# Backend Technology Published articles for Backend Technology. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Two critical PHP flaws put the web on alert as emergency patches arrive DevFeed: [Two critical PHP flaws put the web on alert as emergency patches arrive]() Original publisher: [Read original article]() Author: Taryn Plumb Published: 2026-10-21T22:54:34Z Content type: news Language: en Sources: [InfoWorld]() Topics: [PHP](), [Security research](), [patches](), [Web]() Tags: [alert](), [appliances](), [backend](), [backend-technology](), [cert-eu](), [code-execution](), [critical](), [cve-2026-109618](), [cvss](), [cybersecurity](), [devices](), [drupal](), [emergency](), [europe](), [internet-security](), [internet-security-network-security-php-programming-languages-security-software-development-vul](), [language-en](), [network-security](), [patches](), [php](), [programming-languages](), [rce](), [remote-code-execution](), [security](), [software-development](), [storytype-news](), [the-web](), [vulnerabilities](), [web]() ### AI overview Two PHP flaws can enable unauthenticated remote code execution, and the PHP Foundation urged organizations to patch promptly. CVE-2026-109618 involves memory corruption during out-of-memory handling; CVE-2026-109619 involves stale request-owned global state reused by a later request on the same worker. The Foundation says web-serving PHP installations are at risk, with highest risk for Apache mod_php; PHP embedded in appliances and vendor products may also be affected. Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, and check Linux or LTS vendors for fixes, including backports for unsupported releases. For volunteer-maintained rpms.remirepo.net, the Foundation advises switching distribution packages or building from source. If immediate patching is not possible, CERT-EU recommends preventive measures but warns they do not make systems safe. Identify all PHP deployments, prioritize internet-facing systems, patch, and investigate for compromise; a patch may not remove access already established. Temporarily taking a service offline can be a proportionate choice when it cannot be patched or adequately protected. ### Source excerpt Organizations are scrambling to protect themselves following the disclosure of two critical vulnerabilities in commonly used code that powers much of the internet. The flaws discovered in the PHP scripting language could allow attackers to perform unauthenticated remote code execution (RCE). On Wednesday morning, the PHP Foundation released patches for affected versions, and said it is "imperative" that organizations running PHP patch immediately. It said that all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers the risk highest for mod_php, where an unauthenticated request can trigger exploitation before application code runs. In response to the disclosures, some government websites in Europe, including those in the Netherlands and Finland, as well as those of other organizations worldwide, went offline as a precautionary measure. PHP is 'the web itself' PHP is a widely-used, open source server-side scripting language that underlies websites like WordPress, which powers 43% of the web, as well as Mailchimp, Drupal, Magento, Laravel, and parts of Slack and Zoom, and numerous others. The impact is not limited to websites, noted the Netherlands National Cyber Security Centre (NCSC-NL) in its description of the flaws, collectively dubbed PHP2Shell. PHP is also embedded in appliances, network devices, management interfaces and other vendor products where administrators may not be able to update PHP directly. And CERT-EU, an organization that tracks cybersecurity threats in the European Union, also warned that many commercial and open-source products use PHP as a backend technology, and these could be also impacted by the flaws, even if they do not directly expose a PHP installation. This makes the vulnerabilities all the more serious. CVE-2026-109618, which has a 9.2 severity rating on the common vulnerability and scoring system (CVSS), could allow RCE via memory corruption during ## What Is Caching? A Complete Guide for Developers DevFeed: [What Is Caching? A Complete Guide for Developers]() Original publisher: [Read original article]() Author: Kashif Khan Published: 2026-10-14T15:27:26Z Content type: tutorial Language: en Sources: [Talent500]() Topics: [Cache](), [cache-invalidation](), [Redis](), [cache-control](), [Memcached]() Tags: [backend](), [backend-technology](), [cache-invalidation](), [caching](), [database](), [guide](), [latency](), [performance]() ### AI overview This guide explains how caching works across hardware and software layers, with examples of application, distributed, browser, and CDN caching. It covers cache hits and misses, performance benefits, expiration and invalidation, eviction, consistency, and security considerations. ### Source excerpt Caching improves application performance by storing frequently accessed data in temporary storage for faster retrieval. Explore caching strategies, types, implementation techniques, cache invalidation, and tools that help reduce latency, database load, and response times. The post What Is Caching? A Complete Guide for Developers appeared first on Talent500 blog.