Developer Security News: PHP2Shell, a Fake Claude Code Extension, Black October and a Linux TCP Bug
The last two weeks of October 2026 were rough for anyone who builds or hosts software. PHP shipped emergency fixes for two critical bugs that are now being exploited, a fake version of a popular AI coding extension appeared in an editor marketplace, at least nine AI developer platforms reported breaches, and a critical Linux kernel bug in TCP handling is still waiting for patches on some