Tootfinder

Still in the mood for another round of patching?
After patching NGINX, PHP, and node.js it is urgent that you update your #Sylius shop immediately, following the recent security releases: https://

Security release: Sylius 1.14.21, 2.1.17, 2.2.12 and 2.3.2 | Sylius

Noch ein paar der zuletzt hier besonders häufig geteilten #News:
php2shell: Kritische Sicherheitslücken erlauben Codeeinschleusung in PHP

php2shell: Kritische Sicherheitslücken erlauben Codeeinschleusung in PHP
Zwei Fehler machen Webserver mit PHP aus dem Netz angreifbar. Betroffen: Versionen der letzten 20 Jahre, Admins sollten patchen.

If you think you can relax from patching after a hard day's work of slashing 4 (#eMudhra) and fixing the Web (#PHP2Shell): If you are self-hosting #GitLab, the day isn't over yet.
https://th…

Gratitude and #HugOps to the folk dealing with servers, certificates and whatever else urgently needs patching this week

After patching #PHP yesterday, you need to patch your #Node instances as well...
https://nodejs.org/en/blog/vulnerabil…

Node.js — Wednesday, October 21, 2026 Security Releases
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

OK, but hear me out: has anybody tried patching PHP by using “4” as the password?

And seeing all the reports from people waiting for their hosting providers to patch the servers their clients’ sites run on (myself included), and with all-inkl.com, the host I moved away from, still down, there’s also something to be said for taking care of some things yourself – and choosing your hosting provider carefully.
Still, hang in there, everyone patching things late into the night! 🫶

Before you leave for the weekend after this seriously intense cyber week, check out today's Metacurity for the most important infosec developments you should know, including
--Banks scramble to keep uncontrolled AI agents out of customer accounts,
--eMudhra quits cert business after browsers pull trust,
--PHP flaws spark alarm but little confirmed damage,
--PHP crisis blacks out SoftBank disaster alerts as Japan plans AI cyber team,
--Capcom breach exposes 11.7m customer email records,
--Quest Diagnostics breach puts patient records at risk,
--FCC blocks two devices with Huawei surveillance chips,
--Researchers find gaps in OpenAI’s agent monitoring,
--Suspected DDoS attack knocks North Korean sites offline,
--Australia sanctions North Korean IT worker network,
--Russian hackers hide behind mesh network in Ukrainian grain attack,
--Critical Linux flaws go public before patches are ready,
--Anthropic says Claude proves crash protections across 123 libraries,
--Upwind rebuffs Datadog’s $4B acquisition offer,
--Volunteer PHP maintainer hailed as patching hero,
--Anthropic hands Agent Skills standard to AI foundation,
--AI bug hunting threatens more waves of disruption
https://www.metacurity.com/banks-scramble-to-keep-uncontrolled-ai-agents-out-of-customer-accounts/

OK, but hear me out: has anybody tried patching PHP by using “4” as the password?

And seeing all the reports from people waiting for their hosting providers to patch the servers their clients’ sites run on (myself included), and with all-inkl.com, the host I moved away from, still down, there’s also something to be said for taking care of some things yourself – and choosing your hosting provider carefully.
Still, hang in there, everyone patching things late into the night! 🫶