📢 Flash
Critical security vulnerabilities disclosed within 24 hours across foundational internet software—including PHP, Node.js, and Go
On October 22, foundational software projects for three major programming languages—PHP, Node.js, and Go—released security updates on the same day, collectively addressing multiple critical vulnerabilities, including remote code execution (RCE), TLS certificate hostname validation bypasses, and intermediate certificate trust chain risks.
For PHP, two critical vulnerabilities—CVE-2026-109618 and CVE-2026-109619—were urgently patched. Both allow unauthenticated remote code execution and affect all PHP runtime environments handling web requests. Fixed versions include PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
Node.js disclosed ten security issues the same day, four of which were rated “high” severity: an RCE vulnerability triggered by an out-of-bounds write in the Brotli decoder; a DNS name truncation flaw; and two separate TLS certificate hostname validation logic bypasses. Patches are included in Node.js versions 22.23.4, 24.22.1, and 26.12.1.
In Go, a certificate trust issue in the crypto/x509 module was assigned CVE-2026-111943 and rated “Important” by Red Hat, with a CVSS 3.1 base score of 6.8. This flaw enables attackers with specific network positioning—and possession of a maliciously crafted certificate—to impersonate legitimate servers, potentially enabling man-in-the-middle attacks or communication tampering. Go versions 1.26.10 and 1.27.3 have added the affected intermediate certificate to a denylist, forcibly terminating trust chain validation for it.
For PHP, two critical vulnerabilities—CVE-2026-109618 and CVE-2026-109619—were urgently patched. Both allow unauthenticated remote code execution and affect all PHP runtime environments handling web requests. Fixed versions include PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
Node.js disclosed ten security issues the same day, four of which were rated “high” severity: an RCE vulnerability triggered by an out-of-bounds write in the Brotli decoder; a DNS name truncation flaw; and two separate TLS certificate hostname validation logic bypasses. Patches are included in Node.js versions 22.23.4, 24.22.1, and 26.12.1.
In Go, a certificate trust issue in the crypto/x509 module was assigned CVE-2026-111943 and rated “Important” by Red Hat, with a CVSS 3.1 base score of 6.8. This flaw enables attackers with specific network positioning—and possession of a maliciously crafted certificate—to impersonate legitimate servers, potentially enabling man-in-the-middle attacks or communication tampering. Go versions 1.26.10 and 1.27.3 have added the affected intermediate certificate to a denylist, forcibly terminating trust chain validation for it.
