Company & Industry Updates
Announcements, technology updates, and industry news from Private DevOps LTD.
Showing 1-30 of 82 news items
Page 1 of 3
PHP's New Session Flaw Is Rare, and One Setting Covers It
CVE-2026-115560 is a rare PHP session flaw with no patch yet. Turning off session upload progress covers it, and many servers already did that this week.
Read more about PHP's New Session Flaw Is Rare, and One Setting Covers ItPHP Patches Two Unauthenticated RCEs, Worst on mod_php
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619, two flaws that allow unauthenticated code execution, worst on mod_php. What changed, who is exposed, and what to do before the update lands.
Read more about PHP Patches Two Unauthenticated RCEs, Worst on mod_phpPHP Patches Two Critical Flaws on Wednesday. Prepare Today
The PHP security team will ship fixes for two critical vulnerabilities, both CVSS v4.0 9.2, on October 21 at 14:00 UTC. Details come with the release, so today is for finding every PHP you run and knowing where its update will come from.
Read more about PHP Patches Two Critical Flaws on Wednesday. Prepare TodayLeaked eMudhra CA Keys Mean Updates for Go, Python and Linux
The private keys of eight eMudhra intermediate CAs leaked. Chrome and Firefox blocked them within hours on October 17, but Go programs, Python's certifi and Linux CA bundles need updates of their own, and Node.js is still waiting on a fix.
Read more about Leaked eMudhra CA Keys Mean Updates for Go, Python and LinuxNode.js Security Fixes Land October 21. Plan the Update
Node.js will ship security releases for the 22.x, 24.x and 26.x lines on or shortly after October 21, with HIGH as the top severity on each. Nothing else is public yet, so the useful step this week is booking the time to roll the update out.
Read more about Node.js Security Fixes Land October 21. Plan the UpdateLet's Encrypt Moves to 64-Day Certificates in February
From February 10, 2027, Let's Encrypt issues 64-day certificates by default, and its staging environment already switched on October 14. Automated renewals keep working, but scripts with a hardcoded 60, 80 or 83 days need a look.
Read more about Let's Encrypt Moves to 64-Day Certificates in FebruaryAWS Lambda Can Now Answer HTTP Directly With Web Functions
AWS has added Lambda Web Functions, where your code runs its own HTTP server and one warm environment serves several requests at once. Only Node.js is supported for now, in five Regions, and existing functions are being renamed Event Functions.
Read more about AWS Lambda Can Now Answer HTTP Directly With Web FunctionsUbuntu 26.10 Removes SysV Init Script Support. Check Yours
Ubuntu 26.10 shipped on October 15 with systemd 261.3, which no longer runs old SysV init scripts. It also completes the move to Rust coreutils and changes several server defaults, so it is worth a read before the next LTS.
Read more about Ubuntu 26.10 Removes SysV Init Script Support. Check YoursMagento October Update Closes an Unauthenticated RCE
Adobe's October 13 bulletin APSB26-153 fixes 11 flaws in Adobe Commerce and Magento Open Source, led by a CVSS 10 template flaw that runs code without a login. Nothing is exploited yet, and Magento Open Source 2.4.6 gets no fix.
Read more about Magento October Update Closes an Unauthenticated RCECloudflare Workers on Your Own Servers, With Deno's Help
The Deno team, led by Node.js creator Ryan Dahl, is joining Cloudflare to make workerd, the open source Workers runtime, a supported way to run Workers and Durable Objects on your own servers. Deno Deploy users have six months to move.
Read more about Cloudflare Workers on Your Own Servers, With Deno's HelpPlanning a DigitalOcean Database? Read This Before Oct 15
From October 15, new DigitalOcean accounts can no longer create Standard Edition PostgreSQL or MySQL clusters above 4 GiB of RAM or with standby nodes, and from November 30 the same applies to every account. Existing clusters keep everything.
Read more about Planning a DigitalOcean Database? Read This Before Oct 15Hetzner Adds CPX02, a 1 GB Cloud Server for Small Sites
Hetzner added the CPX02 on October 6, a Regular Performance cloud server with 1 vCPU, 1 GB of RAM and 20 GB of NVMe for static sites, blogs and small single apps. On October 12 it was listed as currently unavailable, like the rest of the CPX line.
Read more about Hetzner Adds CPX02, a 1 GB Cloud Server for Small SitesGitHub Trains a Model to Catch Leaked Secrets
Since October 7, GitHub's AI-detected secret alerts run on a new model trained to spot credentials with no recognizable format, such as plain passwords in config files. It is included with Secret Protection and Advanced Security, and push protection is in preview.
Read more about GitHub Trains a Model to Catch Leaked SecretsOne Line in Laravel 13.35 Stops Duplicate Scheduled Jobs
Scale a Laravel app to three servers and every scheduled task can run three times, from the morning report to the billing run. Laravel 13.35, released October 6, 2026, adds one setting that keeps every task on a single server, plus gentler deploys for long jobs.
Read more about One Line in Laravel 13.35 Stops Duplicate Scheduled JobsThe DNS Root Key Changes on October 11. Is Your Server Ready?
On October 11, 2026 the DNS root starts signing with a new key-signing key, KSK-2024, for only the second time ever. Most sites need to do nothing. A server that validates DNSSEC through its own resolver must already trust the new key, and a one-minute check tells you.
Read more about The DNS Root Key Changes on October 11. Is Your Server Ready?WordPress 7.1.3 Fixes a Stored XSS in the Comments Screen
WordPress 7.1.3, released October 6, 2026, fixes seven security issues, among them a stored XSS on the Comments screen that a pending comment can trigger. Most sites update themselves, but sites that cannot write their own files need a manual update.
