最新のセキュリティ情報
10月22日(木)今日
Atarim joins MariaDB Foundation as a Silver sponsor
MariaDB Foundation is pleased to welcome Atarim as a Silver sponsor, strengthening the connection between MariaDB and the agencies and hosting providers shaping the web. Atarim is an AI web agency that plugs into existing web agencies and does the client work. Agencies point it at the sites they look after, and it designs, writes, […] Atarim joins MariaDB Foundation as a Silver sponsor appeared first on MariaDB.org
10月21日(水)昨日
Critical PHP Security Release
The PHP project has announced a security release that fixes two critical security vulnerabilities discovered in PHP. Due to the critical severity of the issues, site owners are encouraged to immediately update their installations of PHP. Your web host may already be working to update PHP and put web application firewall (WAF) rules in place […]
PHP critical vulnerability response updates
At 13:40 UTC two critical security vulnerabilities were disclosed and patched in PHP. These are extremely serious vulnerabilities affecting every PHP application on the web. Action may be required, read below.
Security advisory: Critical remote code execution vulnerabilities, update now
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs. Who is at risk: The vulnerabilities: , CVE-2026-109618 (): out-of-memory handling can interrupt PHP while internal request data is onl…
PHP 8.5.12 Released!
The PHP development team announces the immediate availability of PHP 8.5.12. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.5 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.5.12 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.4.27 Released!
The PHP development team announces the immediate availability of PHP 8.4.27. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.4 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.4.27 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.3.36 Released!
The PHP development team announces the immediate availability of PHP 8.3.36. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.3 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.3.36 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.2.35 Released!
The PHP development team announces the immediate availability of PHP 8.2.35. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.2 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory PHP 8.2 reaches end of life on 31 December 2026 and will receive no further security fixes after that date. Please plan your upgrade to a supported version. For source downloads of PHP 8.2.35 pleas…
Help set Go's priorities for next year
Share your experience with Go in the 2026 Go Developer Survey, open through November 3.
PHP 8.2.35 released!
There is a new PHP release in town!
PHP 8.3.36 released!
There is a new PHP release in town!
PHP 8.4.27 released!
There is a new PHP release in town!
PHP 8.5.12 released!
There is a new PHP release in town!
nginx-1.31.8 mainline version has been released.
2026-10-21 nginx-1.31.8 mainline version has been released.
Upcoming Critical PHP Security Release
The PHP security team would like to give advance notice of an . upcoming security release It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available. We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild. Full details, affected versions, and the fixed versions will be published with the release. Thank you for helping us keep…
10月20日(火)
Amazic joins MariaDB Foundation as a Silver Sponsor
MariaDB Foundation is pleased to welcome Amazic as a Silver Sponsor, adding a new supporter with strong connections across the software ecosystem. Amazic connects innovative software vendors with partners, developers and organisations looking to adopt modern technologies. Combining software distribution with technical enablement, training, content and community-focused events, Amazic helps bridge the gap between technology […] Amazic joins MariaDB Foundation as a Silver Sponsor appeared first on MariaDB.org
SLES 15.6 repositories are being retired
The SLES 15.6 repositories are being retired from the main PostgreSQL RPM repository, and are moved to the PostgreSQL ZYPP archive .General support for SUSE Linux Enterprise Server (SLES) 15 SP6 (15.6) ended on December 31, 2025 (by upstream). All PostgreSQL major versions that were built for these minor releases are available there, including PostgreSQL 18. If you are still on SLES 15.6 either update to a newer SP (SP7 at the time of this writing), or use the archive. The archived repositories section of the repository packages page generates the repository file and the install commands for…
RHEL 10.0 and 9.6 repositories are being retired
The RHEL 10.0 and RHEL 9.6 repositories are being retired from the main PostgreSQL RPM repository, and are moved to the PostgreSQL YUM archive . All PostgreSQL major versions that were built for these minor releases are available there, including PostgreSQL 18. The rolling EL-10 and EL-9 repository RPMs are not affected. If you are still on RHEL 10.0 or 9.6 (or on Rocky Linux / AlmaLinux 10.0 or 9.6), please either update to a newer minor release, or use the archive. The archived repositories section of the repository packages page generates the repository file and the install commands for ea…
FOSSASIA PGDay 2027: Bangkok, 9 March – CFP Open
We are happy to announce that FOSSASIA PGDay returns to Thailand on 9 March, 2027 , bringing the PostgreSQL community together at True Digital Park, Bangkok . Visit the PGDay website for more details. About Event FOSSASIA PGDay is an annual gathering for PostgreSQL users, developers, and enthusiasts, bringing together the community from across Asia and beyond. Co-located with the FOSSASIA Summit, the event provides a focused forum for sharing knowledge, practical experiences, and insights into PostgreSQL and its growing ecosystem. Previous editions have taken place in Singapore, Vietnam, Thai…
Announcing rustup 1.29.2
The rustup team is happy to announce the release of rustup version 1.29.2. Rustup is the recommended tool to install Rust , a programming language that empowers everyone to build reliable and efficient software. What's new in rustup 1.29.2 This is a small release which only updates the rustls-webpki and webpki-root-certs dependencies to address the problematic eMudhra intermediate certificates issue described in CVE-2026-111943 . See also RUSTSEC-2026-0382 . Further details are available in the changelog ! How to update If you have a previous version of rustup installed, getting the new one i…
Quarterly contributor outreach
Hi Django community, thank you all for continuing to contribute to Django. The Steering Council is reaching out to bring people's attention to a few areas. We have major features we'd like to test and review for 6.2 , smaller changes that could use attention and then various New Feature ideas we'd like community input on. Major features These PRs are things we'd like to refine, test and get merged in. We're looking for people to test the features themselves and review the PRs . Please see our guidelines on reviewing PRs . CompositeField (multi-column subqueries) (this only needs testing, not…
Get Your .NET MAUI App Ready for Xcode 27
Use an agent skill to prepare your existing .NET MAUI app for Xcode 27, with the scene lifecycle changes and manual migration steps explained. The post Get Your .NET MAUI App Ready for Xcode 27 appeared first on .NET Blog .
