Internet infrastructure software exposed security risks in quick succession within a single day, involving PHP, Node.js, and Go.

BlockBeats news, October 22 — Multiple internet infrastructure software projects released security updates within a single day, covering remote code execution, TLS certificate validation bypass, and certificate trust risks. Among them:

PHP fixed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both of which can lead to unauthenticated remote code execution and affect PHP environments handling web requests. The fixed versions include 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Node.js published an advisory listing ten vulnerabilities, four of which are high severity, including remote code execution caused by an out-of-bounds write in the Brotli decoder, DNS name truncation, and two TLS certificate hostname validation bypass issues. The fixed versions are 26.12.1, 24.22.1, and 22.23.4.

In addition, the Go crypto/x509-related risk is tracked as CVE-2026-111943, rated "Important" by Red Hat with a CVSS 3.1 score of 6.8. Under conditions such as a specific network position and possession of relevant certificates, an attacker may impersonate a legitimate server and intercept or tamper with communications. Go 1.26.10 and 1.27.3 have added deny lists to block trust in the relevant compromised intermediate certificates.