Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

On October 21, 2026, Node.js fixed CVE-2026-111497, now known as Node2Shell. The bug is in its bundled Brotli decoder, the component that unpacks compressed data. A crafted compressed stream makes the decoder write data outside the memory set aside for it, known as an out-of-bounds write. That can overwrite data the application relies on, so an attacker can crash the application, leak memory or run attacker code. Public proof-of-concept code was published within 24 hours.

Two critical vulnerabilities in the PHP core, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, let an unauthenticated attacker run commands on servers that use an affected PHP build to handle web requests. PHP released fixes on October 21, 2026, a day after details leaked online. Public proof-of-concept code followed within hours, and exploitation attempts were seen as early as October 17. AppTrana customers have been protected against PHP2Shell.

A critical remote code execution vulnerability was disclosed in Next.js on September 22, 2026, and an out-of-band security update was released to fix it. CVE-2026-94545 is a remote code execution vulnerability in next/og, the feature Next.js applications use to generate images on demand. The GitHub advisory rates it 9.5 on CVSS v4.0. An unauthenticated attacker can reach it over the network, and the root cause is an upstream SVG-escaping vulnerability that applications inherit without realizing it.

WordPress patched CVE-2026-87902 on September 22, 2026. Attackers were exploiting it the same day. Within hours of disclosure, attackers progressed from reconnaissance to active exploitation attempts, including attempts to write malicious PHP files to disk. The vulnerability is critical, with a CVSS v4.0 score of 9.2. Unauthenticated attackers can exploit it remotely. A public scanning template is already in circulation, and CISA has added the vulnerability to its KEV catalog.