Bring Your Own Model to the GitHub Copilot SDK with C#
The GitHub Copilot SDK gives your application an agent runtime. BYOK lets you keep that runtime while sending model requests to your own Microsoft Foundry or Azure OpenAI deployment. Here is the complete C# setup. The post Bring Your Own Model to the GitHub Copilot SDK with C# appeared first on .NET Blog .
10月18日(日)
crecheck v6.0 has been released
Antananrivo, Madagascar - October 14, 2026 PostgreSQL credcheck extension The credcheck PostgreSQL extension provides few general credential checks, which will be evaluated during the user creation, during the password change and user renaming. By using this extension, we can define a set of rules: allow a specific set of credentials reject a certain type of credentials deny password that can be easily cracked enforce use of an expiration date with a minimum of day for a password define a password reuse policy define the number of authentication failure allowed before a user is banned define…
pgBackRest 2.60.0 Released
October 18, 2026 : The pgBackRest community is pleased to announce the release of pgBackRest 2.60.0, the latest version of the reliable, easy-to-use backup and restore solution that can seamlessly scale up to the largest databases and workloads. pgBackRest supports a robust set of features for managing your backup and recovery infrastructure, including: parallel backup/restore, full/differential/incremental backups, block incremental backup, multiple repositories, delta restore, parallel asynchronous archiving, malware/ransomware protection, per-file checksums, page checksums (when enabled) v…
FOSDEM PGDay 2027: two days of PostgreSQL, with calls for papers and sponsors now open!
Join us for FOSDEM PGDay 2027 on January 28 and 29 at the Brussels Marriott Hotel Grand Place . This year, we're expanding to two days, bringing you more PostgreSQL talks and more time to connect with fellow enthusiasts from around the world. Start your FOSDEM trip with dedicated PostgreSQL content, then enjoy the main FOSDEM event over the weekend! - New for 2027: sponsor the event - For the first time, we're offering sponsorship opportunities for FOSDEM PGDay! Our Platinum , Gold and Silver packages offer different ways to get involved. Platinum and Gold packages include an exhibition desk…
pg_utl_smtp v2.0 released
Antananarivo, Madagascar - October 06, 2026 PostgreSQL UTL_SMTP compatibility extension pg_utl_smtp is a PostgreSQL extension to create, manage and use Oracle-style UTL_SMTP package. The use and behavior is just like with the UTL_SMTP Oracle package. This work is released from the HexaRocket project. This extension allows email notifications to be sent from triggers or stored procedures. By integrating the extension directly into the database, you can trigger data-driven actions without waiting for application intervention. Examples include security alerts or notifications when certain minimu…
pg_hint_plan v1.9.0 Released
The pg_hint_plan development team is pleased to announce pg_hint_plan 1.9.0. This release of pg_hint_plan adds compatibility with PostgreSQL 19, and includes various improvements and bug fixes. For more details, see the release notes . This new major version includes support for path generation strategies (PGS). pg_hint_plan is a PostgreSQL extension that offers the possibility to tweak PostgreSQL execution plans using so-called "hints" in SQL comments. For more information, see the project page . The documentation of the project is published at this page , and is synced up automatically from…
10月17日(土)
MariaDB Foundation: Exploring TidesDB Performance with TAF
TidesDB now exists inside MariaDB as a pluggable storage engine. With the TideSQL plugin available, anyone can load TidesDB into a MariaDB server and begin experimenting with it. But having a plugin is only the first step — you still need a practical, reproducible way to run real workloads against it, that’s where TAF comes […] MariaDB Foundation: Exploring TidesDB Performance with TAF appeared first on MariaDB.org
Improving navigation experience in v0 with Next.js 16.4
How we used Partial Prefetching and a coding agent to improve navigation across v0 with Next.js 16.4.
