The Dev Dispatch — PHP, AI & dev news, four languages, one press

PHP · Security

AWS saw PHP2Shell attacks before the patch release

Amazon Web Services detected an attempt to exploit PHP2Shell on October 17, four days before fixes for two PHP vulnerabilities and public reports appeared. The traffic reached an AWS honeypot from an IP tied to a commercial anonymization network. AWS says PHP2Shell is now broadly exploited, although it has not established whether the earlier attempts would work against real systems.

WIRED · Oct 22, 2026 curated by Georg

→ continued: summary & source

PHP · Security

Amazon Linux 2023 targets 22 October for PHP fixes

Amazon Linux 2023 assigns CVE-2026-109618 and CVE-2026-109619 the status Important, although PHP and other public assessments give both a CVSS v4.0 score of 9.2 and Critical severity. AWS says PHP 8.2 through 8.5 are aff…

Hacker News (PHP, ≥15 P.) · Oct 21, 2026 curated by Sönke

PHP · Security

PHP patches critical RCE flaws as upgrade gaps widen

PHP's October 21, 2026 security release fixes two critical RCE vulnerabilities, but a new analysis shifts attention to response capability. It covers the patched branches and the SAPI-specific exposure for each flaw, the…

Medium · PHP · Oct 21, 2026 curated by Sönke

PHP · Ecosystem

frameworks, tooling & runtime all articles →

PHP · Security

PHP schedules emergency patch for two critical vulnerabilities

PHP is set to publish an emergency security update on 21 October 2026 at 14:00 UTC for two critical vulnerabilities rated CVSS v4.0 9.2. CERT-EU lists CVE-2026-109618 and CVE-2026-109619 and warns of …

Medium · PHP · Oct 21, 2026 curated by Sönke

PHP · Security

PHP emergency fixes target two critical RCE flaws

On October 21, 2026, PHP released emergency fixes for CVE-2026–109618 and CVE-2026–109619, two critical unauthenticated remote-code-execution flaws rated 9.2 by CVSS v4.0. Fixed branches are PHP 8.5.1…

Medium · PHP · Oct 22, 2026 curated by Georg

PHP · Security

FrankenPHP 1.13.2 closes PHP2Shell exposure

FrankenPHP 1.13.2, released on 21 October, is a security update for the PHP application server. Its Docker images and static binaries include PHP versions that address PHP2Shell, two critical flaws en…

FrankenPHP Releases · Oct 22, 2026 curated by Georg

KAI · The Editorial

long-form pieces by Kai — opinion, pushback welcome all articles →

The Editorial

If you ship Laravel, Symfony's patch notes are your release notes too

Symfony 6.4 has reached its 48th patch release, and this week's batch fixed security issues in Yaml and HttpFoundation along with a timezone bug in Clock. Laravel teams usually wait for their own framework to tell them something changed. Kai argues you should read the upstream changelog yourself and patch on Symfony's …

An editorial by Kai · Oct 20, 2026

AI · The Model Desk

models, agents & local inference all articles →

AI · Releases

Mistral AI opens public preview for 1.05T-parameter Large 4

Mistral AI opened a public preview of Mistral Large 4 on October 6, 2026. The open-weight multimodal model uses a granular Mixture-of-Experts design with 52 billion active parameters, 1.05 trillion in…

Hacker News (AI, ≥100 P.) · Oct 21, 2026 curated by Sönke

AI · Releases

Anthropic links company stake to new benefit fund

Anthropic plans to place part of its shares in the new Anthropic Public Benefit Fund. The fund has a structure that increases its stake as the company expands. Anthropic published the announcement on …

Anthropic News (Sitemap-Diff) · Oct 20, 2026 curated by Sönke

AI · Releases

DeepSeek publishes DeepInfer for large-scale model serving

DeepSeek has published DeepInfer, an Apache-2.0 inference framework for large-scale DeepSeek deployments. The initial release targets DeepSeek-V4.1-Flash and runs on NVIDIA SM100 GPUs or Huawei Ascend…

Hacker News (AI, ≥100 P.) · Oct 20, 2026 curated by Sönke

DEV · Briefs

beyond the elephpant, kept short all articles →

DEV · Security

Node.js v26.12.1 ships with a security focus

The Node.js project has published version v26.12.1 in the 26.x line. The release is marked as a security update. The supplied notice gives no vulnerability iden…

Node.js Releases (dist) · Oct 21, 2026 curated by Sönke

DEV · Security

Security updates land for Node.js 24 and 22 LTS

The Node.js project has published two security releases for its LTS branches: v24.22.1, codenamed Krypton, and v22.23.4, codenamed Jod. The supplied release not…

Node.js Releases (dist) · Oct 20, 2026 curated by Sönke

DEV · Releases

TypeScript 7.1 beta build is now available

TypeScript 7.1 has reached a beta release in the microsoft/TypeScript repository. GitHub lists the build as v7.1-beta. jakebailey published it on 20 October at …

TypeScript Releases · Oct 20, 2026 curated by Sönke

Conference All conferences →

International PHP Conference Munich 2026 · Oct 26, 2026 – Oct 30, 2026 · Munich, Germany Conference website ↗

+ · The Back Pages

reads, oddities & one from the vault

JOBS · PHP Jobs

live from the Job.bo index — toggle skills, filter by location or remote

STAFF IT PT. Wahana Gula Investama · Tegal, Jawa Tengah
Full Stack Developer Raditya Holding Company · Badung, Bali
Join Our Talent Community: Solutions Engineer Staffbase · Berlin, Germany; Chemnitz, Sachsen, Germany; Dresden, Sachsen, Germany; Germany; Germany Remote; Köln, Nordrhein-Westfalen, Germany; München, Bayern, Germany