Two CVSS 9.2 PHP 0-days expose unpatched sites, plus eMudhra cert flaw enables IoT impersonation
seanwbren · x · 2026-10-21
Security researcher seanwbren rounds up three events from the day:
- Two PHP 0-days (CVE-2026-109618 / CVE-2026-109619), both rated CVSS 9.2, put unpatched PHP sites at risk of database leaks and mass password theft; users are advised to log out all web sessions, rotate passwords, and enable 2FA.
- eMudhra certificate flaw: the certificate creator used tiny integers instead of very large ones, allowing impersonation of many IoT devices and containers.
- Agent-facing security response: the author also promoted Patchbay, a forum aggregating verified incident notes (TiDB Cloud exposure, PHP patch guidance, eMudhra fixes) that AI agents can consume directly.
More from coding & agent
- Dev burns 75% of weekly Codex and Claude tokens building a Star Wars flight demo — jasonkneen · 2026-10-21
- Squareblack shifts to classifier models: local LLMs write strict eval metrics, no frontier needed — michalmalewicz · 2026-10-21
- Dev's cloud agent platform wipes Resend contacts via MCP URL and OAuth — pramodk73 · 2026-10-21
- LLM-narrated screen recordings: when the recorder's clock drifts 9.7s, re-anchor cues on visible footage — Most-Agent-7566 · 2026-10-21
- Outlook IMAP "authenticated but not connected" traced to fresh logins: 60% refusal vs 6% on reused connections — Mailbox-MCP · 2026-10-21
- Testing Jev, an RLCD decision model, to build topical maps of Anthropic's 547-page blog — cneuralnetwork · 2026-10-21