• Mon - Fri 9.00 - 19.00
Open

Blog

Tamara's World  /  Blog
25 Oct 2026
Software developer reviewing PHP code on a laptop after the PHP2Shell critical vulnerabilities disclosure

Two Critical Bugs Just Forced PHP’s Biggest Emergency Patch in Years

Categories Tech

Two newly disclosed bugs in PHP triggered emergency patches this week. PHP is the programming language that still runs a majority of the world’s websites. A researcher’s early leak forced the PHP security team to move its planned fix forward by a full day. The PHP2Shell critical vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. They let an attacker run their own code on a vulnerable server with no login required. Cloudflare says real-world attacks began within a day of disclosure.

What the PHP2Shell critical vulnerabilities actually do

Security firm watchTowr confirmed both flaws are genuine. It did this by reproducing CVE-2026-109618 in its own lab. The firm is withholding technical detail until site owners have had time to patch. PHP’s advisory rates each bug at 9.2 out of 10 under the CVSS v4.0 scoring system. watchTowr and an early, since-deleted post on Hacker News rated them a full 10 out of 10. Researchers do not fully agree on severity. Everyone agrees the bugs allow remote code execution without authentication, which is the most dangerous category a web vulnerability can fall into.

Server room racks representing the websites exposed by the PHP2Shell critical vulnerabilities

That matters because PHP sits underneath content management systems, e-commerce platforms, and custom business applications across a huge share of the internet. A successful exploit can let an outsider plant malware. It can also let them steal a database or take over a server outright. Smaller sites running outdated or unmanaged PHP installs face the highest risk, since larger platforms often patch faster.

A leak forced the patch timeline forward

PHP’s security team originally planned to disclose the flaws and release a fix on a Thursday morning. That plan fell apart fast. According to watchTowr, a Hacker News user going by “petecooper” posted the CVE numbers publicly before the coordinated release. PHP published its advisory on October 20, 2026. It pushed out emergency patches the next day, October 21, at 14:00 UTC, rather than wait for the original schedule.

That compressed timeline is part of why the bugs are dangerous right now. Attackers had the CVE numbers before most site operators had a patch to apply. A coordinated disclosure is designed to close that exact gap. This time, the gap opened early instead.

Cloudflare is already seeing exploitation attempts

Within a day of the advisory, Cloudflare told customers it was observing active attack traffic targeting the flaw. The company rolled out web application firewall rules to catch it. Cloudflare describes the protection as temporary, not a substitute for patching. Singapore’s Cyber Security Agency issued its own alert urging administrators to update immediately. Outlets including BleepingComputer have been tracking the advisory as it developed.

PHP core developer Gina Peter Banyard has been direct about the available options. There is no verified workaround. Some researchers have floated disabling PHP’s session upload progress feature. Others suggested blocking multipart/form-data requests at the web server level. Banyard has said the only real fix is applying the official patch. Blocking multipart requests outright will break ordinary file uploads and web forms for legitimate users too, so it is not a safe substitute.

What website operators should do now

Anyone running a self-hosted PHP application should act now. That includes WordPress, Drupal, and custom-built sites. First, confirm your hosting provider or server has applied PHP’s October 21 patch. Managed hosts typically roll this out automatically. Sites on dedicated or self-managed servers need an administrator to update PHP directly. Singapore’s Cyber Security Agency advisory recommends checking server logs for unusual POST requests to upload endpoints, since that pattern can signal an attempted exploit.

Sites that cannot patch immediately should at least ask their host whether its firewall has been updated to match Cloudflare’s temporary rules. An unpatched server with no protection at all is the highest-risk setup right now. Businesses that outsource hosting should not assume their provider has already handled this. A short email asking directly is worth the five minutes it takes.

Website owners outside the direct hosting chain still carry some risk. Plugin and theme developers for platforms like WordPress often bundle their own PHP code. That code can introduce separate vulnerabilities even after the core patch lands. A full security review after patching, not just confirming the update installed, is the more complete response.

Why this keeps happening to widely used software

PHP has existed since the mid-1990s, and much of the web’s infrastructure was built on top of it long before today’s security practices existed. That long history is part of the problem. watchTowr believes the flawed code has likely existed since PHP 5, meaning it survived multiple major rewrites of the language without being caught. Older code paths that handle file uploads and session data tend to get less scrutiny than newer features, simply because fewer people are actively working on them.

