News

RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

https://www.php.net/ChangeLog-8.php#8.5.12

https://www.php.net/ChangeLog-8.php#8.4.27

https://www.php.net/ChangeLog-8.php#8.3.36

https://www.php.net/ChangeLog-8.php#8.2.35

https://github.com/php/php-src/blob/php-8.6.0RC4/NEWS

Release URL: https://github.com/Bearsampp/module-php/releases/tag/2026.10.22

18 Oct 2026

Bearsampp October Release!

What's Changed

Added statistics page on resource usage of the stack
Remove stray quickpick-releases artifact folder
Fix combine_releases workflow leaking quickpick-releases artifact folder
Fixes Bearsampp/sandbox#272
Add dynamic download statistics section to README
Dropping old versions of mysql
Refactor class.util.php
Changed Quickpick functionality to be available to everyone with no subscription required

Full Changelog: 2026.9.13...2026.10.13

Release URL: https://github.com/Bearsampp/Bearsampp/releases/tag/2026.10.13

14 Oct 2026

PHP 8.6.0 RC3 Released!

https://php.watch/versions/8.6/releases/8.6.0RC3#changelog

Release URL: https://github.com/Bearsampp/module-php/releases/tag/2026.10.11

12 Oct 2026

Apache 2.4.69 Security Release

Security release!

Multiple vulnerabilities. See changelog

https://www.apachelounge.com/Changelog-2.4.html

Release URL: https://github.com/Bearsampp/module-apache/releases/download/2026.10.11/bearsampp-apache-2.4.69-2026.10.11.7z

12 Oct 2026

Nodejs 26.11.1 release

https://nodejs.org/en/blog/release/v26.11.0 - original release
https://nodejs.org/en/blog/release/v26.11.1 - hotfix

Release URL: https://github.com/Bearsampp/module-nodejs/releases/tag/2026.10.11

05 Oct 2026

Git 2.56.0.2

New Features

Comes with OpenSSL v3.5.9.
To help with fixing stale references to the Git Credential Manager after Git for Windows v2.56.0's MINGW64 -> UCRT64 migration, a compatibility shim is now installed.

Bug Fixes

Suppressing the user-wide Git config via GIT_CONFIG_GLOBAL=NUL was broken in v2.56.0 (surprisingly, as a consequence of the MINGW64 -> UCRT64 migration), which was fixed.
Fixed a bug in Git for Windows, v2.56.0, where the x64 Git executables lost their Authenticode signatures by mistake.
An assertion was fixed that caused pushes to fail when the server requires a client certificate.

Release URL: https://github.com/Bearsampp/module-git/releases/tag/2026.10.5

05 Oct 2026

Mailpit 1.31.4 Released!

Fix
Prevent duplicate messages from being added in websocket handlers (axllent/mailpit#737)
Set hostname for HELO/EHLO in SMTP client creation (axllent/mailpit#738)

Release URL: https://github.com/Bearsampp/module-mailpit/releases/tag/2026.10.4

04 Oct 2026

Bruno 4.2.0 Released!

https://github.com/usebruno/bruno/compare/v4.1.0...v4.2.0

Release URL: https://github.com/Bearsampp/module-bruno/releases/tag/2026.9.24

Changelog

Release Files

Security release!

Vulnerabilities

Changelog

Release Files

Changelog

General Cmdlet Updates and Fixes

Release Files

Security release!

Vulnerabilities

Changelog

New Features

Release Files

Security release!

Vulnerabilities

Changelog

Release Files

What's Changed

Release Files

Changelog

Release Files

Security release!

Vulnerabilities

Changelog

Release Files

Changelog

Release Files

Changelog

New Features

Bug Fixes

Release Files

Changelog

Release Files

Changelog

Release Files

Our Supporters