News Flash, Thursday, October 29, 2026

Transcript

This is the OpenSight News Flash for Thursday, October 29, 2026. This episode is read by an AI voice.

PHP patches two critical remote code execution flaws in all supported lines. The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, rated 9.2 under CVSS 4.0 in the advance notice. CVE-2026-109618 lets an out-of-memory condition leave request data half initialised, which cleanup code may then trust. CVE-2026-109619 lets internal state from one request outlive its memory and be reused by a later request on the same worker. Both can lead to remote code execution without authentication, and every setup that serves web requests is affected, with mod_php named as the highest risk. That report is from PHP project.

Kubernetes starts a working group to define workload conformance. The Kubernetes community has formed a Workload Conformance Working Group. Certified Kubernetes already tests clusters, and the AI Conformance programme tests whether a cluster can run AI workloads, but nothing comparable exists for the applications themselves. Operators still check each workload by hand before a node drain or an upgrade. The charter names three deliverables: a specification of workload behaviour per Kubernetes minor version, a method to test each requirement against a running workload, and upstream tooling that runs those tests. That report is from Kubernetes project.

Fed holds rates at 3.75 to 4 percent, two officials vote for another hike. The Federal Open Market Committee kept the federal funds target range at 3.75 to 4 percent at its meeting ending on 28 October 2026. The vote was 10 to 2: Lisa Cook and Beth Hammack dissented, both preferring a further quarter-point increase. The pause follows a unanimous hike in September that lifted the range to its current level. The statement describes economic activity as expanding at a strong pace, with solid productivity growth and business investment. That report is from Board of Governors of the Federal Reserve System.

EU cites EN 18286 as the first harmonised standard under the AI Act. The European Commission has referenced EN 18286:2026, Artificial intelligence - Quality management system, in the Official Journal through Implementing Decision (EU) 2026/2274. It is the first harmonised standard under the EU AI Act. The standard was prepared by the European standards bodies CEN and CENELEC. A cited harmonised standard gives a presumption of conformity under Article 40 of the Act. That report is from Publications Office of the European Union (EUR-Lex).

Every item, with its sources, is on opensight.ch/news. Thank you for listening.