Security teams at hosting companies now face a familiar scramble. They must patch servers fast without breaking live sites. A rushed patch can cause its own problems if it is not tested properly first. Most hosting providers run PHP in a shared environment, where a single oversight can affect many customer sites at once. That shared-infrastructure risk is part of why Cloudflare moved so quickly with its own firewall rules. The rules bought extra time for providers that could not patch every server instantly.

What happens next for PHP site operators

Expect PHP’s security team to publish more technical detail once patch adoption climbs. That detail will likely make the flaw easier to exploit for anyone who still has not updated. watchTowr has said it will hold back its proof-of-concept write-up for the same reason. The practical lesson for administrators is simple. The gap between disclosure and patching is now the most dangerous window in any vulnerability’s life, and this time that window opened a day early because of the leak.

For more on how major technology firms are handling security and capacity pressure this year, see Tamara News’ coverage of Google Cloud’s new AI chip instances and Nvidia’s rapid AI factory rollout.

25 Oct 2026
USCIS deference proposal

US Proposes Ending Deference on Work Visa Extensions

Categories Immigration, Visa Updates, Work Permits

The USCIS deference proposal is the US Department of Homeland Security’s plan to end the rule that tells US Citizenship and Immigration Services (USCIS) to defer to prior approvals when it reviews work-visa extensions. The proposal was published in the Federal Register on 14 October 2026 and would delete 8 CFR 214.1(c)(5). It is only a proposal: the current deference rule stays in force unless and until DHS issues a final rule. Public comments close on 13 November 2026.

In this report

What DHS proposes

Under the current regulation, when USCIS decides an extension petition on Form I-129 involving the same parties and the same facts as an earlier approval, it generally defers to that earlier decision. The exceptions are a material error, a material change, or new material information that hurts eligibility. DHS says removing the provision places the burden of proof squarely on the petitioner and leads to a fuller review. Officers could still consider a prior approval where relevant, but it would carry no automatic weight.

Law firm Manifest Law, in its summary of the proposal, lists H-1B, L-1, O-1, TN and E classifications among the extensions that could be affected. Eligibility standards for each category would not change. What changes is how much an officer may rely on what was already decided.

DHS’s own estimates

The figures below come from DHS’s notice and should be read as the agency’s claims, not independent findings. DHS says about 208,429 Form I-129 petitions a year, out of roughly 688,830, were eligible for deference on average between fiscal years 2022 and 2025. It estimates the change would raise the rate of requests for evidence (RFEs) by 2.9 percentage points, or about 6,044 additional RFEs a year, and says it found no corresponding change in denial rates. It puts added cost to petitioners at about $133,987 a year.

Manifest Law reports that DHS justifies the change partly with worksite-inspection data, citing fraud or noncompliance findings of 22.4% for H-1B extensions in fiscal years 2022 to 2025, against 16.8% in fiscal years 2018 to 2020 when deference did not apply. Those are DHS’s numbers, presented by an agency that has an interest in the outcome.

Who could be affected

The people most exposed are those on a long-running status with the same employer. Consider a hypothetical example. Arjun is an Indian software engineer on an H-1B whose employer files for a three-year extension with the same job duties. Today, USCIS would normally treat the first approval as the starting point. Under the proposal, an officer could ask him to prove again that the role is a specialty occupation, even though nothing changed. Employers and workers from every country use these categories, so the proposal is not specific to any one nationality.

What changes for employers and workers

The practical effect is likely to be more paperwork and more waiting. A timely filed extension can generally allow continued work while it is pending, and the regulation on work authorization sets limits on how long that lasts. A longer review leaves less of that window. Manifest Law’s advice is to file complete petitions with initial-level evidence and not to assume a prior approval will carry the case.

The proposal also arrives alongside other tightening on the same classifications. Tamara News has tracked the H-1B $100,000 fee extension and the proposed $70,000 OPT fee. If you are planning a move to the US on a work route, the visa eligibility checker can help you compare routes before you commit.

What happens next

Comments must be submitted through Regulations.gov under docket USCIS-2026-0529 by 13 November 2026, before midnight Eastern time. DHS must then review them before it can finalise, change or withdraw the proposal. The proposed text, as summarised by Manifest Law, does not explain how pending petitions would be treated at the effective date, so that is a question to watch in any final rule.

Questions on the deference proposal

Is deference to prior approvals already gone?

No. The proposal is not final. The current rule remains in effect until DHS issues a final rule.

When is the comment deadline?

13 November 2026, through Regulations.gov under docket USCIS-2026-0529.

Which visas could be affected?

Form I-129 extensions, including H-1B, L-1, O-1, TN and E classifications, where the parties and facts match an earlier approval.

