Tim Olshansky

If you run PHP anywhere, patch it today. Two RCE bugs in PHP core, CVE-2026-109618 and CVE-2026-109619, both 9.2. Reportedly, every release from 5.4 up is affected. Fixes shipped this afternoon (UTC): 8.5 → 8.5.12 8.4 → 8.4.27 8.3 → 8.3.36 8.2 → 8.2.35 8.1 and older get no official release. Check your distro or LTS vendor for backports, or upgrade. Two things people are getting wrong 👇 1/ Plenty of companies run PHP without thinking of themselves as a PHP shop. WordPress is PHP, and so is that admin panel, that status page, and the staging box nobody decommissioned. Check every host you own that answers to the internet, including the ones nobody has logged into in a year. 2/ The risk went up sharply when the patch landed (30 mins ago!). Details leaked yesterday, and a few attackers already had them. Cloudflare saw attack traffic at 07:43 UTC, hours before any fix was made public. Now the patch points everyone at the exact bug, and writing an exploit from a diff is a short job. If you can’t patch in the next few hours, Cloudflare’s WAF rules block the known attack patterns, including on the free plan. They only help if traffic actually goes through Cloudflare, and attackers are already tweaking payloads to get past them. That buys you hours, so spend them patching.

The slowest part of your SOC 2 just got a lot faster. Now you can run a full pen test on demand, and get results in hours. We just launched Fencer AI pen testing. Scope a pen test in the morning, read the audit-ready report the same day. Network and domain scanning run continuously alongside it. $3,000 a year. fencer.dev/blog/introducing-…

AI for cyber is about to go vertical. The models increasingly becoming insanely good at finding and exploiting vulnerabilities. Frontier models are ahead, but we’re already seeing that open weights is not far behind. Most enterprises are already inundated with cyber discoveries, so now that’s only going to multiply. Triaging and automating the fixes with more AI -along with human oversight- is essentially the only way forward. In case you were wondering what jobs AI was going to create, it’s definitely going to great time to be in security.