Black October Vulnerabilities: Node.js, Nginx, and Server-Side Exploits Analyzed

A detailed review of 15 critical and high-severity vulnerabilities disclosed in October reveals that only a handful actually affected a production server running Astro, Strapi, Nginx, and Ubuntu 24.04. Node.js remained unpatched for four days, exposing a Brotli decompression flaw that could lead to remote code execution. Nginx packages lagged behind security updates despite unattended-upgrades being enabled, though configuration checks showed most CVEs did not apply. PHP and GitLab issues were irrelevant due to their absence from the stack. The author also migrated away from inline scripts and third-party dependencies to reduce attack surface. Commands for verifying package changelogs, detecting deleted binaries in memory, and confirming librsvg fixes in sharp are provided throughout the analysis.

HabrOctober 29, 2026Translated from Russian

Read at source

A production server running Astro 7, Strapi 5, Nginx, and Ubuntu 24.04 faced a wave of October vulnerabilities that included critical flaws in PHP, Nginx, Node.js, Next.js, Java, and GitLab. Continuous monitoring agents flagged 15 high-severity issues, prompting a manual review of each CVE against the actual configuration and installed packages.

Two issues directly impacted the server: Node.js stayed four days behind the patched 22.23.4 release containing CVE-2026-111497, and Nginx packages had not yet received the latest security updates. Several other entries proved misleading. Nginx CVEs rated critical by NVD carried only medium severity on nginx.org because they required specific directives such as alias combined with rewrite or aio. The reported Next.js vulnerability actually resided in the librsvg library inside sharp, affecting any image-processing pipeline that accepts SVG files.

Verification commands and patch status

Ubuntu backports fixes without changing version numbers, so apt-get changelog must be checked rather than relying on php -v or nginx -v. Commands such as apt-cache policy nginx and apt-get changelog nginx revealed that the installed 1.24.0-2ubuntu7.18 package missed fixes for CVE-2026-15176, CVE-2026-93479, and CVE-2026-97205. After updating, sudo needrestart and checks for deleted executables in /proc confirmed that running processes had reloaded the new binaries.

Node.js from the NodeSource repository is never updated by unattended-upgrades. The four-day exposure window closed only after manual installation of 22.23.4. The same Brotli flaw also affected the system libbrotli1 package and Python brotli wheels, requiring separate verification that no process held deleted library mappings in memory.

Configuration review and migration to static delivery

Absence of PHP, Java, and GitLab immediately eliminated multiple critical remote-code-execution flaws. The site had already removed nearly all third-party scripts and inline JavaScript, leaving 132 pages without any inline scripts. Static Astro output served by Nginx now handles all requests, with sharp 0.35.5 (containing fixed librsvg 2.63.2) used only during the build phase.

The incident prompted stricter alerting rules: any security update lingering longer than 24 hours now triggers an immediate notification, regardless of whether the vulnerability matches the current configuration.

NGINX GitLab Node.js Ubuntu 24.04 CVE-2026-111497 sharp librsvg

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulnerabilities & Exploits

Vulnerabilities & Exploits

AI-Driven Discovery of PHP2Shell Zero-Day Forces Rethink of DevSecOps Practices

One week after the October 21 black Wednesday incident, European governments scrambled to shut down web services following the disclosure of a critical remote code execution flaw in the PHP core. The vulnerability, tracked as CVE-2026-109618 with a CVSS score of 10.0, was identified by an advanced AI model during automated auditing rather than by human researchers. The flaw resided in long-untouched multipart/form-data parsing code that had been protected by PHP's backward-compatibility policy for decades. Once a proof-of-concept leaked, attacker-controlled LLMs rapidly generated architecture-specific exploits and polymorphic code that bypassed basic WAF signatures. Human defenders were forced into manual patch cycles and emergency network isolations across the EU because they could not match the speed of automated exploitation. The event has triggered immediate calls for AI-powered fuzzing inside CI/CD pipelines, legacy code audits, and autonomous AIOps-driven protection systems.

HabrOct 29, 2026Translated from Russian

Vulnerabilities & Exploits

Critical Pre-Auth RCE Vulnerability CVE-2026-118633 Affects All Versions of Sophos UTM

Sophos has disclosed a severe remote code execution flaw in its legacy Sophos UTM security gateway product. The vulnerability, tracked as CVE-2026-118633, carries a CVSS v4.0 base score of 9.2 and is rated Critical. It impacts the email proxy when scanning features are enabled, allowing unauthenticated attackers to achieve root-level command execution by triggering a race condition. Although the product has reached end-of-life status, Sophos has released a manual patch that administrators must apply themselves. The company strongly urges immediate remediation for any deployments still using the mail protection functionality and recommends migrating to the supported Sophos Firewall platform.

Security NEXTOct 29, 2026Translated from Japanese

Vulnerabilities & Exploits

Cisco ASA and FTD Firewalls Affected by DoS Vulnerability in SSL VPN Already Exploited in the Wild

Cisco Systems has disclosed a denial-of-service vulnerability affecting its Cisco Secure Firewall ASA and Cisco Secure Firewall FTD products. The flaw, tracked as CVE-2026-76418, resides in the SSL VPN feature and carries a CVSS v3.1 base score of 8.6, rated High severity. When secondary authentication is configured for tunnel groups in the SSL remote access VPN login service, an attacker can send a specially crafted request during the connection process to reboot the device without any authentication. This triggers a service denial state on the affected appliance. Cisco confirmed active exploitation of the issue in October 2026 and has released patches for both products. Organizations are strongly advised to apply the updates immediately to prevent further abuse.

Security NEXTOct 29, 2026Translated from Japanese