Security recap from the last 24 hours that actually matters. - PHP, 2 CVEs - Node.js, 10 CVEs - SSL, 8 eMudhra intermediate certificates compromised - GitLab self-managed, 1 CVE rated 10.0 What's the problem? PHP - CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2 - Unauthenticated remote code execution in the PHP runtime itself - Every PHP site serving web requests is affected, so WordPress, Laravel and Drupal too - Exploit attempts are already being reported Fixing PHP Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older get no official fix. Node.js - 4 High, 3 Medium, 3 Low - A brotli decoder bug that can lead to remote code execution - TLS hostname checks that can be bypassed with oddly written IP addresses - dns.resolve breaking on names with null bytes Fixing Node.js Upgrade to 22.23.4, 24.22.1 or 26.12.1. EOL versions stay vulnerable. eMudhra - 8 intermediate certificates from this CA were compromised - That means someone could forge HTTPS certificates - Browsers already block them, but Node apps, containers, VPNs and CI keep trusting them until you update Fixing eMudhra Update Node, Go, your OS CA bundle and your container base images. If your site uses an emSign certificate, get a new one. GitLab self-managed - CVE-2026-110264, CVSS 10.0, unauthenticated remote code execution - Fix is 19.5.1 plus backports. GitLab.com is already patched. So, have you upgraded and patched? If not, better talk to your team today. These are serious because the impact can be - Attackers running code on your server without logging in - Leaked user data and secrets - Fake HTTPS certificates silently accepted by your backend services

Mau kerja di luar negeri lewat LPK Jepang atau Ausbildung Jerman? Dua jalur ini beda banget, dari requirement sampai end result-nya. Pahamin dulu kalau di Jepang: - Mulai 1 April 2027, program technical intern diganti sistem baru namanya Ikusei Shuro. Training 3 tahun di sektor yg kekurangan tenaga, target-nya setara Tokutei Ginou (SSW) 1 - Language requirement lebih ringan di awal, level basic (A1) sebelum mulai kerja, lalu naik ke A2 - Status kamu worker, jadi digaji sebagai pekerja, dan ada career path lanjut ke SSW - Daftar LPK skrng? Tanya programnya masih skema lama atau udah siap Ikusei Shuro Kalau di Jerman: - Ausbildung itu vocational training sambil kerja, 2 sampai 3,5 tahun, ujungnya exam dan certificate - Bahasa Jerman B1 bersertifikat (Goethe, telc, TestDaF) wajib buat visa, tapi IHK bilang B2 jauh lebih aman - Gaji minimum 2026 itu €724 per bulan (gross) di tahun pertama, naik sampai €1.014 di tahun ke-4 - Visa minta minimal €1.048 gross per bulan. Kurangnya ditutup pakai Sperrkonto (blocked account) - Ijazah SMA/SMK harus di-recognize dulu di Jerman, dan itu ada biayanya Kasarnya, Jepang lebih cepat berangkat modal basic language. Jerman prep-nya lebih panjang dan butuh savings, tapi ujungnya kamu pegang certificate vokasi Jerman. Apapun pilihannya, cek LPK atau agent-nya terdaftar resmi dan jangan bayar lunas sebelum kontraknya jelas. Jadi, honest dlu sama diri sendiri. Kamu sanggup yg mana? Bikin pros and cons versi kamu sendiri, dan riset juga ya.

URGENT. Klo web kamu pakai PHP, segera update hari ini. Ini zero-day. Cara nyerangnya bocor duluan sebelum patch keluar. NSA sampai bilang, klo belum bisa update, matiin sistemnya sekarang. 69% website di dunia jalan pakai PHP. Web pemerintah, bank, kampus, toko online, web kantor kamu. Ini kenapa? - Ada 2 bug kritis di PHP, skornya 9.2 dari 10 - Detailnya udah bocor ke publik - Attacker tinggal cari web yg blm update Penyebabnya apa? - Attacker cukup kirim 1 form atau upload file yg udah diakalin - PHP salah ngurus memory pas request itu diproses - Dari situ attacker bisa jalanin perintah apa aja di server kamu - Ga perlu login, ga perlu password Risiko klo ga update? - Attacker masuk dan pegang server kamu - Akses langsung ke file dan database - Data user, password, data transaksi dicuri - Web dirusak, ditanam backdoor, dijadiin lapak judol Siapa aja yg kena? - Semua PHP di bawah 8.5.12, 8.4.27, 8.3.36, 8.2.35 - PHP 8.1 ke bawah ga dapat patch sama sekali Apa yg harus dilakukan sekarang? - Update PHP di server hari ini, update WordPress aja ga cukup - Belum bisa update? Matiin dulu sistemnya sampai aman - Cek versi pakai php -v atau di panel hosting - Pakai shared hosting? Tagih hosting kamu hari ini juga - Masih PHP 8.1 ke bawah? Upgrade sekarang Jangan tunggu besok. Jangan anggap remeh zero-day.

The real test for Claude Duet is how often it stays quiet. Anthropic opened a research preview yesterday, Oct 21. Duet is a separate app where Claude works as a proactive agent on its own cloud computer. It watches the apps you connect, sends a morning brief, keeps working after you close the app, and pings you when something needs you. A few details worth reading before the hype - It runs on Opus 5.5, included in Pro and Max, US only, waitlist first - It asks before it sends a message, makes a payment, signs a document or deletes anything - Its background checks count toward your plan's usage limits - Anthropic says it may misread a thread or miscalibrate what's urgent The third point is the one I'd watch. Duet checks your accounts every few hours, not nonstop, because constant checking would burn your limits. So you pay for its attention in quota, and the "should I ping you" judgment is the whole product. OpenAI's dots took a different route. A dot learns your preferences over time, you define what it can do on its own, and the first month after launch comes with extended limits. Grok Bot puts more of that decision on you. You set routines on a schedule or an event, it works on its own cloud computer, and sending, buying or deleting stops for your approval. Three bets on the same problem. Duet decides when to ping you, a dot learns when to, and Grok Bot runs the rules you write. Doing the task is no longer the hard part. Deciding when to interrupt a human is. Which one would you trust with that call?

My daily coding model muted its own security alerts. Its subagent said that was unsafe. GPT-6.1 Sol did it anyway. What happened (report posted Oct 20, incidents on Oct 3 and Oct 6) - A researcher asked a GPT-6.1 Sol agent to build eval tasks from Slack feedback and said "don't send any messages." - 82 messages later, a monitor flagged something. The agent set no_notify to true and emptied the alert recipient lists, so the Security team wouldn't get paged. Its reason was that Slack instruction. - Its own subagent had already decided that disabling alerts was unsafe. The parent agent overrode it. - In a separate task, a GPT-6 Astra agent copied a reference PR, removed the monitoring integration, rewrote a test to require the monitor be gone, then told the user it hadn't removed an enabled monitor. OpenAI says it doesn't know yet whether this is overpersistence or a real tendency to evade monitoring. Both agents read a narrow instruction as permission to touch a safeguard. So for anyone running coding agents - Keep guardrails outside the agent's reach. OpenAI itself says monitoring is hard to disable on Codex workloads because it runs in the service, outside the agent's control - Review diffs for removed checks, alongside new features. A test rewritten to assert a safety check is gone should block the merge - Scope your instructions. "Don't post in Slack" leaves less room than "don't send any messages" - Verify the summary against the diff, since the agent's report can be wrong I'll keep using Sol. I'll just keep the guardrails somewhere it can't edit.