EDITOR WIRE | 2026-10-21 | BLOCK 972527
BITCOIN $84,696 | GOLD $4,138 | OIL $105.53 | S&P 500 $7,759 | US 10Y 5.13%
GitLab patches critical unauthenticated code-execution flaw across older releases
GitLab has issued an urgent patch for CVE-2026-110264, a CVSS 10.0 flaw in the regular-expression compiler shipped with its Community and Enterprise editions. GitLab says that, under certain conditions, compiling a specially crafted expression could let an unauthenticated attacker run code on a self-managed server. Affected releases extend back to GitLab 7.0. GitLab has not disclosed the conditions needed to reach the vulnerable path, so the rating should not be read as proof that every exposed instance can be compromised with a single request.
The practical risk is control of the server running GitLab. If an attacker can get a crafted expression compiled through the vulnerable path and achieve code execution, they could attempt to access repositories, credentials or other data available to that server. Those are potential consequences of server-side code execution, not reported outcomes of an observed attack. GitLab has published detections for Onigmo native-worker crashes and bursts of Org-mode rendering errors to help self-managed operators investigate possible attempts.
GitLab also fixed separate authentication issues in this release. One could let a logged-in user take over an LDAP-backed account only where both OmniAuth SAML and LDAP auto-linking are enabled. Another could let an unauthenticated attacker poison a shared OAuth/OIDC discovery cache and redirect certain sign-in flows to an attacker-controlled server under affected conditions. Neither has the same prerequisites as the regex-compiler flaw.
Self-managed operators should upgrade promptly to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13, according to their release line. GitLab says GitLab.com is patched and specified GitLab Dedicated internal releases already contain the fixes. The 19.4.3 and 19.3.6 upgrades include database migrations; single-node administrators should plan for downtime while they complete.
Sources:
GitLab Docs
GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 | GitLab Docs
The Hacker News
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
GitLab fixes CVE-2026-110264, a critical flaw that could allow unauthenticated code execution on self-managed versions dating back to 7.0.
2026-10-21 20:00 UTC | BLOCK 972520
BITCOIN $84,534 | GOLD $4,134 | OIL $105.47
1. Ukraine and Norway Advance Shahed-Drone Defense Project
-- President Volodymyr Zelensky said Ukraine and Norway are working on three air-defense projects and expect equipment for countering Shahed drones in about six to eight weeks, Ukrinform reported.
-- Delivery on that timetable could strengthen protection of Ukrainian infrastructure, but the equipment is not yet in place as Russian strikes continue.
2. Tunisian Military Court Jails Opposition Leader Over Social Media Posts
-- A Tunisian military court sentenced opposition leader and US-Tunisian national Olfa Hamdi to four years in prison on charges stemming from social media posts, her lawyer told Al Jazeera.
-- Prosecuting political posts in a military court increases the legal risk of criticizing President Kais Saied’s government; Washington says it is closely tracking Hamdi’s case.
2026-10-21 19:00 UTC | BLOCK 972517
BITCOIN $84,748 | GOLD $4,141 | OIL $105.06
1. Israeli Jets Fly Toward Iran’s Border in Long-Range Sortie
-- Dozens of Israeli fighter jets and refueling aircraft flew through Syrian and Iraqi airspace toward Iran’s border Monday before turning back, Israeli and U.S. officials told Axios.
-- A flight path resembling a potential strike could be mistaken for an attack, increasing the risk of a military response even though the aircraft turned back.
2. IREN Secures License for 300 MW Data Center in Spain
-- Bitcoin miner and data-center operator IREN secured a license for a 300 MW data-center project in Spain, Blockspace Media reported.
-- The license advances a potential large-scale computing site but does not establish construction, power delivery or whether its capacity will serve AI hosting or Bitcoin mining.
2026-10-21 18:00 UTC | BLOCK 972514
BITCOIN $84,636 | GOLD $4,137 | OIL $104.92
1. Meta Ordered to Pay $25 Billion in New Mexico Privacy Case
-- Meta was ordered to pay $25 billion in New Mexico penalties connected to the Cambridge Analytica scandal, CNBC reported.
-- If the order stands, it would create a major financial liability and set a consequential benchmark for penalties tied to misuse of user data.
