Apigee reports unauthenticated remote-code-execution vulnerabilities affecting Drupal-based developer portals

Semantic Governance Policies marked as dry run are now evaluated and logged without blocking the request. Each dry-run policy adds a second judge evaluation per tool-calling response, whose tokens are billed.

VerifyJWT now rejects a JWT whose header contains "b64":false, with fault steps.jwt.InvalidToken, as RFC 7797 section 7 requires. Previously, such a token could be accepted if KnownHeaders listed b64, IgnoreCriticalHeaders was true, or the header had no crit.

On a tool call that supplies at least one cookie argument, the Cookie header is replaced with only the declared cookie parameters, omitting any others. Any cookie your backend relies on must be declared as an in: cookie parameter.

Two vulnerabilities in PHP core (CVE-2026-109618 CVE-2026-109619, "PHP2Shell") allow an unauthenticated attacker to execute code remotely on a server running a vulnerable PHP version. The impact is limited to Drupal-based Apigee developer portals, which customers deploy and

Semantic Governance now evaluates LLM requests it previously skipped, such as OpenAI requests whose message content is an array of parts, which can produce new denials and judge-model usage. It considers every system message rather than only the last, and a non-streaming OpenAI