最新のセキュリティ情報
10月21日(水)昨日
Critical PHP Security Release
The PHP project has announced a security release that fixes two critical security vulnerabilities discovered in PHP. Due to the critical severity of the issues, site owners are encouraged to immediately update their installations of PHP. Your web host may already be working to update PHP and put web application firewall (WAF) rules in place […]
PHP critical vulnerability response updates
At 13:40 UTC two critical security vulnerabilities were disclosed and patched in PHP. These are extremely serious vulnerabilities affecting every PHP application on the web. Action may be required, read below.
Security advisory: Critical remote code execution vulnerabilities, update now
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs. Who is at risk: The vulnerabilities: , CVE-2026-109618 (): out-of-memory handling can interrupt PHP while internal request data is onl…
PHP 8.5.12 Released!
The PHP development team announces the immediate availability of PHP 8.5.12. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.5 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.5.12 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.4.27 Released!
The PHP development team announces the immediate availability of PHP 8.4.27. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.4 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.4.27 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.3.36 Released!
The PHP development team announces the immediate availability of PHP 8.3.36. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.3 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.3.36 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.2.35 Released!
The PHP development team announces the immediate availability of PHP 8.2.35. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.2 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory PHP 8.2 reaches end of life on 31 December 2026 and will receive no further security fixes after that date. Please plan your upgrade to a supported version. For source downloads of PHP 8.2.35 pleas…
Upcoming Critical PHP Security Release
The PHP security team would like to give advance notice of an . upcoming security release It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available. We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild. Full details, affected versions, and the fixed versions will be published with the release. Thank you for helping us keep…
10月14日(水)
KotlinConf Recap: Lessons from Verifone’s Architect on Kotlin in Mission-Critical Payments
This article was written by an external contributor. Yuri Geronimus’s four-year-old son once asked him what his job was. Yuri told him he writes books: books that describe what he wants to change in the physical world. His son didn’t fully get it. Neither would most engineers: if you understand the words in your application […]
10月9日(金)
Upcoming Next.js Security Update for Upstream Vulnerabilities
Next.js plans to publish an out-of-band security update next Wednesday, October 14, 2026, addressing two Critical and one High severity vulnerabilities in upstream dependencies.
9月23日(水)
Next.js Security Update for a Critical Upstream Issue
The September 22, 2026 out-of-band security update for Next.js is now available
Upcoming Next.js Security Update for a Critical Upstream Issue
Next.js 16.3.6 and 15.5.26 are planned for a critical out-of-band security update on September 22, 2026.
9月22日(火)
WordPress 7.1.2 Release
This security release features a fix for a critical severity security vulnerability. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.2 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, […]
9月16日(水)
Kubernetes v1.37: Pod-Level Resource Managers graduated to Beta
With the release of Kubernetes v1.37, the Pod-Level Resource Managers feature has graduated to Beta status (disabled by default)! First introduced as an Alpha feature in Kubernetes v1.36 , this enhancement builds on Pod-Level Resources by equipping Kubelet's Topology Manager, CPU Manager, and Memory Manager to use Pod-level resource declarations ( .spec.resources ) directly when making hardware placement decisions. Bringing pod-level resources to node managers Before this feature, obtaining exclusive NUMA-aligned CPU cores or memory for latency-critical applications forced cluster operators i…
7月18日(土)
WordPress 7.0.2 Release
WordPress 7.0.2 is now available. The 7.0.2 security release addresses one critical and one high severity security issue. Because this is a security release, it is recommended that you update your sites immediately. Due to the severity, the WordPress.org team have enabled forced updates via the auto-update system for sites running affected versions. To manually […]
5月16日(土)
Kubernetes v1.36: Mixed Version Proxy Graduates to Beta
Back in Kubernetes 1.28, we introduced the Mixed Version Proxy (MVP) as an Alpha feature (under the feature gate UnknownVersionInteroperabilityProxy ) in a previous blog post . The goal was simple but critical: make cluster upgrades safer by ensuring that requests for resources not yet known to an older API server are correctly routed to a newer peer API server, instead of returning an incorrect 404 Not Found . We are excited to announce that the Mixed Version Proxy is moving to Beta in Kubernetes 1.36 and will be enabled by default! The feature has evolved significantly since its initial rel…
5月8日(金)
Kubernetes v1.36: More Drivers, New Features, and the Next Era of DRA
Dynamic Resource Allocation (DRA) has fundamentally changed how platform administrators handle hardware accelerators and specialized resources in Kubernetes. In the v1.36 release, DRA continues to mature, bringing a wave of feature graduations, critical usability improvements, and new capabilities that extend the flexibility of DRA to native resources like memory and CPU, and support for ResourceClaims in PodGroups. Driver availability continues to expand. Beyond specialized compute accelerators, the ecosystem includes support for networking and other hardware types, reflecting a move toward…
5月2日(土)
Kubernetes v1.36: Pod-Level Resource Managers (Alpha)
Kubernetes v1.36 introduces Pod-Level Resource Managers as an alpha feature, bringing a more flexible and powerful resource management model to performance-sensitive workloads. This enhancement extends the kubelet's Topology, CPU, and Memory Managers to support pod-level resource specifications ( .spec.resources ), evolving them from a strictly per-container allocation model to a pod-centric one. Why do we need pod-level resource managers? When running performance-critical workloads such as machine learning (ML) training, high-frequency trading applications, or low-latency databases, you ofte…
4月14日(火)
How I Built an AI-Powered CRM with Laravel in a Week
How a senior freelance developer built a full Laravel MVP in under a week using Laravel Herd, Cloud, and the AI SDK to automate critical workflows.
