PHP, Node.js, and Go release security patches for critical vulnerabilities

iconKuCoinFlash
Share
AI summary iconSummary
On-chain news broke on October 22, 2026, as PHP, Node.js, and Go released urgent security patches for critical vulnerabilities. PHP fixed two remote code execution bugs (CVE-2026-109618 and CVE-2026-109619) in versions 8.5.12 and others. Node.js addressed ten issues, including a Brotli decoder flaw and TLS validation bypasses, in versions 26.12.1 and later. Go patched a crypto/x509 vulnerability (CVE-2026-111943), rated 6.8, in versions 1.26.10 and 1.27.3. Developers are urged to update immediately to mitigate potential security breach risks.

BlockBeats report: On October 22, multiple internet infrastructure software projects released security updates in a single day, addressing remote code execution, TLS certificate validation bypass, and certificate trust risks. Among them:


PHP fixes two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both of which can lead to unauthenticated remote code execution in PHP environments handling web requests. Fixed versions include 8.5.12, 8.4.27, 8.3.36, and 8.2.35.


The Node.js advisory lists ten vulnerabilities, four of which are critical, including remote code execution due to an out-of-bounds write in the Brotli decoder, DNS name truncation, and two issues bypassing TLS certificate hostname validation. Fixed versions are 26.12.1, 24.22.1, and 22.23.4.


Additionally, the Go crypto/x509-related vulnerability is identified as CVE-2026-111943, rated as "Important" by Red Hat with a CVSS 3.1 score of 6.8. Under specific network conditions and with access to relevant certificates, attackers may impersonate legitimate servers to intercept or modify communications. Go versions 1.26.10 and 1.27.3 have added the compromised intermediate certificates to a revocation list to block trust in them.

Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information. Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.