eMudhra certificates revealed private keys with trivial values
Scott Helme’s report examines a failure in eMudhra’s certificate authority infrastructure: private keys corresponding to public certificates had tiny … ▶ D2
Independent. Nonpartisan. Untested in production.
Reddit discussion urges prompt review of PHP updates ▶ D2
GitLab ships patches for CVSS-10 remote-code flaw ▶ D2
PHP2Shell reports unauthenticated code execution risks in core PHP ▶ D2
CVE-2026-110264 is an integer overflow in Onigmo that an anonymous visitor can reach through GitLab's Org-mode renderer.
Patch today, obviously. The harder lesson is about defaults: every format a server renders for strangers is code you're running on their behalf. That includes the markup and regex features in your own PHP apps, and it's worth counting them.
An editorial by Kai
Scott Helme’s report examines a failure in eMudhra’s certificate authority infrastructure: private keys corresponding to public certificates had tiny … ▶ D2
The Node.js project has published version v26.12.1 in the 26.x line. The release is marked as a security update. The supplied notice gives no vulnerab… ▶ D3
The Node.js project has published two security releases for its LTS branches: v24.22.1, codenamed Krypton, and v22.23.4, codenamed Jod. The supplied r… ▶ D4
TypeScript 7.1 has reached a beta release in the microsoft/TypeScript repository. GitHub lists the build as v7.1-beta. jakebailey published it on 20 October at 17:38, tie… ▶ D4
Reads: Go 1.27.3 and 1.26.10 distrust eight CA keys
The Editorial: Your editor is a dependency, so give it a lockfile and a reviewer
Releases: Node.js 24.22.0 LTS widens crypto and runtime support
Security: Microsoft ships 1,411 fixes, including an exploited zero-day
Reads: Python 3.15.0 puts sentinel types in the spotlight
News: Cloudflare brings Deno into its Workers platform
Releases: Bootstrap 6 alpha raises browser bar and adds AI-ready docs
The Editorial: TypeScript 7's real lesson for PHP tooling is the missing API, not Go
News: TypeScript 7.0 moves its compiler to Go as builds speed up
Releases: Node.js 26.11.0 expands runtime and diagnostics APIs
Security: DNS hijacks exposed a path to fake Google TLS certificates
Reads: Reddit discussion questions the reach of StackOverflow’s 2026 survey
Reads: WSL Containers reaches general availability on Windows
The Editorial: React 19.3 finally treats UI updates like PHP-FPM treats requests
Reads: Where encoding/json code breaks under Go 1.27's JSON v2
Reads: Zig 0.17.0: what the release notes cover
Releases: Git 2.56 makes conflict-resolution staging more precise
Reads: Commenter calls Python immature next to Perl 5
The Editorial: Angular v22 Is Stable, So Your PHP Backend Has to Own Validation
Security: Unpatched Zimbra installations face CVE-2026-73570 attacks
Releases: Angular 22 Brings Signal APIs Into the Stable Core
Releases: TypeScript ships vscode-typescript 1.0.1
All stories real, just louder · The Daily Commit · Screen edition · Imprint · Privacy Policy