PHP, Node.js, and Go disclose and fix multiple security risks
BIBIBI
AT A GLANCE
PHP, Node.js, and Go-related components were reported to have remote code execution,TLS validation bypass, and certificate trust risks.
Article
⚡️ Internet infrastructure software disclosed consecutive security risks within a single day, involving PHP, Node.js, and Go
BlockBeats reports that October 22, multiple internet infrastructure software projects released security updates consecutively within a single day, involving remote code execution,TLS certificate validation bypasses, and certificate trust risks. Specifically:PHP fixed CVE-2026-109618、CVE-2026-109619 two critical vulnerabilities, both of which could lead to unauthenticated remote code execution and affect PHP environments that process Web requests. Fixed versions include 8.5.12、8.4.27、8.3.36 and 8.2.35。
The Node.js announcement lists vulnerabilities, of which are high severity, including remote code execution caused by an out-of-bounds write in a Brotli decoder,DNS name truncation, and TLS certificate hostname validation bypass issues. Fixed versions are 26.12.1、24.22.1 and 22.23.4。
In addition, the risk identifier related to Go's crypto/x509 is CVE-2026-111943. Red Hat rated it as “Important,” with a CVSS 3.1 score of 6.8. Attackers with a specific network position and relevant certificates may be able to impersonate a legitimate server and intercept or tamper with communications. Go 1.26.10 and 1.27.3 have been added to the denylist, blocking trust in the relevant compromised intermediate certificates.
Original link https://m.theblockbeats.info/flash/373057
Key points
01
BlockBeats stated that October 22 multiple internet infrastructure software projects released security updates.
02
PHP Fixed CVE-2026-109618 and CVE-2026-109619, both of which the article says could lead to unauthenticated remote code execution.
03
PHP Fixed versions include 8.5.12、8.4.27、8.3.36 and 8.2.35。
04
The Node.js announcement lists vulnerabilities, of which are described as high severity.
05
Node.js-related issues include Brotli remote code execution caused by an out-of-bounds write in a decoder,DNS name truncation, and TLS certificate hostname validation bypasses.
06
Node.js fixed versions are 26.12.1、24.22.1 and 22.23.4。
07
The risk identifier related to Go's crypto/x509 is CVE-2026-111943, which the article says Red Hat rated as “Important,” with a CVSS 3.1 score of 6.8。
08
The article states that attackers with a specific network position and relevant certificates may be able to impersonate a legitimate server and intercept or tamper with communications.
09
Go 1.26.10 and 1.27.3 have been added to the denylist to block trust in the relevant compromised intermediate certificates.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
These issues affect website services, network communications, and certificate validation. Remote code execution means attackers may cause a target system to run their code;TLS validation bypasses or certificate trust issues may cause systems to incorrectly trust an impersonated server. The versions listed in the article are versions for which the respective projects claim to have fixed the issues or taken blocking measures.
Why it matters to readers
If relevant services still use affected versions, they may face risks of code execution or the impersonation, interception, and tampering of encrypted communications.
Maintainers of websites or services using PHP, Node.js, or Go-related components should check their current versions and determine whether upgrades are needed. Ordinary users can monitor whether the services they use have released security updates.
Risks and unknowns
Evidence not provided PHP, Node.js, Go, or Red Hat official announcements were not attached; vulnerability identifiers, ratings, scope of impact, and fixed versions still require verification.
The article does not specify which older versions are affected.
The text does not state whether these vulnerabilities have been actively exploited.
The specific network locations and certificate conditions required for the Go risk to materialize are not described in detail.
Related Developments
Loading event timeline…
Related concepts
Remote code execution
This term is not in the glossary yet. Browse related concepts in the glossary.