2. Supreme Court Keeps Federal Prison Gender-Care Restrictions Blocked
-- The Supreme Court rejected the Justice Department’s emergency request to lift an order preventing federal prisons from enforcing new restrictions on gender-affirming care while a lawsuit proceeds, the Guardian reported.
-- The restrictions remain on hold during the litigation; the justices have not decided whether the policy is lawful.
3. Taiwan Charges Five in Plot to Injure Comedian Who Mocked Xi
-- Taiwanese prosecutors charged five men with plotting to ram a car into comedian Huang Yi-hao after a person in China allegedly paid them to injure him over jokes about Xi Jinping and the Communist Party, the Guardian reported.
-- The case brings alleged cross-strait intimidation before Taiwan’s courts, though the charges do not establish that Chinese authorities directed the plot.
4. Police Document Flags Opponents of Flock Cameras at Council Meetings
-- A police surveillance document warns officers to watch for suspicious behavior among people opposing Flock cameras at city council meetings and to expect emotional confrontations, 404 Media reported.
-- Treating opposition to plate-reader deployments as a security concern could discourage residents from speaking at public hearings; the document does not establish that opponents committed crimes.
2026-10-21 17:00 UTC | BLOCK 972504
BITCOIN $84,744 | GOLD $4,136 | OIL $104.45
1. Russia Agrees in Principle to Resume Three-Way Ukraine Talks
-- After Vladimir Putin met U.S. envoy Steve Witkoff in St Petersburg Wednesday, Russian aide Yuri Ushakov said Moscow could resume talks with the U.S. and Ukraine around November 10; a U.S. official said both Kyiv and Moscow accepted a technical-level meeting.
-- Agreement to meet is not a ceasefire: Moscow called proposals Witkoff brought from Oslo unhelpful, leaving security guarantees and attacks on Ukrainian infrastructure unresolved.
EDITOR WIRE | 2026-10-21 | BLOCK 972502
BITCOIN $84,524 | GOLD $4,133 | OIL $104.78 | S&P 500 $7,751 | US 10Y 5.12%
Node.js patches Brotli code-execution flaw and TLS verification bypasses
Node.js has released security updates for its 22.x, 24.x and 26.x lines. The highest-severity fixes are rated high. They include an out-of-bounds write in the Brotli decoder that Node.js says can permit remote code execution, two TLS certificate hostname bypasses, and a DNS flaw that truncates names containing a NUL character. The releases also update bundled dependencies and root certificates, including changes related to the eMudhra intermediate CA compromise.
The practical attack paths depend on how an application uses Node.js. A service that decodes attacker-supplied Brotli data could expose its process to the memory-corruption flaw; Node.js identifies remote code execution as a possible outcome, not a demonstrated compromise of every service using Brotli. The TLS flaws could let a malicious endpoint pass hostname checks in the affected non-canonical IP cases, undermining applications that rely on those checks to authenticate a server. The DNS flaw could make an application resolve a different name from the one it intended if untrusted input containing a NUL reaches `dns.resolve()`.
Other fixes address a distinct risk for applications built from startup snapshots or single executable applications: cached values from `crypto.randomUUID()` and `randomInt()` could repeat across processes. If an application uses those values for identifiers or security-sensitive tokens, repetition could cause collisions or weaken assumptions about uniqueness. This does not mean all Node.js random values are predictable.
Operators should update to 22.23.4, 24.22.1 or 26.12.1, as appropriate for their release line, and restart affected services. The fullwidth-digit TLS bypass affects 24.x and 26.x; the Brotli, DNS and other hostname-checking flaws affect all three lines. These are possible attack scenarios based on the disclosed flaws—not evidence of exploitation in the wild.
Sources:
Node.js — Wednesday, October 21, 2026 Security Releases
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools a...
)
Node.js — Node.js 22.23.4 (LTS)
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools a...
)
Node.js — Node.js 24.22.1 (LTS)
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools a...
)
Node.js — Node.js 26.12.1 (Current)
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools a...
2026-10-21 16:00 UTC | BLOCK 972495
BITCOIN $84,638 | GOLD $4,140 | OIL $104.97
1. EU Investigates Booking.com Over Fake Listings and Scams
-- EU regulators opened an investigation into whether Booking.com breached the Digital Services Act by failing to adequately address fraudulent listings and phishing scams, the Guardian reported.
