PHP has released fixes for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP-FPM is affected too; updating WordPress or another CMS does not fix the PHP engine.

Update to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 (or newer), or verify that your distribution/vendor has backported the fixes into its packages.

Restart PHP-FPM or the relevant PHP-serving processes after updating, and verify the runtime actually handling web requests. `php -v` only checks the CLI and may show a different installation.

If you use managed hosting, ask your provider to confirm that the fixes are applied. Configuration changes alone are not a complete fix.

Hi everyone,

Terminal commands are great, but visualizing server state as a topology graph helps spot misconfigurations instantly. I built Kubo to map a Linux server’s files, UFW/Nginx network exposure, and systemd services into an interactive graph.

Key design choices:

• 100% Open Source: Public code on GitHub after community feedback.
• No Telemetry / No Cloud: Direct SSH connection only.
• Safeguards: Visual 664/755 permission editor, local command execution audit logs, and hardcoded protection against stopping SSH.

It runs natively on Windows and Linux.

website: kubo.gemmi-e.com

I'd love to hear your feedback on the network visualization mapping!