Several core internet-software projects released security updates in one day, covering remote-code execution, TLS certificate-validation bypass and certificate-trust risks, BlockBeats reported on Oct. 22.
PHP and Node.js fixes
The report said PHP fixed CVE-2026-109618 and CVE-2026-109619, described as serious vulnerabilities that could enable unauthenticated remote code execution in PHP environments handling web requests. It listed fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Node.js’ bulletin listed 10 vulnerabilities, four of them high risk, including a Brotli decoder out-of-bounds write and two TLS certificate-hostname validation bypasses. BlockBeats listed Node.js fixes in versions 26.12.1, 24.22.1 and 22.23.4.
Go certificate-trust risk
The report identified a Go crypto/x509 issue as CVE-2026-111943 and said Red Hat rated it “important” with a CVSS 3.1 score of 6.8. Under specific network and certificate conditions, an attacker could impersonate a legitimate server and intercept or alter traffic. BlockBeats said Go 1.26.10 and 1.27.3 reject trust in the affected intermediate certificates.
The flash relayed the projects’ and Red Hat’s reported details but did not link the underlying advisories, so affected operators should consult the relevant official notices before acting.