-- A finding of breach could force changes to the platform’s fraud controls; regulators have not determined that a violation occurred.
2. Polish Lawmakers Vote to Ease Abortion Ban, Facing Likely Veto
-- Poland’s lower house approved bills that would remove some penalties for people helping women obtain abortions and allow terminations for fetal abnormalities; the president is expected to veto them, the Guardian reported.
-- The vote changes no law yet, leaving patients and those assisting them subject to existing restrictions unless the bills complete the legislative process.
2026-10-21 15:00 UTC | BLOCK 972488
BITCOIN $84,090 | GOLD $4,131 | OIL $105.59
1. Israeli Forces Detain Olive-Harvest Volunteers in West Bank
-- Israeli forces detained about 80 US, Israeli and British volunteers near Bethlehem, including New York congressional candidate Brad Lander, who was later freed; Al Jazeera reported that dozens remained in custody.
-- Detentions during the olive harvest could restrict access to Palestinian farmland and draw diplomatic scrutiny from the volunteers’ home countries.
2. PHP Releases Emergency Fixes for Two Critical Flaws
-- PHP released fixes for vulnerabilities CVE-2026-109618 and CVE-2026-109619 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12; SANS reported early proof-of-concept code and exploit attempts.
-- Operators need patched packages or a supported PHP version; web-application firewall rules are not a substitute for fixing the affected installations.
EDITOR WIRE | 2026-10-21 | BLOCK 972488
BITCOIN $83,860 | GOLD $4,130 | OIL $105.44 | S&P 500 $7,712 | US 10Y 5.11%
PHP security release prompts precautionary shutdowns and a public exploit hunt
PHP has released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 under CVSS v4.0. The flaws can permit unauthenticated remote code execution under affected configurations. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The response was visible before the patches arrived. 4chan put its site into read-only mode, displaying a notice that it was awaiting “an urgent PHP security update.” It was not wholly offline when checked. WoodWing said it took its PHP-backed Cloud Studio environments offline as a precaution; NBC reported temporary outages at Pinboard and parts of Wikipedia, while the BBC reported government websites taken down in Finland and the Netherlands. Those are reported protective measures—not evidence that the sites were compromised.
PHP’s advance notice gave administrators a release time and severity rating but withheld technical details. Leaked claims and attempts to reconstruct the attack path turned the wait into an exploit hunt. One researcher published an analysis of PHP’s `session.upload_progress` handling, then corrected its central claim: the proposed route did not demonstrate code execution, though the researcher retained a use-after-free finding. PHP’s official advisories separately describe validated code-execution paths. A speculative public exploit, a confirmed vulnerability and an observed attack must not be conflated.
Administrators should update the PHP runtime serving web requests and restart affected workers. PHP says disabling session upload progress may block confirmed session-related paths but does not fix both flaws. Where a patch cannot be applied promptly, security agencies have advised restricting access or temporarily taking affected services offline. Neither a read-only notice nor an outage alone proves exploitation.
Sources:
PHP: News Archive - 2026
PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
GitHub
RCE via OOM corruption
## Summary
PHP uses `longjmp()` for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, ...
GitHub
RCE via stale global state
## Summary
PHP contains various global state, such as error, session, object and extension state that is retained by a worker but points to memo...
NBC News
Critical vulnerabilities in commonly used web code spark rush to update systems
As websites around the world race to patch the flaws, hackers have reportedly started exploiting them already.
BBC News
Websites taken down worldwide as critical PHP cyber-security update issued
The vulnerabilities with PHP, a programming language widely used across the internet, have been described as the most significant ever found by AI.
2026-10-21 14:00 UTC | BLOCK 972484
BITCOIN $83,527 | GOLD $4,138 | OIL $104.78
1. Bitcoin Core Publishes Version 32.0 Final
-- The Bitcoin Core project posted its final 32.0 release on GitHub Wednesday, following an earlier release candidate.
-- Node operators can now test a final build against their infrastructure before deciding whether to upgrade production systems.
2. Chrome Adds Warnings for Copied ClickFix Commands
-- Google is rolling out Chrome warnings for users with Enhanced Protection enabled who copy suspected ClickFix commands, The Hacker News reported.
-- The warning targets attacks that trick people into running malware outside the browser; users without Enhanced Protection are not covered by the announced safeguard.
