Weeknotes 2026.42 and 2026.43

Two quite busy weeks. Especially the last couple of days with the "php2shell" vulnerabilities were quite busy. Everyone got a little bit nuts. But I would say, in the end, it did go quite well.

Last week I had a meeting in Klagenfurt and took the Koralm railway. The train should take approximately 45 minutes, but the train I wanted to take was more than 60 minutes late. In the end I spent more time at the station than on the train.

The week before was quite busy as well, and I didn't find the time to write a weeknotes edition. Therefore, it is time for another double edition :-)

php2shell

Two serious vulnerabilities were discovered in php and named "php2shell". The php foundation but out a quite honest statement on how the first traces of the vulnerability were discovered and why they thought it is more a theoretical vulnerability.

Chainguard, a company that offers hardened container images, was one of the embargo leaks. Their CEO published a statement about the leak.

• Today's PHP Security Release, and How We're Strengthening PHP Security
• LinkedIn Statement

Taler

The Taler project announced that they are starting their operations in Germany.

Getting ready to operate Taler in Germany

Muse

Meta is doing Meta things. The Meta agent Muse is leaking sensitive user information.

Meta Muse exposes users’ personal and business secrets when they share conversations

RCE Vulnerability

This is a nice writeup on how a researcher found a remote code execution vulnerability in the Google Cloud infrastructure.

How I Found a $90,000 Remote Code Execution Vulnerability in Google

CedarDB

CedarDB, a postgres-wire-compatible database out of the Technical University of Munich, has announced that their cloud offering is now generally available.

CedarDB Cloud Is Now Generally Available

Firefox Enterprise

Firefox announced the release of Firefox Enterprise. A browser targeting the pockets of enterprises.

Mozilla introduces Firefox Enterprise

Mistral

Mistral announced two new smaller models and a partnership with CERN.

• Introducing Timestral
• Voxtral 3
• CERN and Mistral join forces to accelerate AI for science

Data breach ticker

• Capcom confirms data breach affecting 11.7 million accounts
• Hackers steal customer data from major Russian hosting provider FirstVDS
• Defense contractors in two NATO allies hacked in recent Russia-linked campaign
• California warns all public school students of data stolen in contractor breach
• Railway warns devs to rotate secrets after potential breach
• Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected
• Burger King Japan data breach exposes 11 million customer records
• Retail giant Ahold Delhaize takes systems offline after cyberattack
• Nippon Columbia malware incident exposes 8.6 million karaoke fan records
• Cyberattack disrupts refrigeration at hundreds of French supermarkets