Day's Snapshot by WRF – 24 Oct 2026
Five stories from the last day: a third PHP2Shell flaw, Ruby's fix behind the GitLab bugs, AWS Lambda Web Functions, the Quest Diagnostics breach, and Cloudflare's memory savings.
A third PHP2Shell flaw will not get an emergency fix
The PHP Foundation reserved CVE-2026-115560 for a third remote code execution bug alongside the two PHP2Shell flaws patched earlier. It needs an unusual mix of configuration and application code, so the fix will wait for the next regular PHP release. Setups that switch the session handler at runtime with session upload progress enabled are affected, and the advice is to set session.upload_progress.enabled to 0 until then.
Why it matters: If an agency runs your PHP site, ask whether it has applied the session setting and how it will track the regular release.
Ruby patches the regex bugs behind four critical GitLab flaws
Ruby released 4.0.9, 3.4.12 and 3.3.13 to fix three memory bugs in its built-in regular expression engine. Applications that build regular expressions from attacker-controlled text are exposed, and Ruby 3.2 and earlier will not receive a fix. Self-managed GitLab administrators are told to install a patched GitLab release such as 19.5.1 or 18.11.13.
Why it matters: Ask your engineering partner which Ruby versions it runs and whether any code compiles patterns from user input.
AWS adds Lambda Web Functions for Node.js apps
Lambda Web Functions run Express or Hono web applications directly on Lambda, with concurrent requests and response streaming. Billing follows active CPU time and memory instead of time spent waiting on other services. It supports Node.js only for now and is available in five regions: Northern Virginia, Ohio, Oregon, Tokyo and Ireland.
Why it matters: Cloud migration partners may now propose serverless for web apps. Ask for cost modelling against your real traffic.
Quest Diagnostics confirms patient data was taken in a platform attack
Quest told the SEC that an attack on its Quanum lab-testing platform, used by doctors' offices and hospitals, included access to certain patient records. It has not said how many patients or customers are affected, and the specific data types are still under investigation. Law enforcement has been notified.
Why it matters: When choosing partners for healthcare systems, ask how they handle third-party platform risk and breach response.
Cloudflare frees more than 100 TB of RAM in its request router
Cloudflare reduced the memory used by pingora-ketama, the Rust consistent-hashing code behind its Pingora Backend Router. Using statistical analysis it cut hashes per backend by about 90% and shrank each stored hash point from 8 bytes to 6, rolling the new ring out gradually.
Why it matters: A reminder to ask performance-focused partners for measured results, not just a promise of efficiency.