📰 GitLab CVE-2026-110264, PHP2Shell and Linux 7.4: Digest for October 22, 2026

• Twelve Years of Unchecked Regex Buffers in GitLab
• Node.js and Musl Libc Patch Remote Code Execution Bugs
• LiteLLM Poisoned via Stolen GitHub CLI Tokens
• PHP Foundation Confesses to Months of Decision Paralysis
• PHP2Shell RCE Triggered in the Wild Days Before Disclosure
• Security Vendors Forget How Mailing Lists Work
• Unsafe __get_user and __put_user Finally Evicted in Linux 7.4
• Kernel Shadow Stacks Proposed for Hardware ROP Defense
• Broken QPACK Accounting Enables Massive HTTP/3 DoS
• Railway Environment Variable Breach Drains Crypto Keys
• Linux 7.4 Lands Major Kbuild Performance Cleanups
• KeePassXC 2.8.0 Modernizes with Qt6 and Wayland Auto-Type
• Linux 7.4 Streamlines AES Code into the Crypto Library
• EEVDF Latency Improvements and VM Steal Governor in Linux 7.4
• Linux 7.4 Drops Costly SafeRET Mitigations on AMD Zen 6

https://or1k.net/digests/daily-digest-2026-10-22/

📰 Linux 7.4 HID Drivers - OpenSSL 4.1 and PHP2Shell Flaws: Digest for October 23, 2026

• Unpatched KSMBD Flaws Leak Via Mailing Lists Without Patches
• Arista VeloCloud Hit by Critical SQL Injection Zero-Day
• PHP2Shell Scans Surge as Botnets Fail to Land Exploits
• Node2Shell Proof-of-Concept Proves Brotli RCE on Stock Builds
• LibreSSL 4.4 Drops Weak Roots and Speeds Up SHA-3
• x402 SDK Flaws Left AI Agent Wallets Wide Open
• Pillow 13 Fixes Critical Ghostscript and JPEG Buffer Overflows
• Linux 7.4 Lands Nintendo Switch 2 Controller Support via Valve
• LibreSSL 4.4 Adds Post-Quantum Hybrid Key Exchange Support
• Factorio 2.1 Drops With Native ARM64 Linux Support
• Tails 7.15.1 Ships as Emergency Fix for Compromised Certs
• PHP Warns of Second Edge-Case RCE Bug Amid Botnet Scans
• OpenSSL 4.1 Arrives With Native DTLS 1.3 and AVX-512 Boosts
• OpenSSL 4.1 Brings Post-Quantum NTT Optimizations to PPC64LE
• Linux 7.4 Power Management Prep Targets Zen 6 and Panther Lake

https://or1k.net/digests/daily-digest-2026-10-23/

📰 Linux 7.4 Memblock, Ruby CVE-2026-110264 and systemd Rust: Digest for October 24, 2026

• Linux kernel ponders dropping ancient HPFS file-system driver
• Ruby regex engine bugs expose GitLab and other apps to RCE
• BlackX bootkit targets diplomatic networks via forgotten Secure Boot patch
• Linux 7.4 slab updates squeeze out a 24% throughput boost
• OBS Studio 33.0 arrives with a massive CEF upgrade and plugin overhaul
• KDE Plasma 6.9 stabilizes Wayland picture-in-picture support
• Transmission 4.1.4 torrent client squashes download regressions and bugs
• CISA urges fixes for actively exploited flaws in Collabora and Arista
• Linux 7.4 graphics updates enable AMDGPU HDMI 2.1 by default
• Brotli decoder memory corruption flaw hits Node.js, Bun, and Python
• Wild 0.11 linker drops with WASM and Linux kernel module support
• Linux 7.4 memory management merges 539 patches and DAMON upgrades
• systemd merges initial Rust support for leaf utilities
• Leaked LiteLLM master key enables supply chain compromise on PyPI
• Linux memblock early boot allocator drops search time from 268s to 50ms

https://or1k.net/digests/daily-digest-2026-10-24/

📰 Linux 7.4 Kernel Updates, SteamOS 3.9.5 and KDE Plasma 6.9: Digest for October 25, 2026

• SteamOS 3.9.5 Drops With Linux 7.2 and Plasma 6.7
• WireGuard Easy 15.5 Pulls In AmneziaWG 3.1
• Systemd Welcomes Rust For Isolated Components
• Linux 7.4 Block Subsystem Spans Floppies and Apple M4 NVMe
• KDE Plasma 6.9 Fixes Wayland PiP and Layout Amnesia
• Google Purges C Binder Driver for Rust in Linux 7.4
• AMD 600 Series Chipsets Get Linux Temperature Monitoring
• Realtek rtl8723bs Driver Graduates From Staging
• Linux 7.4 Teaches XPad Driver GameSir Nova Lite Support
• Linux 7.4 Sound Subsystem Flooded With AI Patches
• Wayland Proposes ext-transient-output for VNC Software
• Ubuntu Touch 24.04-2.2 Patches eMudhra Certificate Mess

https://or1k.net/digests/daily-digest-2026-10-25/

📰 Wasmtime 5.0, Tailscale SSH and Linux 7.4 Core MM: Digest for October 26, 2026

• Global Scanning Targets PHP2Shell Flaws
• Tailscale SSH Flaws Risk Fleet-Wide Root Access
• Systemd Merges Support for Rust Components
• Kali Linux 2026.3 Ships With Kernel 7.1 and KDE Plasma 6.7
• EXT4 Lands Optional Buffered IOmap Support
• Critical Wasmtime Flaws Allow Sandbox Escapes
• Linux 7.4 Fixes Ryzen AI 9 Scheduler Regression
• Linux 7.4 Establishes Dedicated Core MM Tree
• Nouveau-DKMS Aims to Fix Fermi GPU Support
• Linux 7.4 EFI Stub Improves Systemd Boot Integration
• Stolen GitHub Tokens Exploit Actions Logs for Secrets
• Microsoft 365 Token-Replay Campaign Compromises Accounts
• Coordinated Disclosure Faces Strain in AI Era
• Amutable Opens Signups for Immutable Linux Preview
• Redox OS Delivers Major IPC and Scheduler Performance Wins

https://or1k.net/digests/daily-digest-2026-10-26/

📰 Linux 7.4 Kernel, PHP Brotli Fix and Stalwart 1.0 Mail Server: Digest for October 27, 2026

• Linux 7.4 Media Pull Adds Intel IPU8 and Panther Lake Support
• PHP Rushes Out Second Windows Security Build in Five Days
• KMSCON 10.1 Lands Per-Monitor Configurations
• The Slow-Motion Trainwreck of Legacy VPN Gateways
• Linux 7.4 Sets Up CXL Dynamic Capacity Devices
• Stalwart 1.0 Mail Server Lands After Five Years in the Oven
• Valve's Steam Frame VR Headset Hits the Linux 7.4 Mainline Kernel
• Linux 7.4 Kernel Upstreams Apple M4 and A18 Pro Support
• CISA Confirms Active Exploitation of PHP2Shell RCE Flaws
• KIO Finally Fixes the Fifteen-Year-Old USB Copy Progress Bug
• Linux 7.4 HWMON Expands Motherboard and Mini PC Monitoring
• Linux NTFS Driver Gains Alternate Data Stream Support
• Beeper Project Accelerates Web Servers Using In-Kernel eBPF
• Linux 7.4 KVM Brings Zen 6 PML and s390 Virtualization
• Resurrecting a Classic ThinkPad Keyboard with Modern Tech

https://or1k.net/digests/daily-digest-2026-10-27/