The Dev Dispatch — PHP, AI & dev news, four languages, one press

PHP · Security

PHP emergency fixes target two critical RCE flaws

On October 21, 2026, PHP released emergency fixes for CVE-2026–109618 and CVE-2026–109619, two critical unauthenticated remote-code-execution flaws rated 9.2 by CVSS v4.0. Fixed branches are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. WordPress updates do not repair PHP, so site operators must patch and restart the PHP service.

Medium · PHP · Oct 22, 2026 curated by Georg

→ continued: summary & source

PHP · Security

FrankenPHP 1.13.2 closes PHP2Shell exposure

FrankenPHP 1.13.2, released on 21 October, is a security update for the PHP application server. Its Docker images and static binaries include PHP versions that address PHP2Shell, two critical flaws enabling unauthenticat…

FrankenPHP Releases · Oct 22, 2026 curated by Georg

PHP · Security

Dutch NCSC takes website offline over PHP flaws

The Dutch National Cyber Security Centre (NCSC) has taken NCSC.NL offline as a precaution, citing vulnerabilities in PHP. The agency says PHP’s security team expects to publish a patch at 16:00 Dutch time and plans an ad…

Hacker News (PHP, ≥15 P.) · Oct 21, 2026 curated by Sönke

PHP · Ecosystem

frameworks, tooling & runtime all articles →

PHP · Security

Report points to an unpatched PHP double-free issue

An October 21 post describes a reportedly separate PHP vulnerability that produces an AddressSanitizer double-free error in PHP 8.4.25. The author says the behavior was confirmed on PHP 8.5.10 and sti…

Hacker News (PHP, ≥15 P.) · Oct 21, 2026 curated by Sönke

PHP · Security

CloudLinux PHP patch rollout puts timing under scrutiny

A post on r/PHP asks why CloudLinux is listing patches for PHP 7.4 and 8.0 before updates for 8.2 through 8.5. The discussion concerns CVE-2026-109618 and CVE-2026-109619. The author says official PHP…

r/PHP (Top) · Oct 21, 2026 curated by Sönke

PHP · Releases

PHP publishes point releases for four branches

The PHP project has released new point versions for four branches: PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, and PHP 8.2.35. The release notices provide no changelog or security details.

php.net Releases · Oct 21, 2026 curated by Sönke

KAI · The Editorial

long-form pieces by Kai — opinion, pushback welcome all articles →

The Editorial

If you ship Laravel, Symfony's patch notes are your release notes too

Symfony 6.4 has reached its 48th patch release, and this week's batch fixed security issues in Yaml and HttpFoundation along with a timezone bug in Clock. Laravel teams usually wait for their own framework to tell them something changed. Kai argues you should read the upstream changelog yourself and patch on Symfony's …

An editorial by Kai · Oct 20, 2026

AI · The Model Desk

models, agents & local inference all articles →

AI · Releases

Mistral AI opens public preview for 1.05T-parameter Large 4

Mistral AI opened a public preview of Mistral Large 4 on October 6, 2026. The open-weight multimodal model uses a granular Mixture-of-Experts design with 52 billion active parameters, 1.05 trillion in…

Hacker News (AI, ≥100 P.) · Oct 21, 2026 curated by Sönke

AI · Releases

Anthropic links company stake to new benefit fund

Anthropic plans to place part of its shares in the new Anthropic Public Benefit Fund. The fund has a structure that increases its stake as the company expands. Anthropic published the announcement on …

Anthropic News (Sitemap-Diff) · Oct 20, 2026 curated by Sönke

AI · Releases

DeepSeek publishes DeepInfer for large-scale model serving

DeepSeek has published DeepInfer, an Apache-2.0 inference framework for large-scale DeepSeek deployments. The initial release targets DeepSeek-V4.1-Flash and runs on NVIDIA SM100 GPUs or Huawei Ascend…

Hacker News (AI, ≥100 P.) · Oct 20, 2026 curated by Sönke

DEV · Briefs

beyond the elephpant, kept short all articles →

DEV · Security

Node.js v26.12.1 ships with a security focus

The Node.js project has published version v26.12.1 in the 26.x line. The release is marked as a security update. The supplied notice gives no vulnerability iden…

Node.js Releases (dist) · Oct 21, 2026 curated by Sönke

DEV · Security

Security updates land for Node.js 24 and 22 LTS

The Node.js project has published two security releases for its LTS branches: v24.22.1, codenamed Krypton, and v22.23.4, codenamed Jod. The supplied release not…

Node.js Releases (dist) · Oct 20, 2026 curated by Sönke

DEV · Releases

TypeScript 7.1 beta build is now available

TypeScript 7.1 has reached a beta release in the microsoft/TypeScript repository. GitHub lists the build as v7.1-beta. jakebailey published it on 20 October at …

TypeScript Releases · Oct 20, 2026 curated by Sönke

Conference All conferences →

International PHP Conference Munich 2026 · Oct 26, 2026 – Oct 30, 2026 · Munich, Germany Conference website ↗

+ · The Back Pages

reads, oddities & one from the vault

JOBS · PHP Jobs

live from the Job.bo index — toggle skills, filter by location or remote

Senior DevOps Engineer Art of Problem Solving · San Diego, California, United States
Technical Account Manager Twilio · Remote
Frontend Entwickler (m/w/d) Shopware / vollzeit VanSprint GmbH · Darmstadt