Read more about WordPress 7.1.3 Fixes a Stored XSS in the Comments ScreenNext.js 16.4 Shrinks the Turbopack Cache by Up to a Quarter
Next.js 16.4, released October 6, 2026, cuts the Turbopack disk cache by 20 to 25 percent, trims production bundles and ships React 19.3. It also makes Cache Components the default for new apps, ahead of Next.js 17 making it the default everywhere.
Read more about Next.js 16.4 Shrinks the Turbopack Cache by Up to a QuarterCloudflare Makes Threat Intelligence Free for Every Account
Cloudflare now gives every account Threat Signals, which turns a security RSS feed into tagged indicators, plus access to its Threat Events platform. The free tier covers one feed and 30 days of data, and turning indicators into WAF rules stays on enterprise plans.
Read more about Cloudflare Makes Threat Intelligence Free for Every AccountEmDash 1.0 Is Out. Should a WordPress Site Move to It?
Cloudflare released EmDash 1.0, an open source CMS on Astro that it calls a spiritual successor to WordPress, with plugins that run in a sandbox. It imports WordPress content but not themes or PHP plugins, so it suits some sites today and not others.
Read more about EmDash 1.0 Is Out. Should a WordPress Site Move to It?GitHub Retires SHA-1 SSH, and Old Git Clients Feel It First
GitHub will stop accepting SHA-1 RSA signatures and one old key exchange over SSH, with brownouts on November 4 and December 9. HTTPS remotes are untouched and any OpenSSH from the last ten years already copes. The risk sits in tools that carry their own SSH code.
Read more about GitHub Retires SHA-1 SSH, and Old Git Clients Feel It FirstNext.js 16.3.6 Patches an RCE in next/og ImageResponse
Next.js 16.3.6 fixes a critical remote code execution bug in next/og ImageResponse. One thing your OG routes do decides whether you were exposed, and two days after release npm audit still had no record of it.
Read more about Next.js 16.3.6 Patches an RCE in next/og ImageResponseGitLab Fixes Two 9.9 RCEs Any Signed-In User Can Trigger
GitLab 19.4.1, 19.3.3 and 19.2.7 fix eleven security issues. In the two rated 9.9, any signed-in user can run code on the server with a crafted regular expression in a CI/CD configuration. GitLab.com is already patched.
Read more about GitLab Fixes Two 9.9 RCEs Any Signed-In User Can TriggerHetzner IP Space Hijacked to Poison a Virtualizor Update
For 33 hours across 28 to 30 August, an unauthorized announcement diverted traffic bound for the Virtualizor update servers, and the attacker obtained a genuine TLS certificate for it. If you run Virtualizor, there is one file to check first.
Read more about Hetzner IP Space Hijacked to Poison a Virtualizor UpdateOVHcloud Prices Rise on 1 October, at Your Renewal Date
Headlines say 87 percent. OVHcloud's own tables say up to 158 on servers and 652 on memory. What rises, what does not, and why 1 October matters.
Read more about OVHcloud Prices Rise on 1 October, at Your Renewal DatecPanel and Plesk Both Patched a Root Escalation the Same Day
On August 27 both control panels shipped a fix for a customer account becoming root. They read as the same bug and they are not. One needs nothing but a normal hosting account, the other needs shell access and can be blocked without patching.
Read more about cPanel and Plesk Both Patched a Root Escalation the Same DayYour CI History Now Expires With Your Build Artifacts
From October 1, GitHub applies your Actions retention setting to checks, workflow runs and statuses, which used to survive 400 days regardless. Anyone who lowered that number to save on artifact storage just signed up to lose their build history at the same interval.
Read more about Your CI History Now Expires With Your Build ArtifactsGitHub Now Revokes Stolen Tokens Without Locking Out the Rest
GitHub's credential kill switch used to be all or nothing: containing one compromised token took every credential the user had. As of August 18 you can act on one type at a time, and organizations finally get the controls that were enterprise-only.
Read more about GitHub Now Revokes Stolen Tokens Without Locking Out the RestGitHub Now Migrates GitLab Repositories in One Command
GitHub Enterprise Importer now handles GitLab migrations self-service, no consulting engagement needed. Repositories, issues, merge requests and releases move with one CLI extension. Here is what comes across, what you rebuild, and how to size the work.
Read more about GitHub Now Migrates GitLab Repositories in One CommandThe New cPanel Critical Bug Needs a Valid Login and Still Outscores April's Unauthenticated Root Flaw
CVE-2026-58048, published July 31, 2026, is a 9.4 critical privilege escalation in cPanel and WHM: renaming a database fails to preserve SQL mode, so a customer's SQL executes in root context. It requires a valid cPanel account and the MySQL feature, which sounds reassuring until you compare the scores. April's unauthenticated authentication bypass rated 9.3. This one needs a login and rates 9.4, and the entire difference lives in the CVSS 4.0 subsequent-system metrics: the CNA scored this as breaking out of the account and taking the host with it. On a shared server that means any tenant, including one who paid for a month. Covers the exact first-fixed builds per release tier, the quieter companion CVE, and why automatic updates are the answer to a different question.
Read more about The New cPanel Critical Bug Needs a Valid Login and Still Outscores April's Unauthenticated Root FlawGitHub Ships Stacked Pull Requests and One Limitation Decides Whether Your Team Can Actually Use Them
On July 30, 2026 GitHub put stacked pull requests into public preview: an ordered chain of dependent PRs where each layer targets the one below, reviewed separately and merged bottom up, with the branches above rebasing themselves as lower ones land. It is the workflow Graphite built a business on, now native and free. The catch is in the docs rather than the announcement, and it rules the feature out for a whole class of work: all branches must live in the same repository, so cross-fork stacks are not supported at all.
Read more about GitHub Ships Stacked Pull Requests and One Limitation Decides Whether Your Team Can Actually Use Them