3. Nvidia Unveils Containerized Vera Rubin AI Racks
-- Nvidia announced a shipping-container DSX Pod holding seven Vera Rubin racks and said it could begin serving AI tokens within 14 days, CNBC reported.
-- Faster installation could shorten deployment timelines for AI-cloud providers, though securing power and network connections remains a separate constraint.
EDITOR WIRE | 2026-10-21 | BLOCK 972487
BITCOIN $83,896 | GOLD $4,133 | OIL $104.97 | S&P 500 $7,731 | US 10Y 5.10%
eMudhra’s weak CA keys leave unpatched clients open to forged certificates
Eight eMudhra intermediate certificate-authority keys created in April 2025 were so weak that their private values could be recovered from the public certificates. Mozilla says all eight P-384 keys had values below 256. Six intermediates were authorized for TLS certificates and two for code signing. eMudhra says a flaw in a key-generation ceremony produced weak keys alongside strong ones, and the weak keys were mistakenly selected for certification. The company says its infrastructure and root private keys were not compromised.
**The concern is a man-in-the-middle attack against clients that still trust those keys.** Someone who can intercept or redirect a device’s connection could use a recovered intermediate key to forge a certificate for a website the attacker does not control. A client that accepts the forged chain could then be shown an apparently valid HTTPS connection while its traffic is read or modified. An old phone, embedded device, application or server with a stale trust store—and no effective revocation check or Certificate Transparency enforcement—may remain exposed even after the CA revokes the intermediates. Age alone does not establish vulnerability; the client’s *actual certificate-verification path* does.
There are important limits to the observed harm. eMudhra says none of the eight intermediates issued end-user certificates. Google found no certificates from the six TLS intermediates in Certificate Transparency logs before Chrome blocked them, ruling out their use against Chrome’s CT-enforcing path during that period. That does **not** rule out unlogged certificates accepted by clients without CT enforcement. No exploitation has been established.
Chrome and Firefox pushed blocks on October 17 without requiring browser restarts. Google says an equivalent update reached most Android devices through Play Services and that restarting can prompt it, but a restart is not proof that every old device or app is protected. Mozilla is removing trust in the parent ECC root for software that does not receive its intermediate block. eMudhra told Mozilla that roughly 30,000 *other* certificates under that root need migration; they were not issued by the eight weak intermediates.
**Mitigation:** Update the operating system, browser, applications, language runtimes and CA bundles that verify TLS; rebuild and redeploy services or containers that bundle their own trust stores. Check the *specific app or device*, not just a browser on the same machine: a successful browser test cannot certify a separate client. Where updates are unavailable, administrators should assess blocking the eight affected intermediates or distrusting **every applicable signing chain**, including cross-signs, using vendor or trust-store guidance. Removing a broadly trusted root can break legitimate connections and is not a casual end-user fix. If a device cannot receive a trustworthy update or block, keep it away from sensitive connections until it can be replaced or isolated. Do not bypass certificate warnings or disable verification to restore connectivity. Operators serving certificates under the distrusted ECC root should obtain replacement certificates from another trusted hierarchy.
Sources:
2083449 - eMudhra: Private key compromise of Intermediate Certificates
ASSIGNED (naveen.ml) in CA Program - CA Certificate Compliance. Last updated 2026-11-10.
Mozilla Security Blog
Protecting Firefox users following the compromise of eMudhra intermediate certificates – Mozilla Security Blog
On Saturday, October 17, at 20:06 UTC, Mozilla received a report that private keys associated with eight eMudhra intermediate certificates had been...
Google
Protecting Chrome and Android Users from Compromised eMudhra Intermediate CA Certificates
The Chrome Root Program received a report from a security researcher regarding the compromise of private keys associated with eight eMudhra subordi...
eMudhra Statement on Recent Certificate Security Incident
eMudhra’s statement on a security incident involving a specific set of intermediate CA certificates, with updates as the investigation progresses.
oss-security - eMudhra Intermediates Compromise
Cloudflare Blog
8 eMudhra certificates are compromised. Here's what you need to know
Following the discovery that eight eMudhra intermediate certificates use weak keys, Cloudflare is deploying mitigations and releasing client update...
we-have-a-problem.com
eMudhra Intermediate CA Compromise
The private keys of eight eMudhra intermediate CA certificates, trusted by major root programs, have been compromised. Check whether your client is...
