PHP Fixes Land as Attacks Surge, Plus 2 Stories
Yesterday’s Brief warned that a critical PHP security release was coming. The PHP security update has now landed across four supported branches, the vulnerable behavior has a name and version list, and the internet did what it always does with a fresh vulnerability: it started poking at every door it could find.
PHP fixes are available, and scanning surged within hours
The PHP project released four security updates on October 21: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. They fix CVE-2026-109618 and CVE-2026-109619, two flaws that can allow an attacker who has no account or password to run code on a vulnerable server. That is remote code execution, and it is about as direct as a web-server vulnerability gets.
The important sentence in the project’s announcement is the one saying there are no complete mitigations. A web application firewall or a hosting provider’s temporary filter may block known exploit patterns, and that can buy time. It does not repair the PHP runtime. Updating is the fix.
This is also where version numbers matter more than headlines. Updating WordPress core or a plugin does not update the PHP interpreter underneath the site. On managed hosting, the provider may handle the runtime update. On a VPS, dedicated server, or older shared-hosting account, somebody needs to confirm the installed branch and the exact patched release. PHP 8.2 also reaches end of life on December 31, so 8.2.35 is an emergency landing spot, not a long-term plan.
Reuters reports that Cloudflare saw the volume of attempted exploitation climb from thousands before public disclosure to millions after it. That is evidence of aggressive scanning, not evidence of millions of successful break-ins. The distinction matters. Panic is not useful, but neither is assuming that a quiet website was ignored.
If you operate a PHP site, confirm the runtime version today and arrange the update if it is below the fixed release for its branch. Take a backup or snapshot before the change, test the site afterward, and remember that a backup made after an intrusion can preserve the intruder right along with your files. If the server was exposed while vulnerable, review web and system logs for unexpected requests, new files, processes, outbound connections, or account changes. If you find evidence of execution, treat credentials stored on that server as potentially exposed. A patch closes the hole. It does not evict anyone who already walked through it.
WordPress security & maintenance
Keeping WordPress current is only part of keeping it healthy. Raymond Tec handles updates, backups, security monitoring, compatibility problems, access cleanup, and maintenance — plus the assorted weirdness that accumulates on a site over time.
Meta’s $25 billion privacy penalty is enormous, and unsettled
A New Mexico judge ordered Meta to pay the state $25 billion after a jury found more than 43 million violations of state consumer-protection law. The case grew from the Cambridge Analytica scandal and focused on claims that Facebook users controlled who could access their personal data.
The number is large enough to swallow the headline, but the mechanism is more interesting. Jurors found that Meta and its leadership made 26 misleading public statements, and the state tied those statements to the audience that received them. In other words, a privacy promise was not treated as decorative language. It became the basis for counting violations at scale.
Meta says the ruling is unconstitutional, disputes the state’s case, and expects to win on appeal. The company could get the penalty reduced, and Reuters notes that a long appeal fight is expected. Users should not mistake a judgment for money already collected or a product change already delivered.
There is nothing to change in your Facebook settings because of this ruling alone. What is worth watching is whether the final outcome forces clearer disclosures or changes how courts value repeated privacy claims. Companies have spent years writing promises that sound specific to users and flexible to lawyers. New Mexico just demonstrated how expensive that gap can become, assuming the judgment survives.
The rules around technology matter too
Platforms, privacy, speech, competition, surveillance, copyright, and regulation increasingly determine what technology companies can build and what the rest of us have to live with. Browse more Raymond Tec News for practical coverage of technology policy and digital rights.
Data-center promises are getting more specific because communities are saying no
Amazon, Google, Meta, and Microsoft are promising more money, fewer secrets, or both to communities considering new data centers. The Associated Press reports that Amazon, Microsoft, and Google have stopped requiring public officials to sign nondisclosure agreements for these projects. Google says it will pay full real-property taxes on new campuses, while Amazon and Meta have each announced $1 billion in community incentives.
Those are meaningful concessions. They are not substitutes for the boring questions that determine who actually pays. Will the company cover the new substation, transmission line, water infrastructure, backup generation, and long-term maintenance? Are those commitments enforceable if ownership changes? How much revenue disappears through sales-tax exemptions, and is a community fund recurring or a one-time payment?
This matters beyond the town hosting the building. In the 13-state PJM electricity market, data-center demand has already been blamed for higher bills, which pushed technology companies to promise that ratepayers would not finance their power infrastructure. A promise is useful. A contract, tariff, or law that allocates the cost is better.
If there is no proposed data center near you, there is nothing to do today. If one appears on a local agenda, ask for the owner, load forecast, tax agreement, water use, backup-generator plan, noise study, grid-upgrade costs, and enforcement terms before the vote. The industry’s new willingness to disclose more is progress. It is also a sign that public scrutiny is working.
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources / Further Reading
- PHP project: security releases for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35
- Reuters: exploitation attempts surge after PHP disclosure
- Associated Press: New Mexico’s $25 billion judgment against Meta
- Reuters: Meta ruling and expected appeal
- Associated Press: data-center companies promise fewer secrets and more local support
Photo by Jakub Zerdzicki on Pexels.