How many petitions does DHS say are eligible for deference?

DHS estimates about 208,429 a year, based on a fiscal 2022 to 2025 average.

Will approval standards change?

No. The eligibility criteria for each classification stay the same. The proposal changes how much weight a past approval carries.

What should employers do now?

File complete extension petitions with fresh evidence and plan for possible requests for evidence, rather than relying on a past approval.

Sources

24 Oct 2026
Kuwait 15-year residency

Kuwait 15-Year Investor Residency: Reported Conditions

Categories Business, Citizenship, Immigration

Kuwait 15-year residency for investors allows eligible foreign investors in companies licensed by the Kuwait Direct Investment Promotion Authority (KDIPA) to hold residency for up to 15 years. KDIPA announced the framework on 14 June 2026, and EY reports that it also covers senior executives of licensed companies. The conditions are significant, so this is a route for established investors rather than a general visa.

In this explainer

What KDIPA announced

According to KDIPA, the Council of Ministers issued a resolution under Article 13 of Law No. 114 of 2024 on the Residency of Foreigners, covering foreign investors licensed under Law No. 116 of 2013 on the Promotion of Direct Investment. It allows eligible licensed investors to secure residency for up to 15 years. EY gives the resolution number as 651 of 2026, issued in coordination with the Ministry of Interior, while the KDIPA page’s own rendering of the number is unclear. Khaleej Times also reported the announcement as residency of up to 15 years for qualified foreign investors, immediate family, accredited senior executives and approved partners.

Reported conditions

KDIPA lists several conditions. The investment value must be no less than KWD 5 million, capital for approved investment activities no less than KWD 1 million, operations in Kuwait must be active, and the entity must meet a minimum employment requirement for Kuwaiti nationals. KDIPA does not give the required number of Kuwaiti employees, and its page does not describe application steps, documents or fees.

Who is covered

KDIPA names owners of licensed investment entities, partners, KDIPA-approved senior executives and eligible immediate family members, subject to prescribed conditions. It does not state how long executive or family permits last. EY says the residency is for investors and senior executives, and notes only that it covers granting and renewal across defined categories.

Consider a hypothetical case. Minh is a Vietnamese manufacturer who is weighing a KDIPA-licensed plant in Kuwait. Under the reported rules, his company would first need a KDIPA licence, meet the capital and investment thresholds, and show Kuwaiti employment. Only after that could he or approved executives seek the long-term residency. A residency-first plan would not work, because the permit is tied to the licensed company.

What is not yet clear

EY says an effective date is not stated on the page we read, and its full tax alert was not available to us. KDIPA does not set out fees, documents or timelines. Anyone planning around this should ask KDIPA and Kuwaiti immigration authorities for the current process rather than relying on summaries, including ours.

How it compares in the Gulf

Kuwait joins other Gulf states offering longer residency for investors and executives. Our guides cover Qatar’s 10-year residency for founders and executives and Dubai’s golden visa figures, and our note on Oman free-zone rules for foreign investors. Each programme has different thresholds and conditions, so compare them on the capital you can commit and the staff you plan to hire. If you are choosing a jurisdiction for a new company, our company formation page sets out options.

Kuwait residency questions

How long is Kuwait’s investor residency?

KDIPA says up to 15 years for eligible licensed investors.

When was it announced?

KDIPA announced the framework on 14 June 2026.

What are the investment thresholds?

KDIPA lists an investment value of no less than KWD 5 million and capital of no less than KWD 1 million for approved activities.

Are executives covered?

EY says senior executives in KDIPA-licensed companies are covered, and KDIPA names approved senior executives. Their permit length is not stated.

Do I need Kuwaiti employees?

KDIPA lists a minimum employment requirement for Kuwaiti nationals, but does not give the number.

What are the fees and steps?

They are not described on the KDIPA page we read. Ask KDIPA or the Ministry of Interior.

Sources

24 Oct 2026
Singapore skyline at dusk, where the Singapore work pass changes take effect October 29

Singapore Just Made Its Work Pass Process Less of a Headache

Categories Visa Updates, Work Permits

Singapore’s Ministry of Manpower will roll out new Singapore work pass changes on October 29, 2026. The update reworks how employers and foreign workers submit work pass applications through the myMOM Portal. MOM first outlined the plan on May 20, 2026. An implementation update on October 20 confirmed the launch date.

