BleepingComputer reports that two critical remote-code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been successfully exploited in the wild. Collectively called PHP2Shell, the flaws make identifying affected PHP deployments and checking patch status an immediate operational priority.
The Hacker News reports two critical Wasmtime vulnerabilities that could allow malicious WebAssembly modules to escape their sandbox. Exploitation requires a vulnerable build to compile an attacker-controlled module, and one flaw affects only ARM64 systems. Teams embedding Wasmtime should review their runtime versions and the maintainers' fixes.
TechCrunch reports that Apple's new iPad mini introduces an OLED display and a faster A20 Pro chip. The device also has a thinner and lighter design than its predecessor, updating both its display hardware and portable form factor.