Skip to main content

PHP, Node and Ruby patch storms as Meta's AI bill hits $825B

  1. Security

    PHP warns of another RCE flaw two days after emergency PHP2Shell patches (opens in a new tab)

    PHP disclosed CVE-2026-115560, a session upload progress bug that the October 21 releases do not fix. Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 for PHP2Shell, and turn off session upload progress until the next routine release.

    Source: The Hacker News

  2. Security

    Singapore urges immediate patching of critical Node.js Brotli flaw CVE-2026-111497 (opens in a new tab)

    Singapore's Cyber Security Agency flagged the Brotli decoder bug in Node.js, rated CVSS 9.8, as a remote code execution risk. Any service that decompresses untrusted Brotli data should move to 22.23.4, 24.22.1 or 26.12.1 now.

    Source: Cyber Security Agency of Singapore

  3. Languages

    Ruby 4.0.9, 3.4.12 and 3.3.13 fix regex engine bugs behind four GitLab RCEs (opens in a new tab)

    The releases close memory bugs in Onigmo, Ruby's regex engine, that GitLab rated critical. Any Ruby app that compiles a regex from untrusted input is exposed, and 4.0.8 alone is not enough, so upgrade to 4.0.9 or later.

    Source: Ruby

  4. Business

    Meta's AI build-out pushes future leases and contracts to about $825 billion (opens in a new tab)

    Meta's quarterly filing lists $454.5 billion in non-cancellable contracts and $355.7 billion in leases yet to start, about $825 billion in all. Free cash flow hit minus $2.1 billion and shares fell 7%, so expect tougher questions about AI spending.

    Source: CNBC

  5. Cloud

    Google blames a "power event" for London cloud outage that hit UK banks (opens in a new tab)

    Google said a power event in its europe-west2-b zone, starting at 06:08 UTC on 20 October, disrupted Revolut, Lloyds, HSBC, Royal Mail and DPD for hours. It is a clear reminder to spread critical workloads across zones and to actually test your failover.

    Source: Silicon UK

  6. Security

    Pillow flaw lets a crafted EPS file name run commands on servers with Ghostscript (opens in a new tab)

    CVE-2026-112900 scores 9.2 in its CVE record, though Pillow rates it Moderate, and only bites hosts with Ghostscript installed. It affects Pillow 2.6.0 to 12.3.0, so upgrade to 13.0.0 and refuse EPS input if you do not need it.

    Source: The Hacker News

  7. AI

    Anthropic deputy CISO warns basic security will get worse before better (opens in a new tab)

    Jason Clinton said the PHP scramble, after Wiz and Calif used OpenAI and Google models to find the flaws, will get "a lot worse before" it improves. Plan for more emergency upgrades and less time between disclosure and attack.

    Source: Bloomberg

My take

This week AI found bugs faster than most teams could ship fixes, and PHP, Node.js, Ruby and Pillow all needed emergency patches within days of each other. Meanwhile Meta is signing up for hundreds of billions in AI infrastructure, and one London zone losing power was enough to knock UK banks offline. My view is that the boring work now matters most: know every runtime version you run, be able to roll a patch out in hours rather than weeks, and make sure no critical service depends on a single zone. Teams that treat upgrades as routine will cope with this new pace, and teams that treat them as projects will not.