A professional filing documents online, relevant to the Singapore work pass changes

What’s actually changing for Singapore work pass applicants

The biggest change is auto-fill. Applicants who already hold a Foreign Identification Number, known as a FIN, will see their passport details pre-populated. That only works if MOM already has valid passport data on file. First-time applicants without an existing FIN record still enter details by hand for now. MOM plans to extract passport data automatically from uploaded scans eventually. That feature is not live at launch. Until it arrives, agencies that handle high volumes of first-time applications will likely see less benefit from the update than those renewing passes for workers already in MOM’s system.

MOM also redesigned the application form itself. The agency says the new layout cuts down on manual data entry and makes the form easier to navigate. No new questions were added to the application. Document upload rules changed too. Applicants generally need to upload only the passport biodata page now. An amendment or observation page is required only when it changes identifying details, such as a corrected name or passport number.

Upload specifications are strict. Each page must be its own file, saved as JPG, PNG or PDF. Images need to be landscape and correctly oriented, or the system may reject them. The biodata page has to be uploaded before any other document.

Why MOM is rolling out the Singapore work pass changes now

MOM has not published a cost or time-savings estimate for the update. The stated goal is simpler. MOM wants to reduce repetitive data entry for returning applicants and tidy up a form that had grown unwieldy. Singapore depends heavily on foreign talent across its economy, from finance to construction. A smoother application system lowers friction for employers who file large numbers of work pass applications every year. The update also follows a broader push across Singapore’s public agencies to digitize routine paperwork and cut processing friction for both residents and foreign applicants.

The timing also matters. MOM first announced the changes back in May, giving employers and agents five months to prepare before the October 29 switch. That lead time suggests MOM wanted feedback and testing before a full rollout, rather than pushing a change through quickly.

What stays the same under the new process

Nothing about eligibility changes. Salary thresholds, qualification requirements and approval conditions remain exactly as they were. MOM did not create any new pass category as part of this update. Processing times have not been guaranteed to improve, despite the simpler form. Applications submitted before October 29 follow the existing process in full. Only applications filed on or after that date use the new auto-fill and upload rules.

That transition detail matters for anyone mid-application. An employer who started a submission in the old system before the cutover should expect to finish it under the rules that were in place when they began. They should not expect the format to switch partway through a single filing.

What applicants should do before October 29

Employers and agents filing multiple applications should check their saved passport records now, before the new system goes live. An outdated FIN record won’t auto-fill correctly. That mistake could slow a submission down rather than speed it up. Anyone preparing documents should also convert existing passport scans to the accepted formats in advance. A multi-page PDF that mixes formats may not upload the way the new form expects. Employers managing dozens of applications at once may find it worth building a short internal checklist, rather than relying on staff to remember the format rules case by case.

Agencies that regularly submit work pass applications are advising clients to test the new portal interface as soon as it opens. Waiting until a filing deadline forces the issue is a common and avoidable mistake. Confirming exactly which upload format the system accepts, rather than assuming compatibility, is the kind of small step that avoids a last-minute scramble once October 29 arrives.

More Asia work visa coverage

Work visa and permit rules are shifting across Asia this month. See our reports on Japan’s new residence permit fees, South Korea’s extended K-ETA exemption, and the status of the US $100,000 H-1B fee.

Singapore work pass changes: frequently asked questions

  • When do the Singapore work pass changes take effect? The new myMOM Portal process begins October 29, 2026.
  • What is the main change for applicants? Applicants with an existing FIN and passport details on file will have those details auto-filled on the application form.
  • Do first-time applicants get auto-fill too? Not yet. MOM plans to extract passport data from uploaded scans automatically, but that feature is not live at launch.
  • Did eligibility requirements change? No. Salary thresholds, qualification requirements and approval conditions are unchanged.
  • What document format does the new system require? JPG, PNG or PDF, with each page as its own file, uploaded in landscape orientation with the biodata page first.
  • Do applications filed before October 29 follow the new rules? No. Applications submitted before that date follow the existing process in full.

Sources consulted for this report

24 Oct 2026
Data center infrastructure representing the NVIDIA AI factory deployment

Nvidia Says It Can Build an AI Data Center in 14 Days — Here’s How

Categories Tech

Nvidia used its GTC Berlin 2026 conference to detail a NVIDIA AI factory deployment system. The company says it can cut construction time from roughly six months down to as little as 14 days. Nvidia calls the reference design DSX POD. The company announced it October 21-22. It covers complete Vera Rubin AI factories, built and tested inside modular containers before they ever reach a customer’s site.

