2026-10-26: Oops All Vulnerabilities

About this Episode

In this week's Log Level Debug news roundup we talk about PHP waaaaaay to long, but balance it out with other vulnerability discussion, and talk about layoffs. You know, just the good stuff.

• 0-day vulnerability discoveries are up. Way, way up.
  • https://cve.0xosprey.com
  • https://www.nist.gov/news-events/news/2026/04/nist-updates-nvd-operations-address-record-cve-growth
• Amazon is spending $3 billion a month on GPUs and not using them.
  • https://www.techspot.com/news/114315-dark-gpus-amazon-show-limits-ai-buildout-chips.html
• PHP had 2 super bad vulnerabilities.
  • https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security
• Microsoft is shutting down their The Garage program.
  • https://www.geekwire.com/2026/microsoft-shuts-the-door-on-the-garage-the-central-program-behind-its-hackathon-and-maker-spaces
• Government websites went down to patch PHP vulnerabilities.
  • https://www.bbc.com/news/articles/cmly0lg3w5x2o
• Google and OpenAI claim their A.I. models were used to find the PHP vulnerabilities.
  • https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619
  • https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities
• Chainguard published PHP patches before anyone else, annoying and/or angering everyone.
  • https://www.linkedin.com/posts/danlorenc_i-wanted-to-share-what-happened-with-the-share-7518756991520120832-QX2_
  • https://www.reddit.com/r/PHP/comments/1xbpbiu/comment/19rg36xdmfw02
• The certificate authority eMudhra had some incredibly insecure certificates.
  • https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs
• Http2Shell is out, a vulnerability affecting multiple frameworks.
  • https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497
• ES is laying off 400 people because award-winning games are for losers.
  • https://www.bloomberg.com/news/articles/2026-10-21/electronic-arts-to-cut-400-jobs-shut-down-bioware?accessToken=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzb3VyY2UiOiJTdWJzY3JpYmVyR2lmdGVkQXJ0aWNsZSIsImlhdCI6MTc5MjYwMjI4MCwiZXhwIjoxNzkzMjA3MDgwLCJhcnRpY2xlSWQiOiJUTjlPUkZLSVVQU08wMCIsImJjb25uZWN0SWQiOiJCMUVBQkI5NjQ2QUM0REZFQTJBRkI4MjI1MzgyQTJFQSJ9.BPLdBqixyN47DHZvtrfHyRsF_Np3UKIKzGi_WqMA-I4
• AWS is sold out through 2027
  • https://www.reuters.com/business/retail-consumer/amazon-cloud-capacity-sold-out-through-2027-ceo-jassy-says-2026-10-23