Security · Worth Noting

PHP releases emergency fixes for two critical RCE vulnerabilities

CVE-2026-109618 and CVE-2026-109619 could allow unauthenticated remote code execution in affected web-serving installations. Users should upgrade to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12. A separate advisory covers an uncommon session configuration requiring additional mitigation.

PHP Oct 21, 2026 Security

GitLab patches critical unauthenticated code execution vulnerability

CVE-2026-110264, rated 10.0 in severity, could allow attackers to execute code on affected servers without authentication. Self-managed installations should update to 19.5.1, 19.4.3, 19.3.6, or the corresponding patched version. GitLab.com is already patched.

GitLab Oct 21, 2026 Security

Node.js security update fixes Brotli vulnerability

Node.js 22, 24 and 26 received security fixes, including a vulnerability that could allow remote code execution when processing malicious Brotli data. Update to versions 22.23.4, 24.22.1 or 26.12.1.

Node.js Oct 21, 2026 Security

Next.js patches two critical remote code execution vulnerabilities

Two critical vulnerabilities in Cache Components and image optimization could allow unauthenticated remote code execution in affected Next.js applications. Update to Next.js 15.5.28 or 16.4.1 to apply the fixes.

Next.js Oct 14, 2026 Security