Summary

This week is packed with RCEs: a bug in Ruby's regex engine (Onigmo) turns out to be behind four critical RCE flaws GitLab just patched, a Brotli decoder bug in Node.js turns out to extend to Envoy and possibly OpenSSL, and Apache Vysper has a CVSS 8.8 auth bypass that will never be fixed because the project has been retired. What needs the fastest action: teams using Ruby/GitLab, Node.js, or Java (there's an eMudhra CA zero-day) should patch first; nginx, Perl, PHP, and Godot follow.

1. Ruby regex engine (Onigmo) is the root cause of four critical RCEs in GitLab

Ruby released 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, Ruby's built-in regex engine. These three bugs are the root cause of four critical security flaws that GitLab has patched over the past month — a specially crafted regex pattern can corrupt memory when Ruby compiles it, potentially leading to code execution on the GitLab server itself. The article doesn't mention a specific CVE ID or GitLab version. Action: upgrade Ruby to 4.0.9 / 3.4.12 / 3.3.13, and make sure your GitLab instance is on the latest patched version. The Hacker News

2. Node.js Brotli decoder RCE (CVE-2026-111497) — not just a Node.js problem

Node.js 22.x, 24.x, and 26.x are affected by an out-of-bounds write in the Brotli decoder that allows RCE (severity: high). Node released new versions on/after October 21, 2026. Importantly: this bug actually lives in Google's brotli library itself, so it also impacts Envoy (advisory GHSA-3wvj-j6qm-62mr) and possibly OpenSSL when processing compressed certificates via brotli. Ubuntu itself has only rated it "medium priority," which, according to one participant in the oss-security discussion, may be underestimating its impact. Action: upgrade Node.js to the latest release in each release line (22/24/26), then also check other components in your stack that link directly against brotli (Envoy, other compression libraries) — don't assume "we don't use Node.js so we're safe." oss-security mailing list

3. Apache Vysper: an authorization bypass that will never be fixed (CVE-2026-115748)

CVSS 3.1 8.8 (high), severity important. All versions of Apache Vysper (the XMPP/Jabber server library) are affected by this issue: the XEP-0077 (In-Band Registration) implementation has no authentication check, so any authenticated user can take over another account. This project is already retired, so no fix will be released. Action: if you're still using Apache Vysper, start looking for a replacement — no patch is coming. oss-security mailing list

4. Azul Zulu (OpenJDK): 53 quarterly CVEs, then a zero-day one day later

The October 20, 2026 quarterly update for Azul Zulu Builds of OpenJDK (Java 27, 25, 21, 17, 11, 8, 7, 6) patched 53 CVEs. A day later, on October 21, Azul released an out-of-cycle update for a zero-day: Mozilla announced that the private keys of eight eMudhra intermediate CA certificates had leaked, meaning anyone holding those keys could issue certificates for any domain and still be trusted by the chain-of-trust. Because Java doesn't check revocation by default, Java applications would keep trusting those forged certificates until they're blocked at the JDK level. Azul released an out-of-cycle build for Zulu Builds of OpenJDK (27, 25, 21, 17, 11, 8, 7, 6) and Zing Builds of OpenJDK (25, 21, 17, 11, 8) that adds all eight certificates to the blocklist in both the CPU and PSU configurations. Action: install the out-of-cycle build immediately. If you already installed the quarterly update first, you still need to update again to the out-of-cycle build — this build supersedes the quarterly one. If you can't update right now, Azul provides a temporary workaround via security properties in the release notes. Foojay.io

5. Perl IO::Compress::Brotli carries the same decoder bug (CVE-2026-115936)

The IO-Compress-Brotli distribution, versions 0.004001 up to before 0.023, statically bundles brotli version 1.0.4–1.2.0, which carries the same out-of-bounds write in the decoder — exactly the CVE-2026-111497 bug above. Because it's bundled (not linked to the system library), upgrading brotli on the system doesn't help. Anyone decompressing untrusted data via unbro or the decompress method is exposed: memory corruption, memory leaks, crashes, and potentially arbitrary code execution. Action: upgrade to IO-Compress-Brotli 0.023 or later (this version updates its bundled brotli to 1.2.1). oss-security mailing list

6. nginx: three CVEs, two of them potentially RCE

An F5 advisory (referencing nginx.org) states that nginx open source before version 1.31.7 or 1.30.6 is affected by three issues, all medium severity but two with RCE potential:

  • CVE-2026-97205 — a use-after-free in ngx_http_core_module when AIO is active while processing SSI include virtual; it can trigger memory corruption or a worker crash, and RCE if ASLR is disabled/bypassable.
  • CVE-2026-97629 — if ssl_session_cache shared:<name>:<size> is used without an explicit ssl_session_ticket_key directive for key rotation, an unauthenticated remote attacker can forge a TLS client session non-deterministically, bypassing client certificate verification.
  • CVE-2026-95101 — request body injection in HTTP/3 when used with proxy_* (further details cut off in the source).

Action: upgrade to nginx 1.31.7 (mainline) or 1.30.6 (stable) or later. oss-security mailing list

7. PHP: a new, unpatched RCE risk (CVE-2026-115560)

Two days after releasing an emergency patch for the critical "PHP2Shell" flaw, PHP announced another RCE risk, CVE-2026-115560. This flaw only affects web applications with an uncommon configuration, and PHP rates it as a low-likelihood risk — which is why there's no emergency fix, just a recommendation to disable one specific feature (the source doesn't specify which feature). Action: check whether your configuration falls into the "uncommon" category PHP mentions, and follow their recommendation to disable the related feature while waiting for further details. Also make sure the earlier PHP2Shell emergency patch is already installed. The Hacker News

8. Godot 4.x/3.x: heap out-of-bounds write in the binary resource loader

A negative string length in Godot's binary resource loader can trigger a heap out-of-bounds write. The fix for 4.x has already merged into master via PR #124699 (merge commit d9f4c99f0a, October 20, 2026): ResourceLoaderBinary::get_unicode_string and get_ustring now reject negative lengths as well as lengths exceeding the remaining file size, and get_ustring returns early for zero length. The 3.x backport (PR #124700, merged the same date) adds another fix: parse_utf8 is now given the string length, closing an out-of-bounds read on files with a valid length but no null terminator. No CVE ID or official severity has been assigned. Action: pull a build from master after commit d9f4c99f0a (4.x) or PR #124700 (3.x) if you load binary resources from untrusted sources. oss-security mailing list

Checklist

  • [ ] Upgrade Ruby to 4.0.9 / 3.4.12 / 3.3.13, make sure your GitLab instance is on the latest patched version.
  • [ ] Upgrade Node.js 22/24/26 to the latest security release, audit other components that link brotli (Envoy, etc.).
  • [ ] Find a replacement for Apache Vysper — no patch is coming for CVE-2026-115748.
  • [ ] Install the Azul Zulu/Zing OpenJDK out-of-cycle update (eMudhra CA blocklist) immediately, even if you've already installed the quarterly update.
  • [ ] Upgrade IO-Compress-Brotli (Perl) to 0.023+.
  • [ ] Upgrade nginx to 1.31.7 / 1.30.6 or later; check your AIO+SSI configuration and ssl_session_ticket_key.
  • [ ] Review any uncommon PHP configuration related to CVE-2026-115560 and apply PHP's mitigation; make sure the PHP2Shell patch is already installed.
  • [ ] Update Godot to a build that already includes the fix from PR #124699/#124700 if you load untrusted binary resources.

---

Sources summarized: