Press enter or click to view image in full size

Member-only story

NodejsJavaScriptProgrammingWeb DevelopmentDevOps Security Alert: Node2Shell (CVE-2026–111497), the Node.js Brotli RCE You Need to Patch Now

Developer Awam

11 min read14 hours ago

One compressed request, one unpatched runtime, and your server may no longer be yours. Here is how we check for it, detect it, and fix it.

A quick look back at PHP

If you follow runtime security news, this will sound familiar. On the same day, October 21, 2026, PHP published a security advisory for two critical vulnerabilities that can allow unauthenticated remote code execution.

The key points from php.net:

Patched versions: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35

The two flaws: CVE-2026–109618 (corruption from out-of-memory handling) and CVE-2026–109619 (stale global state).…