Vulnerabilities
We track 17 posts about Vulnerabilities from 10 engineering blogs. Most active: Cloudflare, Daniel Stenberg, Hostinger. Latest post: Oct 23, 2026.
Companies writing about Vulnerabilities
Recent posts
Volker Dusch on the PHP RCE Vulnerabilities and Disclosure (opens on the source site)
Laravel ·
Volker Dusch of the PHP Foundation explains how the two critical PHP RCE vulnerabilities were found, fixed, and disclosed, plus the leak and the broken embargo. The post Volker Dusch on the PHP RCE Vulnerabilities and Disclosure appeared first on Laravel News. Join the Laravel Newsletter to get Laravel articles like this directly in your inbox.
Security vulnerabilities across the internet: How Replit is protecting your business (opens on the source site)
Replit ·
The vulnerabilities disclosed this week affect software that much of the internet depends on. They create real risks for businesses and more work for the teams responsible for keeping their applications secure. As AI makes more vulnerabilities easy to find, those teams will face more pressure to respond. At Replit, the security of our customers and the software and businesses they are building is our top priority. We’re handling much of the work for them directly: patching infrastructure, updating language tooling, and blocking exploits. Helping you build software also means helping you keep…
7 new Node.js vulnerabilities, 0 things for you to do (opens on the source site)
On October 21, the Node.js project released security fixes for all supported versions (22, 24 and 26), covering 7 vulnerabilities, four of them rated high severity. We’re installi… The post 7 new Node.js vulnerabilities, 0 things for you to do appeared first on Hostinger Blog.
Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) (opens on the source site)
DigitalOcean is aware of two critical remote code execution (RCE) vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, publicly disclosed on October 21, 2026. Either allows an attacker to execute arbitrary code on a server running PHP, potentially resulting in full compromise of the affected system. Proof-of-concept exploit code is publicly available, and there are no complete mitigations except patching. Updating PHP to a patched version is the only safe path to protection. PHP powers a significant share of the web, including Cloudways by DigitalOcean, and technologies…
Hostinger deploys protections against php2shell PHP vulnerabilities (opens on the source site)
On October 21, the PHP project fixed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, now known as php2shell. Both are rated 9.2 out of 10 on the Common Vulnerab… The post Hostinger deploys protections against php2shell PHP vulnerabilities appeared first on Hostinger Blog.
Cloudflare deploys protections against php2shell vulnerability (opens on the source site)
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers.
PHP Security Releases Fix Two Critical RCE Vulnerabilities (opens on the source site)
Laravel ·
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix two critical vulnerabilities that allow unauthenticated remote code execution. Here's who's at risk and how to update. The post PHP Security Releases Fix Two Critical RCE Vulnerabilities appeared first on Laravel News. Join the Laravel Newsletter to get Laravel articles like this directly in your inbox.
Do minor curl vulnerabilities in the open (opens on the source site)
The curl project has decided to alter its vulnerability disclosure program procedure and starting October 26 2026, we insist that all vulnerability reports submitted to us that are deemed to be severity LOW or MEDIUM should instead be submitted as issues in our GitHub repository. Only vulnerabilities deemed to be HIGH or CRITICAL will be … Continue reading Do minor curl vulnerabilities in the open →
Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities (opens on the source site)
CVE-2026-88771 lets attackers run commands on NetScaler Gateway before anyone signs in. Patching takes time most teams don't have, so the sign-in decision has to move in front of the vulnerable code.
Can Agentic AI Find the Security Vulnerabilities Other Tests Miss? (opens on the source site)
Security teams are good at finding problems. The difficult part is finding the right problems across a growing codebase, a changing application and the connections between them. A scanner can flag a known pattern quickly. A skilled tester can follow a complicated line of enquiry. Neither has unlimited time, and there will always be a question nobody thought to ask. Could AI agents take on more of that investigative work? I think the answer is yes, provided we are precise about what “find” means. Agents can produce leads, test assumptions and uncover issues that established checks have missed.…
Twenty-two pending curl vulnerabilities (opens on the source site)
On October 14 2026 we will ship curl 8.23.0. The next iteration in the never-ending series of version bumps from the curl project. We always think of the next release as the best version we ever did – and this time is no exception. Decades of collected experiences and meticulous polishing has lead us to … Continue reading Twenty-two pending curl vulnerabilities →
Frontier models found the vulnerabilities. Only the attacker found the chains. (opens on the source site)
Snyk ·
Static analysis found the flaws, but only live attack testing proved how they could be chained into breaches. A comparison of Evo COS, Claude Security, and Claude Code Security.
How we found 24 Android vulnerabilities using our open source AI security agent (opens on the source site)
A look at the targeted AI taskflows behind these findings, the critical Android bugs they uncovered, and how to run the same open-source agent on your own app. The post How we found 24 Android vulnerabilities using our open source AI security agent appeared first on The GitHub Blog.
How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers (opens on the source site)
External security researchers at Accomplish identified a vulnerability in Cloudflare Containers that could expose residual disk data from previous workloads. We explain how the issue worked, how we investigated it, and the steps we took to remediate it.
Vercel applications are protected from Next.js August 2026 security vulnerabilities (opens on the source site)
Vercel ·
Copy link to headingSummary Two vulnerabilities affecting Next.js were disclosed in the August 2026 Security Release. Next.js applications hosted on Vercel are protected and require no customer action. Copy link to headingNext.js August 2026 vulnerabilities Next.js disclosed the following critical vulnerabilities: GHSA-2xp9-vwfh-vxw4 originates in the upstream libheif dependency and can lead to unauthenticated remote code execution when Image Optimization processes a crafted AVIF input. CVE-2026-75604 (GHSA-p293-qw3h-jr36) can lead to unauthenticated remote code execution on Windows-hosted…
A revisit of remote Spectre attacks on Cloudflare Workers (opens on the source site)
In 2024 and 2025, we reassessed remote Spectre attacks on our Workers infrastructure. We share details about the new attack primitives like Spectre gadgets, remote timers, achieving co-location and how new defenses further harden Cloudflare Workers.
Security Center 2.0: Act on vulnerabilities in bulk across all your apps (opens on the source site)
Replit ·
Replit is the most secure place to vibe code. Today, we're making it dramatically easier to use the Security Center to understand your security posture across all Replit projects in your business. We’re also making it possible to remediate urgent security holes, such as active critical vulnerabilities on multiple published projects, in seconds. You can reach the Security Center from the Replit Homepage, or your Settings. When you land there, the first thing we want to answer is simple: which of my projects are actually at risk right now? Start with what's urgent At the top of Security Center,…
Related topics
This page is generated automatically from the engineering blogs we follow. Every post links to its source, where it was published. See all sources.