patch

黑客在 PHP 两个严重漏洞（CVE-2026-109618、CVE-2026-109619）正式补丁发布前几天就已尝试利用，据 Amazon Threat Intelligence 报告，其蜜罐系统在 10 月 17 日即检测到 PHP2Shell 攻击活动。PHP Foundation 承认修复因兼容性问题被拖延，并表示将加快未来漏洞的处理流程。

AI tools from OpenAI and Google's Wiz uncovered two critical vulnerabilities in PHP affecting roughly 70% of websites, prompting emergency patches and widespread site shutdowns including parts of Wikipedia and over 200 Japanese organizations.

PHP 8.x 全系发布紧急安全更新，修复两个远程代码执行漏洞；因协调披露流程泄露导致 PoC 提前扩散，PHP Foundation 与 Wiz 公布了完整披露时间线。

PHP 项目发布 8.5.12、8.4.27、8.3.36 和 8.2.35 安全版本，修复了两个可导致未认证远程代码执行的严重漏洞，并介绍了 PHP 安全流程的改进。

Two critical PHP zero-day vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PHP 5.4 and later are being exploited in the wild, prompting an emergency PHP release and outages across countless sites, with OpenAI and Wiz involved in the research and disclosure.

GitLab警示一个最大严重级别的CI/CD正则表达式编译器整数溢出漏洞（CVE-2026-97229），可让远程未认证攻击者在服务器上执行任意代码，官方已发布补丁并敦促自托管用户立即升级。

Meta patched a zero-day exploit in its Muse macOS AI agent that could allow attackers to control the agent by redirecting transcription processing, highlighting security challenges for the new product.

Researchers disclosed Zoom vulnerabilities that could let attackers take over devices via screen-sharing annotation, discovered using AI models in under 20 prompts. Zoom has released patches.

A GitHub patch allows running DeepSeek V4 Flash in LM Studio on 128GB Macs by sideloading antirez's llama.cpp fork, working around struct-layout drift, decoding splits, and code-signing issues.

A new AMD Linux kernel patch improves low-end gaming performance on Steam Deck by monitoring core workloads and temporarily setting busy cores to performance mode, resulting in up to 31.8% improvement in 1% low FPS in Civilization VI.

Apple released macOS Tahoe 26.6 with security fixes addressing multiple vulnerabilities including buffer overflows, authorization issues, sandbox escapes, and kernel memory corruption.

A Windows 0-day vulnerability called LegacyHive allows non-admin users to escalate privileges by abusing how Windows loads user class hives, with Microsoft investigating and detection scripts available.

Microsoft patched a zero-day vulnerability in Windows Defender (CVE-2026-50656) but the patch may cause disk space exhaustion due to a new bug that allows writing unlimited file sizes.

Describes a patch for llama.cpp that adds CUDA support for DeepSeek V4 Flash's context indexing, enabling full 1M token context on an RTX 5090 with significantly reduced VRAM usage and high throughput.

The article requests testers for the Canvas patch for GNU Emacs, providing building instructions for MS Windows and a test code snippet.

Apple has patched a high-severity eavesdropping vulnerability in Beats Studio Buds, tracked as CVE-2025-20701, which could allow attackers to listen in on audio. The flaw was discovered by security firm Sentinel One and is part of broader Bluetooth vulnerabilities.

Microsoft fixed a 0-day vulnerability disclosed by researcher Nightmare Eclipse amid a heated rivalry, alongside other vulnerabilities like MiniPlasma, YellowKey, and others. The researcher published exploit code for a new Windows Defender vulnerability.

NASA's Artemis II crew, the fastest humans alive, earned a Mach 39 patch after reaching 24,664 mph on their lunar flyby.

A developer describes patching the i3 window manager to pass key events to Emacs when focused, enabling shared keybindings between i3 and Emacs.

A patch for Firefox to work around a crash on Intel Raptor Lake CPUs, authored by glandium.