Two Next.js RCEs, PHP2Shell and Arc's last call

Upgrade Next.js before your coffee cools, then check PHP logs going back to October 17.

The main thing

If you run Next.js 16.0.0 through 16.4.0 with the App Router, you have a new first task this morning. Two critical remote code execution advisories for next landed together, and one of them has no known workaround for affected apps.

The headliner is GHSA-673q-mjm6-r5xr. It covers apps that use the App Router with Cache Components. An attacker can run code without logging in if the app has a use cache function that returns multiple typed arrays. The advisory rates it Critical, 9.5 on CVSS v4: reachable over the network, no privileges needed, no user interaction.

The advice is the unusual part. The advisory says there is no known workaround for affected apps, and that you should upgrade immediately even if your app has no function like that. When maintainers tell people outside the blast radius to patch anyway, take the hint.

The second advisory, GHSA-2464-fhr4-w9xw, is in the Image Optimization API. A memory bug in an upstream library can lead to remote code execution through SVG files when Next.js runs on glibc-based Linux. That one has a way out, and it's in the patch roundup below.

• Advisory: GHSA-673q-mjm6-r5xr, Critical, CVSS 9.5
• Package: next (npm)
• Condition: App Router with Cache Components, plus a use cache function that returns multiple typed arrays
• Workaround: none known for affected apps
• Affected versions: 16.0.0 through 16.4.0
• Fixed in: 16.4.1

What to do today: if you run next 16.0.0 through 16.4.0, upgrade to 16.4.1 and redeploy. The advisory says to do this even if you've never written use cache. While the lockfile is open, check that sharp resolves to 0.35.5 or later.

Quick bits

PHP2Shell exploit attempts came before disclosure. Amazon saw an attempt against CVE-2026-109618 and CVE-2026-109619 on October 17, four days early, and more from several actors on October 21 before the embargo lifted. It says it's unclear whether those October 21 attempts would have worked on real systems, and that PHP2Shell now sees broad exploitation attempts in the wild. Upgrade to the fixed PHP versions; Amazon says that is the only complete fix. If you can't yet, consider blocking multipart uploads after you check what that breaks. Then investigate from October 17: look for POST requests carrying PHP_SESSION_UPLOAD_PROGRESS, review web server logs, and check web servers for unexpected processes or file changes. (discussion)

More code, not more shipped. A Harvard study of 718 firms found AI agents raised lines of code by 30% but resolved issues by only 12%. PR review time went up 49%. Your reviewers are the bottleneck, and they would like a word.

Anthropic-managed Claude is generally available on Google Cloud. It has the same models, pricing and Google billing as the Google-managed option. The difference: Anthropic is the data processor, and platform features like skills and code execution arrive on day zero. If you need CMEK or VPC Service Controls, stay Google-managed.

Arc stops working December 22. New accounts ended October 22. On December 22, Arc for macOS and Windows stops working and account data is deleted within 30 days. Import into Dia, or export through Settings → Advanced → Export Data (on Windows it sits under Export Spaces and tabs). The export saves your tabs as a list of links. Pour one out for the sidebar.

HTML-in-Canvas enters origin trial. In Chrome 148 through 150 you can draw live DOM into a 2D canvas or a WebGL/WebGPU texture, and text selection, find-in-page and the accessibility tree keep working. Yes, Ctrl+F now searches your 3D mesh.

Six ways one click becomes two orders. Most duplicate requests are harmless, like React Strict Mode in development. The expensive one is a client that times out and retries after the server already did the work. A disabled button is UI feedback, so put the real safety check on the server.

"I'm 93% confident" is a string. A model's self-reported score is not a probability until you test it against real outcomes. Log each decision with its ground truth, plot coverage against selective accuracy, and check again after every model swap.

Patch roundup

• Next.js Image Optimization (GHSA-2464-fhr4-w9xw): upgrade next to 15.5.28 or 16.4.1. If you can't yet, make sure sharp resolves to sharp@0.35.5 or later.
• Ruby Regexp fixes: Ruby 4.0.9, 3.4.12 or 3.3.13
• Pillow (CVE-2026-96639): affects 11.0.0 and every release before 13.0.0; upgrade to Pillow 13.0.0, a major version, before you process multi-frame uploads
• DOMPurify (GHSA-cg2g-xh64-v4q7): the advisory lists 3.4.17 as the fix for 3.4.4 through 3.4.16, but its own write-up says no release had the shadow-root fix when it was filed. If you combine SAFE_FOR_TEMPLATES with a DOM-returning mode, upgrade and confirm the fix before you rely on it.
• Django REST framework (CVE-2026-114137): upgrade to 3.18.2. If you revoked tokens on 3.12.0 or later anywhere other than DRF's own admin, check that those tokens no longer authenticate.
• Claude Code: 2.1.309

Also in today's security news, without a line each: Sentry's Next.js tunnelRoute advisory, Next.js Server Actions CPU exhaustion, PyJWT accepting empty HMAC keys, Pillow wheels reportedly bundling a vulnerable libopenjp2, Pillow's JPEG comment heap overflow, DOMPurify in-place hooks, Django REST framework JSON memory limits, the Black GitHub Action's required-version input, nbconvert file writes, Jupyter gateway WebSocket authorization, Linux kernel bugs reportedly disclosed by accident, TOML parser and GraphQL Tools prototype pollution, GraphQL-core comment tokens, QPACK amplification on HTTP/3 servers, a report of 333 hijacked Tor exit nodes, Anthropic's opt-in scans for open-source projects, Vercel's push to retire static credentials, 1Password's new way for AI agents to log in without seeing your password, and AWS Continuum reaching general availability.

Patch first, coffee second. Fine, coffee during.

← All issues