12月12日(金)
React / Next.js Denial-of-Service Vulnerability: Deno Deploy users protected
A high severity Denial-of-Service (DoS) vulnerability has been found in React Server Components and Next.js. Deno has implemented mitigations in Deno Deploy. Immediate upgrades are required for other users.
12月11日(木)
Denial of Service and Source Code Exposure in React Server Components
Security researchers have found and disclosed two additional vulnerabilities in React Server Components while attempting to exploit the patches in last week’s critical vulnerability. High vulnerability Denial of Service (CVE-2025-55184), and medium vulnerability Source Code Exposure (CVE-2025-55183)
12月4日(木)
Security Advisory: CVE-2025-66478
A critical vulnerability (CVE-2025-66478) has been identified in the React Server Components protocol. Users should upgrade to patched versions immediately.
React Server Functions / Next.js Vulnerability: Deno Deploy users protected
A critical Remote Code Execution (RCE) vulnerability has been found in React Server Functions and Next.js. Deno has implemented mitigations in Deno Deploy. Immediate upgrades are required for other users.
12月3日(水)
Critical Security Vulnerability in React Server Components
There is an unauthenticated remote code execution vulnerability in React Server Components. A fix has been published in versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.
5月2日(金)
How Plaid migrated 100 services to a new database platform 5x faster with Deno
Learn how Plaid used Deno to minimize downtime and improve cutover speed during a critical infrastructure migration.
4月10日(木)
PHP Core Undergoes Security Audit – Results Now Available
A focused security audit of the PHP source code () was recently completed, commissioned by the , organized by in partnership with , and performed by . The audit targeted the most critical parts of the codebase, leading to 27 findings, 17 with security implications, including four CVEs. php/php-src Sovereign Tech Agency The PHP Foundation OSTIF Quarkslab All issues have been addressed by the PHP development team. Users are encouraged to upgrade to the latest PHP versions to benefit from these security improvements. Read the full . More details in . audit report the PHP Foundation blog post If…
2月8日(土)
How Deno's documentation is evolving
Documentation is a critical part of developer experience. Here's how we're improving our documentation and what's to come.
7月26日(金)
Benchmarking AWS Lambda Cold Starts Across JavaScript Runtimes
When running production JavaScript in the cloud, performance is a critical consideration. Here’s how Deno’s cold start times compare against other JavaScript runtimes on AWS Lambda.
5月11日(土)
How to document your JavaScript package
Writing good JSDocs for your JavaScript package is critical to its success. Here are some best practices for creating docs that helps your users be successful.
7月26日(水)
How the creator of Homebrew simplifies distributing software with tea and Deno
Deno is a critical part of distributing our own software and also helping our users manage their dependencies.
5月23日(火)
Dutch PHP Conference 2023 - Call for Papers
We are back for the of the ! We hope you will join us on for the . 🐘🎉 17th edition Dutch PHP Conference October 13, 2023 online conference We’re also looking for high-quality, technical and non-technical sessions from speakers who can cover advanced topics and keep our audience inspired. We’ve had great speakers presenting talks about the PHP ecosystem, frameworks, DevOps, architecture, JavaScript, scaling, testing, performance, security and more. And we would like to advance on these very topics for this year’s conference as well. But we also would like to invite speakers to talk about non…
4月29日(日)
ZendCon & OpenEnterprise 2018 - Call for Speakers
for is now open! The Call For Papers ZendCon & OpenEnterprise 2018 ZendCon & OpenEnterprise is the premier open source conference designed to teach and share practical experiences from the front lines of business critical and enterprise environments, giving you the opportunity to speak in front of technical business leaders, strategists, and developers seeking the best knowledge around the operational advantages of open source. This is your chance to tell everyone what you’ve learned and enrich our community of enterprise technology practitioners. is open until May 25, 2018. The CFP
1月4日(木)
PHP 7.0.27 Released
The PHP development team announces the immediate availability of PHP 7.0.27. This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version. This release marks the end of the two years active support period for the 7.0 branch. The further releases of the 7.0 branch will be issued on demand and contain only critical security relevant bug fixes. The security support is provided till December 3rd, 2018. It is a good time to plan the migration to PHP 7.1 or 7.2. For source downloads of PHP 7.0.27 please visit our , Windows…
4月14日(金)
Dutch PHP Conference 2017
We are glad to announce that we’ll be organizing the 11th edition of the Dutch PHP Conference, which will be held in Amsterdam from June 29th to July 1st 2017. Thursday 29th will be the tutorial day and June 30th and July 1st will be the main conference days. DPC brings together the best speakers and PHP, Javascript and front-end talent from Europe and beyond for three days of high-level technical sessions. Our is already online and features a variety of talks on PHP, DevOps, Security & privacy, microservices, JavaScript, databases and much more; so come along to our two main conference days…
3月15日(火)
PHPTour 2016
After Nantes, Lille, Lyon,and Luxembourg-City, this year the PHP Tour, the itinerant conference organized by the French PHP users group, goes to Clermont-Ferrand, a lovely city surrounded by volcanoes. Helped by Clermont'ech, a local developers organization, AFUP is happy to welcome you on May 23rd and 24th at the Polydome convention centre. This year, part of the program will focus on performance. "The big don't eat the little, the fast eat the slow" (Eberhard von Kuenheim, BMW) With more and more business-critical applications, performance becomes decisive. HHVM and PHP 7 make PHP better th…