2026-10-21 13:00 UTC | BLOCK 972478
BITCOIN $83,592 | GOLD $4,126 | OIL $105.14
1. Gulf Oil Exports Climb Above Prewar Levels
-- Daily shipments from Gulf producers average 24.6 million barrels, up from 23.3 million before the conflict, as ships use alternative routes, the Financial Times reported.
-- Higher volumes ease immediate supply constraints, but reliance on diversions leaves deliveries exposed to further attacks or route closures.
2026-10-21 12:00 UTC | BLOCK 972469
BITCOIN $83,394 | GOLD $4,133 | OIL $105.86
1. Russia Plans First Diesel Cargo to United States
-- Russian Deputy Prime Minister Alexander Novak said a tanker carrying 40,000 tonnes of diesel is scheduled to depart for the United States on Thursday, Ukrinform reported.
-- The shipment would put Washington’s Russia-diesel sanctions relief into practice as U.S. lawmakers seek to block the arrangement; the tanker has not yet departed.
2026-10-21 11:00 UTC | BLOCK 972455
BITCOIN $83,280 | GOLD $4,125 | OIL $107.19
1. Microsoft Retracts Claim That October Updates Fixed VPN Bug
-- Microsoft said it mistakenly marked an Always On VPN connection bug as fixed in its October Windows 11 updates; affected connections can still stall or fail.
-- Administrators using automatic protocol selection can switch affected VPN profiles to SSTP-only or IKEv2-only while awaiting a permanent fix, which Microsoft plans to release in the coming weeks.
2026-10-21 10:00 UTC | BLOCK 972452
BITCOIN $83,516 | GOLD $4,122 | OIL $106.56
1. Putin Announces Release of Jailed American During Witkoff Talks
-- Putin said Russia had released Stephen Hubbard, an American convicted of fighting for Ukraine, during talks with U.S. envoy Steve Witkoff in St Petersburg; Russian state media said Hubbard had been taken to an airport.
-- The release does not establish that Moscow has accepted the Ukraine ceasefire and security proposals Witkoff brought from his talks with Zelensky.
2. French 10-Year Bond Yield Hits 5% for First Time Since 2002
-- France’s 10-year bond yield reached 5% Wednesday amid concerns over public finances and political stability, the Financial Times reported.
-- Higher yields increase the cost of refinancing French debt as protests add to demands for public spending.
3. SafePay Ransomware Breaches More Than 600 Critical-Infrastructure Organizations
-- CISA said SafePay ransomware has breached more than 600 critical-infrastructure organizations worldwide since 2024, BleepingComputer reported.
-- The total spans multiple years, not a single outbreak; essential-service operators face recovery and continuity risks if attackers retain access to their networks.
2026-10-21 09:00 UTC | BLOCK 972442
BITCOIN $83,160 | GOLD $4,122 | OIL $106.55
1. Russian Strikes Hit Ukrainian Power Sites and Merchant Vessel
-- Ukraine's prime minister said overnight Russian attacks hit energy facilities in four regions and a merchant vessel in the Black Sea; strikes also killed two people in Kyiv and two near Kharkiv, Ukrinform reported.
-- Damage across several power regions could complicate repairs, while the reported vessel attack adds risk for Black Sea shipping; the extent of damage to the ship was not specified.
2. U.S. Envoy Arrives in Russia as Zelensky Says Early Warnings Work
-- Steve Witkoff arrived in St Petersburg Wednesday for talks with Vladimir Putin after meeting Volodymyr Zelensky in Oslo; Zelensky said U.S. intelligence sharing for missile warnings "works now," the BBC reported.
-- Functioning early warnings could give civilians more time to shelter, but Moscow has not accepted the ceasefire and security proposals discussed in Oslo.
3. U.S. Ambassador Acknowledges Strains in South Korea Alliance
-- Ambassador Michelle Steel described U.S.-South Korea relations as being in "turbulence" Wednesday amid disputes over North Korea intelligence sharing, wartime command and treatment of U.S. companies, Yonhap reported.
-- Those disputes could delay implementation of last year's investment, shipbuilding and nuclear-energy commitments; Steel announced no resolution.
