Node.js Issues Security Updates Patching Ten Vulnerabilities Including High-Severity TLS Name Verification Bypasses
Node.js published security updates on October 21 for release lines 26, 24, and 22, correcting ten vulnerabilities, four of them high severity. The fixed versions are 26.12.1, 24.22.1, and 22.23.4.
The most severe issue lies in the Brotli decoder, tracked as CVE-2026-111497. It is an out-of-bounds memory write that can lead to remote code execution and affects all three release lines. The advisory does not detail the exploitation conditions required.
Two high-severity flaws impact TLS name verification. CVE-2026-105483 bypasses the check when an address uses full-width digits, while CVE-2026-106069 fails with names that resolve imprecisely to an IP address. In practice, a certificate may be accepted for a destination that is not the intended one.
The fourth high-severity issue resides in DNS. CVE-2026-105482 causes the dns.resolve function to truncate names containing a null character, opening the door to inconsistency between the queried name and the name actually resolved.
Among the medium-severity issues are out-of-order processing in HTTP socket keep-alive, incorrect certificate validation for non-standard IPv4 addresses, and repetition of cryptographic random values in snapshot initialization and single-executable applications, affecting crypto.randomUUID and crypto.randomInt.
The three low-severity issues involve attacker-controlled bytes returned after ZIP header validation failure, excessive file access via wildcard in the Permission Model, and bypass of that model via fs.realpathSync.
The package also updated c-ares, CA certificates, Undici, OpenSSL, and SQLite. The recommended remediation is to install the appropriate version for the release line in use, rebuild application images where present, and restart services. The project advises testing outbound HTTPS connections, DNS handling, Brotli-compressed content, and permission-restricted workloads. Unsupported release lines received no fixes, so users on those lines must migrate.
Related articles
Anatomy of HTC Sense Vulnerability: Bypassing FRP Lock on HTC U11 Plus Without PC
A detailed technical breakdown reveals how an old HTC U11 Plus running Android 8 or 9 can have its Factory Reset Protection bypassed after a forgotten pattern lock. The method uses the device's own email client and credential storage system to force a new PIN without any PC or external tools. Multiple standard bypass attempts failed due to HTC Sense restrictions, including muscle memory recovery, Google account removal, Find My Device, and bootloader unlocking. The working exploit leverages the Exchange account setup flow to trigger Credential Storage Bypass, which overrides FRP flags by prioritizing certificate requests over setup wizard locks. A combined fingerprint and PIN option then allows creation of a new credential that survives reboot and passes the post-reset Google verification. The technique exploits architectural priority conflicts between the Biometric Framework and FRP enforcement in HTC Sense firmware.
Yandex Station Root Access Flaw Exploited via Trusted Certificates Error, Patch Now Rolling Out
Enthusiasts discovered a method to obtain root access on their own Yandex Station smart speaker by exploiting an error in the trusted certificates system, bypassing the need to physically disassemble the device. The technique involved instructing the Alice voice assistant to play music and then probing for administrator privileges on the hardware. Yandex confirmed the vulnerability and has begun distributing an over-the-air update to close the access vector. Root privileges enable users to modify device software with far fewer restrictions than standard settings allow, expanding options for custom experimentation. The company emphasized that the flaw only affected a user's own device and that remote compromise of third-party units remained nearly impossible before the fix. Yandex also noted that owners previously could achieve similar customization by opening the device and flashing custom firmware, but the new method avoids any hardware intrusion. Work continues on refining the factory reset process, though specific details remain undisclosed.
PHP Foundation Reveals Two Critical RCE Vulnerabilities Fixed After 2024 Discovery Delays
The PHP Foundation has disclosed details surrounding two severe remote code execution vulnerabilities in PHP that were addressed in updates released on October 21, 2026. The issues, tracked as CVE-2026-109618 and CVE-2026-109619, affect memory management and error handling routines used in nearly every request. Although signs of one flaw were identified during an external audit in 2024, resource constraints and prioritization of other issues delayed remediation. The foundation had planned a coordinated disclosure, but information leaked prematurely, causing confusion among stakeholders. Updated versions PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are now available, and immediate patching is strongly recommended for all users. The vulnerabilities' broad impact and the challenges in balancing security fixes with performance considerations made the response particularly complex.
CISA Urges Immediate Patching of Critical PHP Remote Code Execution Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory regarding two severe vulnerabilities in the PHP programming language that allow unauthenticated remote code execution. Identified as CVE-2026-109618 and CVE-2026-109619, the flaws affect all environments processing web requests with PHP and have been nicknamed php2shell. CISA recommends applying patches to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 without delay, or taking affected systems offline if updates cannot be applied immediately. Although no exploitation has been observed yet, organizations are instructed to inventory PHP usage, prioritize internet-facing systems, and monitor for suspicious activity such as shell processes spawned from PHP workers. Web application firewalls may offer partial protection but are not considered a substitute for patching.