Server cooling hardware inside a rack, part of the NVIDIA AI factory deployment system

How the NVIDIA AI factory deployment system works

Under the DSX POD approach, partner companies assemble and validate entire AI factory systems inside standardized containers. They do this work at a factory, separate from the physical site where the containers will ultimately sit. Rack-to-rack cabling, piping and functional testing all happen before shipping. A container arrives at a site that already has power, cooling and networking prepared. From there, it connects in as little as two weeks. A conventional build-out typically takes months instead.

Jensen Huang, Nvidia’s founder and chief executive, framed the pitch around revenue timing rather than construction speed alone. “An AI factory creates value when it starts producing tokens — not when construction is complete,” Huang said. He added that the goal is “reducing deployment time from months to weeks” so customers can scale AI capacity faster.

The efficiency claims behind DSX

Nvidia paired the deployment announcement with efficiency figures for the broader DSX product family. The company estimates that its cooling approach could save 54 million liters of water per day at a hypothetical 2-gigawatt deployment, compared with conventional evaporative cooling towers. A related component called DSX MaxLPS targets up to 30% less electricity for the same AI output. In testing, partner Nscale reported 49% higher inference throughput within an unchanged 264-kilowatt power budget. These figures are Nvidia’s own estimates. Actual results will vary by site and workload.

The DSX family also includes Flex, a tool for adjusting power use based on grid conditions. SimReady Central and DSX OS round out the family. Partners use both tools to simulate and manage AI factory operations digitally, before and after construction.

Who is building the modular factories

Nvidia named a wide partner roster for the DSX POD rollout. The list includes Anduril, Armada, Bull, Crusoe, DayOne, Dell Technologies, Delta, Eaton, Foxconn’s Ingrasys unit and Gigabyte. It also includes HPE, Lenovo, Pegatron, Quanta Cloud Technology, Schneider Electric, Vertiv and Wistron. GE Vernova, Hitachi Energy and Siemens Energy handle the power infrastructure side. The partner ecosystem plans to deliver DSX POD AI factories worldwide starting in early 2027.

Nvidia also used GTC Berlin to announce semiconductor capacity agreements meant to support that rollout. Substrate capacity will rise 2.5 times over three years, with partners IBIDEN, Samsung Electro-Mechanics and Unimicron. Advanced packaging capacity with Amkor should grow more than 300% by the end of 2028. A $1.1 billion capacity-reservation advance from Nvidia backs a new US testing facility from King Yuan Electronics. “Capacity is the constraint,” Huang said of the broader buildout.

What to watch as DSX POD ships

The real test of Nvidia’s 14-day claim comes once the first DSX POD units reach customer sites in early 2027. Analysts are likely to scrutinize several things, independent of Nvidia’s own figures. Does the modular approach hold up at scale? Do the water and power savings estimates match real-world deployments? And does standardizing on Nvidia’s architecture deepen customer dependence on a single vendor for AI infrastructure? Some industry commentary has already raised that last concern.

Supporters of the approach counter with a comparison. The alternative, building each AI factory from scratch on site, carries its own vendor-lock problems and a far slower timeline. Whether that trade-off looks favorable will largely depend on one thing: how the first wave of DSX POD deployments performs once they go live next year. Customers weighing the two approaches will also want to see independent confirmation of the 14-day connection claim, rather than relying solely on figures Nvidia itself has published. Early 2027 will be the first real opportunity for that kind of outside scrutiny, once customer sites actually go live.

More AI infrastructure coverage

This week brought a wave of AI infrastructure news. See our reports on Nvidia and Huawei’s AI chip market share in China, Microsoft’s Maia 300 chip plans, and TSMC’s Q3 2026 earnings and AI chip demand.

Nvidia DSX POD: frequently asked questions

  • What is Nvidia’s DSX POD? DSX POD is a reference design for complete Vera Rubin AI factories, built and tested inside modular containers before shipping to a customer site.
  • How fast can a DSX POD deploy? Nvidia says deployment at a prepared site can take as little as 14 days, down from roughly six months for a conventional build.
  • Who announced the NVIDIA AI factory deployment system? Nvidia CEO Jensen Huang announced DSX POD at the company’s GTC Berlin 2026 conference.
  • Which companies are building the modular factories? Partners include Dell Technologies, HPE, Lenovo, Foxconn’s Ingrasys unit, Schneider Electric, Vertiv and more than a dozen others.
  • When will DSX POD factories start shipping? Nvidia’s partner ecosystem plans to deliver DSX POD AI factories worldwide starting in early 2027.
  • Are the water and power savings figures independently verified? No. The water savings and power efficiency figures are Nvidia’s own estimates, not independently verified.

Sources for this story

1 … 18 19 20 21 22 … 274