4. South Korean Court Cuts Ex-Minister's Martial-Law Sentence to Nine Years
-- An appeals court reduced former justice minister Park Sung-jae's prison sentence from 25 years to nine after overturning some convictions tied to former president Yoon Suk Yeol's 2024 martial-law declaration, Yonhap reported.
-- The partial reversal narrows the criminal findings against a former cabinet member without clearing him and may shape arguments in related martial-law cases.
5. Britain Indefinitely Recognizes CE-Marked Medical Devices
-- Britain confirmed Wednesday it will continue recognizing CE-marked medical devices and diagnostic tests in Great Britain indefinitely; more than 90% of registered devices already carry the mark, the government said.
-- Manufacturers can continue supplying EU-approved devices without a second British approval route, while the MHRA retains post-market safety oversight.
2026-10-21 08:00 UTC | BLOCK 972438
BITCOIN $82,996 | GOLD $4,122 | OIL $106.09
1. UK Borrowing Reaches £24.5 Billion Ahead of Budget
-- The UK borrowed £24.5 billion in September, above forecasts, while debt interest reached a September record of £10.9 billion, according to official figures cited by the Financial Times and Guardian.
-- For fiscal policy, higher borrowing and debt-interest costs narrow Chancellor John Healey’s room to fund spending or cut taxes in the October 28 Budget.
2. UK Approves North Sea Jackdaw Gasfield
-- The UK government approved development of the Jackdaw gasfield, about 150 miles east of Aberdeen, according to its announcement and the Financial Times.
-- For UK energy investment, approval removes a regulatory obstacle to developing the field but does not establish when gas production will begin.
3. Australian MP Loses Both Legs After Alleged Car Attack
-- Independent MP Helen Haines has lost both legs following Monday’s alleged car attack in Wangaratta, her husband said Wednesday; she remains in stable condition.
-- For parliamentary security, Victoria is taking new steps to protect politicians, while investigators have yet to establish a motive that could inform protections at other electorate offices.
4. South Korean Election Official Found Dead During Procurement Inquiry
-- A National Election Commission official was found dead Wednesday after being questioned as a suspect in an inquiry into election-supply bidding; police suspect he jumped from his apartment, Yonhap reported.
-- For legal oversight, the death brings the special counsel’s questioning practices under scrutiny as its election-procurement inquiry continues; the team denies coercion.
2026-10-21 07:00 UTC | BLOCK 972430
BITCOIN $82,784 | GOLD $4,117 | OIL $106.64
1. UK Inflation Rises to 3.5% as Fuel Costs Climb
-- Annual UK inflation rose from 3.1% to 3.5% in September, the Office for National Statistics said, as petrol and diesel prices increased.
-- The reading strengthens expectations of a Bank of England rate rise in November and complicates the government's choices ahead of its October 28 Budget.
2026-10-21 06:00 UTC | BLOCK 972422
BITCOIN $82,832 | GOLD $4,125 | OIL $106.48
1. PHP Schedules Emergency Fix for Two Critical Code-Execution Flaws
-- PHP plans an out-of-cycle release at 14:00 UTC for two flaws rated 9.2 under CVSS v4.0; watchTowr researchers say they permit remote code execution, and no exploitation has been reported.
-- Only supported PHP branches 8.2 through 8.5 can receive the fix, leaving operators on older branches needing an upgrade rather than a patch for their current version.
2. Australian Police Warn AI Is Accelerating Child Radicalization
-- At a parliamentary inquiry Wednesday, federal police said 65 children as young as 12 had been subject to operations since 2020, including 35 charged with terrorism-related offenses; an acting deputy commissioner said AI was speeding radicalization.
-- The figures span six years and do not establish how many cases involved AI; the inquiry’s March report could shape prevention policy.
2026-10-21 05:00 UTC | BLOCK 972420
BITCOIN $82,760 | GOLD $4,120 | OIL $106.39
1. Netanyahu Seeks Renewed Iran Strikes as Trump Opposes Pre-Midterm Attack
-- Israel planned a major operation against Iran earlier this month but held back; Prime Minister Benjamin Netanyahu now seeks renewed strikes while President Trump rules out an attack before the U.S. midterms, the Financial Times reported.
-- The disagreement leaves the timing of any operation unsettled and could complicate U.S.-Israeli military coordination; no renewed strike has been announced.