Suricata

Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Enable Unauthenticated Remote Code Execution

Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, both scoring CVSS 9.2, were disclosed on October 21. The flaws allow attackers to execute arbitrary code without authentication by triggering out-of-memory conditions that lead to use-after-free memory corruption. Exploitation involves specially crafted requests that manipulate uninitialized arrays and function pointers, with full chains demonstrated via PHP_SESSION_UPLOAD_PROGRESS and fatal error backtraces. The issues affect PHP versions starting from 5.4 and were discovered using AI tools Gemini 4 Argon and GPT-5.6 Sol, resulting in a patch exceeding 10,000 lines of code. Amazon detected attacks as early as October 17, with Cloudflare later reporting millions of exploitation attempts. Mitigation requires updating to patched versions such as PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, while temporary workarounds include disabling session upload progress and fatal error backtraces.

Building a Minimal Open Source Security Stack for Infrastructure Protection

The article outlines a practical approach to assembling a basic cybersecurity stack using open source tools for organizations with limited budgets. It covers endpoint protection with ClamAV, network perimeter defense via pfSense including Snort and Suricata integration, centralized logging with ELK Stack or Wazuh, and identity management through Keycloak. The guide emphasizes that these solutions provide foundational capabilities but require careful configuration, regular updates, and community validation to avoid risks from unmaintained projects. Detailed installation steps, rule configuration examples, and integration advice are provided for each component. The author stresses that open source options serve as an entry point rather than a full replacement for commercial platforms like Kaspersky or Symantec.

Why Deep Packet Inspection Overestimates Its Reach in Encrypted Networks

Modern encryption has fundamentally limited the effectiveness of Deep Packet Inspection systems, leaving network monitors with only metadata and behavioral patterns rather than actual content. DPI tools can still classify traffic types and apply policies based on visible flow characteristics, but they cannot read messages, files, or credentials inside properly encrypted sessions without explicit TLS inspection. The article details how TLS 1.3, Encrypted Client Hello, and QUIC further reduce passive visibility while corporate inspection remains possible only when endpoint devices trust an organizational certificate. Russian regulatory requirements around TSPU systems are discussed separately from corporate DPI use, with emphasis on the need for technical confirmation rather than assumptions. The piece also clarifies distinctions between DPI, IDS, IPS, and DLP, and explains why machine learning cannot convert metadata into decrypted payloads. Overall, the analysis shows that DPI remains useful for traffic management and known-threat detection where visibility exists, but it cannot serve as a complete security foundation.