Security

2 posts

2026-10-22Notes12 min read

Node.js October 2026 Security Releases: 10 CVEs, a Brotli RCE, and the eMudhra CA Compromise

Node.js 22.23.4, 24.22.1, and 26.12.1 patch 10 runtime vulnerabilities — including a Brotli RCE, a trio of TLS verification bypasses, and the eMudhra CA compromise. Full breakdown, risk profiles, and how to update.

2026-10-22Engineering18 min read

PHP2Shell: A Complete Guide to PHP's Critical RCE Flaws — News, Root Cause, and How to Secure Your Server

Two critical RCEs in the PHP engine itself (CVE-2026-109618 & CVE-2026-109619) are now being exploited at scale. A complete guide: the news, the Zend engine root cause, how to check & patch your server, temporary mitigations, and attack detection.