TuxCare Is Heading to KCDC 2026!

Check the status of CVEs. Learn More.

 CVE Status (opens in new tab)

php2shell patches (CVE-2026-109618 and CVE-2026-109619) for EOL PHP are out now. With sales replies slower than usual due to high demand, the fastest route to patched packages is to buy ELS for Runtimes online (opens in new tab). Read the patch FAQ

TuxCare will be at KCDC 2026, one of the Midwest’s largest developer conferences, taking place September 10–11 at the Kansas City Convention Center in Kansas City, Missouri. With 15 tracks running across two days and thousands of developers, architects, and technology leaders in attendance, it’s a great place to talk about the security risks hiding in the open source packages we all depend on every day.

Our team will be onsite across both days to connect with developers, share what we’re seeing in the open source security space, and talk through how TuxCare’s SecureChain for Open Source helps teams catch malicious and vulnerable packages before they make it into production.

Catch Our Talk

Possessed by Packages: Is Your JavaScript Haunted?

Chris DeMars, TuxCare  Thursday, September 10 · 3:45–4:45 PM · Room 2210

Is your app acting strange, with random network calls or behavior you can’t explain? It might not be a bug, it might be a malicious package. In this session, Chris explores how typo-squatting, dependency confusion, and supply chain attacks let bad packages sneak into your codebase, and what it takes to root them out. You’ll leave with practical tools and habits, beyond npm audit, to help keep your dependency tree free of unwanted guests.

Come find us on campus in Kansas City. Whether you want to catch the talk, talk shop about supply chain security, or just say hi.

See you in Kansas City!