This week I've gathered eight flaws that I think deserve a spot on your team's radar. The most urgent: PHP users are hit by PHP2Shell, which has already proven to produce real shells on a honeypot; anyone with a dependency on Brotli (almost everyone, via Node.js, .NET, PowerShell, Bun, Envoy, or Istio) is hit by Node2Shell with a CVSS of 9.2; and anyone relying on the Go runtime for TLS verification needs to make sure they're on the emergency release tied to the eMudhra PKI incident.

PHP2Shell: the PHP RCE that's now actually being exploited

Tracked as CVE-2026-109618 and CVE-2026-109619, this critical flaw allows unauthenticated RCE. PHP released a patch on October 21, but exploitation had already begun before the fix shipped, with millions of attempts recorded. What's new: Perplexity researchers confirmed actual code execution via a four-stage sequence of HTTP requests (exhausting memory, leaking memory contents, then running shell commands) on a PHP 8.4.26/Apache mod_php honeypot — previously it only caused crashes, with no confirmed RCE. What to do now: make sure your PHP installation is on a build that includes the October 21 patch for both of these CVEs. The Hacker News

Node2Shell: the Brotli flaw with a CVSS of 9.2 that spread across many stacks

CVE-2026-111497, an out-of-bounds write in the Brotli decoder versions 1.0.3 through 1.2.0, was given a CVSS v4 score of 9.2 (critical) by Google. A specially crafted input can push data past the decoder's buffer bounds, causing crashes, memory leaks, or — according to Node.js — arbitrary code execution by an unauthenticated attacker. Imperva has already demonstrated code execution on the official Node.js 24.22.0 Linux arm64 image via Express 5/body-parser 2. Fix: upgrade to Brotli 1.0.10, 1.1.1, or 1.2.1; Node.js and two Python packages were patched last week, Microsoft followed on October 25 for .NET, Visual Studio, and PowerShell, and Bun, Envoy, and Istio have also been updated. SecurityWeek

eMudhra: weak root CA, Go ships an emergency patch within 7.5 hours

Mozilla blocked eight eMudhra intermediate certificates (six for TLS, two for code signing) in OneCRL after researchers found that its private key could be reconstructed within microseconds. Because the eMudhra root is present in almost every trusted root program, an attacker could sign fake TLS certificates for any domain without needing to prove control over that domain — opening the door to MITM attacks against any TLS connection. The Go security team received the report on October 19 and shipped their first-ever URGENT security release about 7.5 hours later to protect the TLS verifier in net/http and crypto/tls. What to do now: make sure your Go toolchain/runtime is on that emergency release version. Go blog

Wasmtime: two critical flaws could escape the WebAssembly sandbox

Two critical flaws in Wasmtime allow malicious WebAssembly modules to escape the sandbox that's supposed to isolate them; one of them only affects ARM64 systems. The prerequisite is that the attacker needs to compile their own module on a vulnerable Wasmtime build. The maintainers have already released fixed versions — update to the latest Wasmtime release right away, especially if you're running on ARM64. The Hacker News

Godot 4.x: RCE via .po files, no official patch yet

The .po loader in Godot 4.1.0 through 4.7.2 (confirmed working on the official 4.7-stable export, with no equivalent path in 3.5) stores the Plural-Forms header without validation, then evaluates it through the engine's own Expression evaluator. A specially crafted header can call bytes_to_var_with_objects() to deserialize a GDScript object with attacker-controlled script/source properties, causing that script to get compiled and its static initializer to run immediately. The impact: attacker-chosen GDScript runs with the privileges of the game process whenever a game that loads a community .po file displays a plural string. Status as of October 26: unpatched in both master and 4.7.2/4.7.1/4.7; two maintainer PRs (#123130, #123857) are still unmerged; a CVE has been filed (CAN-2026-2040826). Temporary mitigation: don't load .po translation files from untrusted community sources until an official patch is released. oss-security

git-annex: cross-repository data exfiltration via special remote

CVE-2026-112818 allows cross-repository data exfiltration if an attacker controls one of the victim's remotes (for example, a repo the victim clones) and knows a bit of information about the victim's private annexed files. When the victim runs git-annex (for example, git-annex sync --content), the attacker's auto-enabled special remote can pull the victim's private files and send them to the attacker. Another variant: the attacker waits for the victim to enable their own special remote (for example, an S3 bucket), then changes its configuration to target the victim's private special remote. Fix: git-annex 10.20261026 has already shipped a fix, with backport patches available for versions 10.20250416, 10.20251029, and 10.20261006. oss-security

GNU patch 2.8.1: file creation outside the target directory

CVE-2026-115207: when reverse-applying a patch that deletes a file, patch creates that file without checking whether its pathname is safe — allowing out-of-tree file creation. GNU patch 2.8.1 has shipped a fix for this critical bug, complete with a sha256 checksum and GPG signature. What to do: upgrade to GNU patch 2.8.1. oss-security

GPAC/MP4Box: use-after-free, medium severity (DoS)

CVE-2025-60467 (CVSS 3.1: 4.3, medium), a use-after-free in gf_filter_pid_inst_swap_delete_task when MP4Box processes a specially crafted MPEG-2 TS file. gf_filter_pid_inst_swap_delete() frees the pid_inst allocation before the scheduled delete task gets to run, so that task performs a READ on the already-freed structure and causes a crash (DoS). It requires user interaction to open the file, with no special authentication needed. It was reproducible on the GPAC master branch at the time it was found. What to do: update to the latest GPAC/MP4Box fix commit. oss-security

Action checklist

  • [ ] Make sure PHP is on a version that includes the October 21 patch for CVE-2026-109618/CVE-2026-109619
  • [ ] Upgrade Brotli to 1.0.10/1.1.1/1.2.1, or make sure Node.js, .NET, Visual Studio, PowerShell, Bun, Envoy, and Istio are updated for CVE-2026-111497
  • [ ] Verify that your Go toolchain/runtime is on the URGENT release tied to the eMudhra incident
  • [ ] Upgrade Wasmtime to the latest fixed version, especially for ARM64 deployments
  • [ ] Avoid loading untrusted community .po files in Godot 4.1.0–4.7.2 until an official patch is released
  • [ ] Upgrade git-annex to 10.20261026 or apply the backport patch for CVE-2026-112818
  • [ ] Upgrade GNU patch to 2.8.1 for CVE-2026-115207
  • [ ] Update GPAC/MP4Box to the latest fix commit for CVE-2025-60467

---

Sources summarized:

Read also