10月16日(金)
Interactive refactoring in gopls
Introducing interactive refactoring in gopls and the LSP: a new capability that brings dynamic, multi-step refactorings into your favorite editor.
Faster blank? checks, safer SQLite rollbacks, and more!
Hi, it’s Vipul. Let’s explore this week’s changes in the Rails codebase.
Introducing dotnetup: A toolchain manager for .NET
Learn how the new dotnetup tool helps macOS and Linux developers install, manage, and update user-local .NET SDKs and runtimes. The post Introducing dotnetup: A toolchain manager for .NET appeared first on .NET Blog .
MariaDB Foundation Newsletter – 15 October 2026
The first half of October belonged to the ecosystem. The MariaDB Ecosystem Hub passed 200 entries six months after launch, Laravel 13 gained native MariaDB Vector support through community contributors, and Frappe and Solanica joined the Foundation as Silver Sponsors. The Foundation’s testing framework learned PostgreSQL, reproduced a regression reported by Mark Callaghan and confirmed […] MariaDB Foundation Newsletter – 15 October 2026 appeared first on MariaDB.org
Google Summer of Code 2026 With the Kotlin Foundation: Recap
Google Summer of Code 2026 has wrapped up! This was the Kotlin Foundation’s fourth year participating in GSoC, bringing new contributors into the Kotlin open-source ecosystem through hands-on projects and mentorship. This year, two projects successfully reached completion, tackling two areas of the ecosystem: improving recursion support in the Kotlin/Wasm backend and building a global […]
10月15日(木)
What Makes a Great KotlinConf Proposal?
The KotlinConf 2027 Call for Papers is now open! We invite developers from across the Kotlin community to bring their ideas, experiences, and expertise to the stage in Kraków. Do you have a Kotlin lesson or discovery that could help other developers? Perhaps you solved a difficult technical problem, introduced Kotlin into an existing codebase, […]
Solanica joins MariaDB Foundation as a Silver Sponsor
We are pleased to welcome Solanica, the company driving the development of OpenEverest, as a MariaDB Foundation Silver Sponsor. OpenEverest is an open-source platform for deploying and managing databases on Kubernetes. Its recently added MariaDB support gives developers and platform teams another way to bring MariaDB into their infrastructure, with deployment, high availability, backups and […] Solanica joins MariaDB Foundation as a Silver Sponsor appeared first on MariaDB.org
PostgreSQL 19 RC 1 Released!
The PostgreSQL Global Development Group announces that the first release candidate of PostgreSQL 19 is now available for download. As a release candidate, PostgreSQL 19 RC 1 will be mostly identical to the initial release of PostgreSQL 19, though some more fixes may be applied prior to the general availability of PostgreSQL 19. The next scheduled update release for supported versions of PostgreSQL, on November 12, 2026, will include a large number of fixes. Because of this, the release team decided to include these fixes in PostgreSQL 19 before its general availability. This means a second re…
Announcing Rust 1.99.1
The Rust team has published a new point release of Rust, 1.99.1. Rust is a programming language that is empowering everyone to build reliable and efficient software. If you have a previous version of Rust installed via rustup, getting Rust 1.99.1 is as easy as: rustup update stable If you don't have it already, you can get rustup from the appropriate page on our website. What's in 1.99.1 Rust 1.99.1 fixes the following regressions from prior releases: Missing symbol wcslen : Some Rust targets were getting link errors for missing wcslen , and that function is now present in Rust's compiler-bui…
Add email to any Laravel Cloud environment with the Resend
Resend is now a first-party Laravel Cloud integration. Connect once, verify a domain, and attach email to an environment like any other resource.
MariaDB Foundation: Reproducing and Validating MDEV‑37992 with TAF
Thanks to Mark Callaghan for filing MDEV‑37992. This regression only appears under specific LRU and buffer‑pool conditions, and requires a memory‑resident workload to expose. Using TAF, I reproduced the issue across 11.8, 12.3, and 13.1 using both parent commits and patched commits from MDEV‑33966. The fix restores expected throughput in all branches. The workload used […] MariaDB Foundation: Reproducing and Validating MDEV‑37992 with TAF appeared first on MariaDB.org
Why Is My Kubernetes Job Still Pending? Tracing Kueue Admission with Headlamp
You submit a Kubernetes Job and wait for its Pods to appear. A minute passes. Then another. The Job is still suspended, there are no application logs, and there may not even be a Pod to inspect. In a cluster managed by Kueue , this can be completely normal. Kueue may still be deciding whether the Job can use the requested resources. The useful question is not only “Why is the Pod pending?” It is first “Has Kueue admitted the Workload?” The Kueue plugin for Headlamp brings that investigation into the Headlamp UI. Instead of reconstructing the admission path from several commands and large YAML…
r9.0.4
r9.0.4
Next.js Security Update for Upstream Vulnerabilities
The October 14, 2026 out-of-band security update for Next.js is now available
r9.0.2
r9.0.2