https://badtech.org/tag/news/Notes on security, vulnerabilities, and the systems we depend on.en-ushttps://badtech.org/php-emergency-fixes-address-two-critical-rce-flaws-as-exploitation-attempts-were-reported/https://badtech.org/php-emergency-fixes-address-two-critical-rce-flaws-as-exploitation-attempts-were-reported/Sat, 24 Oct 2026 13:28:40 +0000PHP issued emergency fixes for CVE-2026-109618 and CVE-2026-109619, two critical flaws that can allow unauthenticated remote code execution. The fixed release lines cited in the supplied material are 8.2.35, 8.3.36, 8.4.27, and 8.5.12, with older branches also described as backported.RadarNewshttps://badtech.org/microsoft-azure-urges-network-based-compensating-controls-as-patch-windows-shrink/https://badtech.org/microsoft-azure-urges-network-based-compensating-controls-as-patch-windows-shrink/Tue, 25 Aug 2026 23:25:23 +0000Microsoft Azure says patch validation and deployment timelines no longer match current exploitation speed and is urging enterprises to add adaptive, network-based compensating controls during remediation. In a Microsoft Azure Blog post, Microsoft argues the usual sequence of disclosure, exposure assessment, testing and patch rollout is increasingly out of step with attacker timelines. Microsoft says organizations may need days or weeks to validate and deploy fixes, while exploitation can emerge within hours. Help Net Security separately reported Rapid7’s assessment that the gap between patch release and weaponization has approached zero.News