Vulnerability notes, site pentests and audits
Recent vulnerabilities in plain language, and how a website pentest and a security audit work for companies.
CVE-2026-109618: PHP aborts a request on memory and leaves a hole
On 21 October PHP fixed a bug where running out of memory aborted a request and later memory could be treated as valid. Patch: 8.2.35, 8.3.36, 8.4.27, or 8.5.12.
CVE-2026-109619: a PHP worker remembers someone else's request
The second critical bug in the same October release: request globals outlive the memory that held them, and the next request on the same worker reads them. Fixed in the same versions as CVE-2026-109618.
CVE-2026-115560: the third PHP bug the 21 October patch does not close
On 23 October PHP separately disclosed CVE-2026-115560. Remote code execution applies only where session upload progress is enabled, which is uncommon on production sites. The October 8.2-8.5 releases do not fix it.
Why "the site opens" does not see a defacement
An availability check asks whether the server answered. A defacement answers. A green tick and a foreign homepage therefore live together.
GitLab CVE-2026-110264: a regular expression scored 10 out of 10
On 21 October GitLab fixed an overflow in the Onigmo compiler. No login is required, and code execution is confirmed. The 12 October patch does not close this bug.
Audit, pentest and threat monitoring: three different jobs
An audit describes state, a pentest checks a scenario, monitoring stays on. Those are three contracts, not three names for one service.
GitLab CVE-2026-97229: the first October CI bug, not the second
On 12 October GitLab fixed CVE-2026-97229: an overflow while compiling a regular expression in CI configuration. Also scored 10, also unauthenticated. The version range is narrower than the 21 October bug.
What to write into a threat-monitoring contract
A threat-monitoring contract rests on the asset list, the alert channel and who may stop the site. Without that, the subscription turns into a chat.
eMudhra: eight certificates were weaker than the key length promised
On 20 October eMudhra emSign intermediate certificates were revoked. At the 30 April 2025 ceremony the entropy of a P-384 key collapsed. Browsers no longer trust them. Software with its own trust list often still does.
A night alert about the site: a calm order until morning
A night alert about the site needs to be read, and one person needs to own the decision. Rolling "back to yesterday" before morning often publishes the same page again.