Tootfinder

Still in the mood for another round of patching?
After patching NGINX, PHP, and node.js it is urgent that you update your #Sylius shop immediately, following the recent security releases: https://

Security release: Sylius 1.14.21, 2.1.17, 2.2.12 and 2.3.2 | Sylius

Noch ein paar der zuletzt hier besonders häufig geteilten #News:
php2shell: Kritische Sicherheitslücken erlauben Codeeinschleusung in PHP

php2shell: Kritische Sicherheitslücken erlauben Codeeinschleusung in PHP
Zwei Fehler machen Webserver mit PHP aus dem Netz angreifbar. Betroffen: Versionen der letzten 20 Jahre, Admins sollten patchen.

If you think you can relax from patching after a hard day's work of slashing 4 (#eMudhra) and fixing the Web (#PHP2Shell): If you are self-hosting #GitLab, the day isn't over yet.
https://th…

Gratitude and #HugOps to the folk dealing with servers, certificates and whatever else urgently needs patching this week

After patching #PHP yesterday, you need to patch your #Node instances as well...
https://nodejs.org/en/blog/vulnerabil…

Node.js — Wednesday, October 21, 2026 Security Releases
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

Before you leave for the weekend after this seriously intense cyber week, check out today's Metacurity for the most important infosec developments you should know, including
--Banks scramble to keep uncontrolled AI agents out of customer accounts,
--eMudhra quits cert business after browsers pull trust,
--PHP flaws spark alarm but little confirmed damage,
--PHP crisis blacks out SoftBank disaster alerts as Japan plans AI cyber team,
--Capcom breach exposes 11.7m customer email records,
--Quest Diagnostics breach puts patient records at risk,
--FCC blocks two devices with Huawei surveillance chips,
--Researchers find gaps in OpenAI’s agent monitoring,
--Suspected DDoS attack knocks North Korean sites offline,
--Australia sanctions North Korean IT worker network,
--Russian hackers hide behind mesh network in Ukrainian grain attack,
--Critical Linux flaws go public before patches are ready,
--Anthropic says Claude proves crash protections across 123 libraries,
--Upwind rebuffs Datadog’s $4B acquisition offer,
--Volunteer PHP maintainer hailed as patching hero,
--Anthropic hands Agent Skills standard to AI foundation,
--AI bug hunting threatens more waves of disruption
https://www.metacurity.com/banks-scramble-to-keep-uncontrolled-ai-agents-out-of-customer-accounts/

OK, but hear me out: has anybody tried patching PHP by using “4” as the password?

And seeing all the reports from people waiting for their hosting providers to patch the servers their clients’ sites run on (myself included), and with all-inkl.com, the host I moved away from, still down, there’s also something to be said for taking care of some things yourself – and choosing your hosting provider carefully.
Still, hang in there, everyone patching things late into the night! 🫶

I rose early to get Metacurity out before 10 am ET, when, apparently, chaos could reign for PHP-enabled sites.
So don't miss today's issue for more on this crucial development and other critical infosec news you should know, including
--Weak eMudhra keys trigger massive internet security cleanup,
--Russian hackers breach NATO defense firms and police agency,
--Delivery robots face lawsuits over alleged biometric scans,
--State Bank of India breach exposes nearly 4k customer records,
--Hackers execute unauthorized trades at Japanese brokerage,
--Vendor breach puts 125k Japanese police records at risk,
--Malaysia bans Waze for civil servants over Israel ties,
--Friend says he urged teen to abandon alleged FBI hack,
--SafePay ransomware gang breaches at least 600 organizations,
--Zeabur to shut down after breach exposes 3.2m environment records,
--Save-On-Foods breach exposes loyalty customers’ personal data,
--AI agent joins researchers’ listserv and sparks privacy concerns,
--AI security jobs look familiar to cybersecurity veterans,
--Viral software clones threaten to spread AI slop,
--Democrats press tech giants over retreat from election safeguards,
--Musk ordered Starlink slowdown that rattled Ukraine,
--Hackers disrupt Russian school tests with anti-Putin message
https://www.metacurity.com/php-urges-immediate-patching-as-details-of-two-critical-flaws-reportedly-leak/

OK, but hear me out: has anybody tried patching PHP by using “4” as the password?