PHP2Shell: critical flaws in PHP request handling
On October 21, PHP issued emergency fixes for CVE-2026-109618 and CVE-2026-109619, covering out-of-memory corruption and stale request state. An attack can reach vulnerable code before application code runs. Fixes shipped in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CISA added both flaws to its Known Exploited Vulnerabilities catalog on October 26.
Update the PHP runtime or your distribution's patched package and restart the workers. WAF rules alone do not complete remediation.
An October 23 follow-up covers CVE-2026-115560, involving session upload progress and applications that change session serialization handlers at runtime. PHP recommends session.upload_progress.enabled=0 pending the next regular fix.
securityPHP: October security announcementsBrotli decoder flaw reaches Node.js, Python packages and PHP builds
CVE-2026-111497, disclosed on October 21, allows malformed Brotli data to trigger an out-of-bounds write during decompression. Applications using the affected C decoder can crash, disclose memory or potentially execute code. Copies bundled into applications and container images need attention alongside system libraries.
Node.js fixes shipped in 22.23.4, 24.22.1 and 26.12.1. Python fixes are Brotli 1.2.1 and brotlicffi 1.2.1.0.
On October 26, PHP rebuilt its Windows packages as 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 with updated Brotli. The PHP runtime version stayed unchanged; the package revision identifies the dependency fix.
securityNode.js: October 21 security releasesLiteLLM 1.107.0 compromise: clean source tag, malicious release artifacts
On October 21, a compromised LiteLLM release pipeline published credential-stealing malware in PyPI version 1.107.0 and container images. The October 23 investigation traced the intrusion from an exposed internal administrative key to stolen GitHub tokens and a workflow redirected to an attacker-controlled repository. The official GitHub source tag did not contain the malicious files.
Use the completed investigation for the attack chain; it corrects assumptions in the initial incident post.
If affected artifacts ran, rebuild from a clean environment and rotate credentials accessible to the host. For moving container tags such as latest, check the digest actually pulled and when it ran.
securityLiteLLM: completed attack-chain investigationGitLab emergency patches fix unauthenticated code execution
GitLab's October 21 critical release fixes CVE-2026-110264, an integer overflow when compiling a crafted regular expression. Under certain conditions, an unauthenticated attacker could execute code on the server. GitLab rates it CVSS 10.0, with affected self-managed releases reaching back to version 7.0.
Fixed versions are 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1. Upgrade to a fixed release for your branch or later. GitLab.com was already patched when the notice was published.
securityGitLab: October 21 critical patch releaseeMudhra weak intermediate CA keys trigger emergency trust updates
On October 17, researchers reported that private keys associated with eight eMudhra intermediate CAs were recoverable because they had insufficient randomness. Browser vendors blocked affected keys and changed trust stores. Clients still trusting those keys could accept forged website certificates, so applications with separate certificate stores also need checking.
eMudhra acknowledged a script error in key generation. Its October 26 update said the affected intermediates had not issued publicly trusted end-entity certificates, and its investigation had found no infrastructure or customer-data compromise.
Operators using affected certificate chains need replacement certificates; clients need the relevant trust updates.
securityGoogle: Chrome and Android certificate responseEDK II PXE flaw allows code execution before the OS loads
TianoCore disclosed CVE-2026-97631 on October 22. During IPv4 or IPv6 PXE boot, a crafted ICMP error can overflow a buffer in the EDK II network-boot driver and allow code execution before the operating system loads. The advisory assigns CVSS 4.0 severity 9.5.
Exposure requires PXE boot and delivery of the malicious ICMP error. Disable unused network-boot paths and check the hardware vendor's firmware guidance. An upstream source fix and an installable firmware update for a particular machine are separate steps.
securityTianoCore: EDK II PXE driver advisoryNext.js security update covers cache functions, SVG processing and Server Actions
On October 14, Next.js released 16.4.1 and 15.5.28 with upstream security fixes. The notice covers code execution in use cache functions returning multiple typed arrays, code execution during SVG optimization on glibc-based Linux, and denial of service through Server Actions. Exposure depends on the application's features and runtime.
Upgrade to a patched Next.js release or later. The notice lists sharp 0.35.5 or later as a workaround for the SVG issue; that dependency change does not address the other issues in the notice.
securityNext.js: October 14 upstream security updateDeno team joins Cloudflare and sets a runtime wind-down schedule
On October 9, the Deno team announced it was joining Cloudflare. It will provide monthly runtime bug fixes and security updates for another year, then end its runtime development. Deno Deploy will shut down after six months. JSR will continue operating with its infrastructure moving to Cloudflare.
The follow-up maintenance notice specifies Deno 2.9.x LTS support through October 2027. Runtime support and the hosting service have different deadlines. The runtime remains open source.
runtimeDeno: joining CloudflarePython 3.15 adds explicit lazy imports and defaults to UTF-8
Python 3.15 shipped on October 9 with explicit lazy imports, built-in frozendict and sentinel types, UTF-8 as the default encoding, and a stable ABI for free-threaded builds. Lazy imports give applications control over module-loading work, while the encoding change calls for checking file I/O that relied on locale defaults.
The release also adds a profiling package and the Tachyon statistical sampling profiler. When adopting lazy imports, check when module initialization runs and when import errors surface.
languagesPython: What's New in 3.15Node.js 26 enters Lithium LTS as 27 begins its annual alpha cycle
Node.js 26.13.0 entered LTS as Lithium on October 28, with updates planned through the end of April 2029. The following day's 27.0.0-alpha.0.0.0 starts the new annual release cycle. Node.js 27's final release is scheduled for April 2027.
26.13.0 changes LTS metadata without further changes from 26.12.1. Version 27 is an alpha. Teams moving from an older LTS should also check the official Linux binaries' libatomic dependency.
runtimeNode.js 26.13.0 Lithium LTSTypeScript 7.1 Beta brings import attributes into ambient declarations
TypeScript 7.1 Beta arrived on October 20. Ambient module declarations can specify import attributes, allowing types to reflect whether an asset is loaded as text, bytes or CSS rather than relying on its filename extension alone.
This is a beta release. Test declarations against the import attributes supported by your bundler and runtime.
languagesMicrosoft: TypeScript 7.1 BetaNext.js 16.4 enables Cache Components by default in new apps
Next.js 16.4 shipped on October 6. New create-next-app projects enable Cache Components by default, while existing applications can adopt the model after reviewing their configuration and cache boundaries. The release also includes development memory and disk improvements, smaller production bundles, React 19.3 support and expanded bundle analysis.
For an existing application, adoption involves checking which work runs during the build and which runs for each request. October's security fixes are covered separately.
frameworksNext.js 16.4 releaseRust 1.99 stabilizes C variadic definitions, followed by regression fixes
Rust 1.99.0, released October 1, stabilizes defining variadic functions with the C and C-unwind ABIs. Rust could already call external variadic C functions; it can now implement them too. Raw-pointer size and alignment APIs also became stable.
The October 15 release of 1.99.1 fixes x86_64 FFI bool return-value miscompilation, missing wcslen link symbols on some targets, and rust-lld loading libLLVM on macOS. Projects using those interfaces or targets should check the patch release.
languagesRust 1.99.0 release