21CTO (21CTO.com) offers developers community, training, and services, making it your go‑to learning and service platform.
Linux Foundation research reveals generative AI reduces open source coding time by 52% but leads to 25% of pull requests being low-quality 'AI slop,' rising to 31% in large projects, while maintainer burnout grows as verification costs fail to keep pace with AI-generated contribution volume.
This guide covers two critical PHP RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) with CVSS 9.2, providing patch versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), free Aikido patched container images for older branches, verification commands, mitigations like memory_limit=-1 and disabling session.upload_progress, and post-patch compromise checks.
Indian CA eMudhra voluntarily exits the global SSL/TLS certificate business after a Mozilla researcher exposed the compromise of eight intermediate CA private keys, prompting Chrome and Firefox to distrust its emSign ECC Root CA G3 and affecting around 30,800 certificates largely issued via InCommon.
Cloudflare's VoidZero team develops tsrs, a Rust port of the TypeScript compiler that reduces memory usage by 70% and achieves up to 8x faster type checking than the Go-based version, while adding WebAssembly support for browser-based type checking.
OpenSSL 4.1 introduces AVX-512 optimizations for ML-DSA and AES-CBC, adds DTLS 1.3 and GREASE support, drops Itanium/Windows CE, and publishes benchmarks showing performance gains across CPUs.
Oracle issued an emergency Java patch for CVE-2026-91403 (CVSS 9.1) after eMudhra CA issued eight intermediate certificates with trivially weak elliptic-curve private keys, enabling anyone to forge HTTPS certificates; Java's independent trust store and disabled revocation checks require immediate JDK upgrades or manual blacklist updates.
Two critical PHP vulnerabilities in memory management and error handling allow unauthenticated remote code execution, affecting ~70% of websites; emergency patches for PHP 8.2-8.5 released after AI-assisted discovery and early exploitation, with CVSS 9.2 scoring.
Rails creator DHH praises Chinese AI models and hardware but criticizes super-apps like WeChat and Alipay for poor aesthetics, inconsistent spacing, frame drops, and cluttered architectures, attributing the gap to China's free, traffic-driven super-app model versus Silicon Valley's paid, single-purpose approach, while developers cite WebView complexity and high information density as technical constraints.
cURL maintainer Daniel Stenberg shut down the project's bug bounty program after AI-generated fake vulnerability reports overwhelmed the team, while simultaneously using AI analysis tools to discover over 100 real vulnerabilities that traditional methods missed, highlighting the dual impact of AI on open source security.
Cloudflare disclosed and fixed a cross-tenant data leak in its container platform where the dm-thin storage allocator's skip_block_zeroing setting allowed new containers to read residual data from deleted containers, including databases and credentials, across 18 of 24 deployments and 20 of 22 nodes; the fix involved removing the flag, draining hosts, and clearing caches.
