Kit generally available with free MCP tools and 37 open-source skills connecting coding agents to more than fifteen Google Data Cloud services, using skill instructions and enforceable IAM deny policies as guardrails. InfoQ

• Harbor added Docker Sandboxes support so each agent evaluation task can run in its own microVM rather than sharing a container. InfoQ

• Vercel Labs open-sourced fx, an experimental pre-1.0 Zig coding agent usable as a CLI, script component or embedded library, including WebAssembly. InfoQ

• A Harvard study of 718 firms using Jellyfish analytics found that AI-driven increases in code volume did not produce corresponding increases in completed work, with downstream workload including review contributing to the gap. InfoQ

• JetBrains made Air Governance generally available to centralize AI agent, model and provider controls, spending limits and usage visibility. The JetBrains Blog

What to watch

• Watch the close of the Linux 7.4 merge window, which may be extended to three weeks, for the final set of incoming changes.

• Watch Marketplace vendors' credential changes ahead of Vercel's January 2027 deadline.

• Watch for confirmation of Linux 7.3's expected long-term-support status; the timing has not been announced.