(Minghui.org) Over the last week, major security vulnerabilities have been reported in PHP, Node.js, and Go runtimes. Administrators who maintain servers using these technologies, including popular content management systems like WordPress, must act to protect their services from potential exploitation.

Since October 21, global cybersecurity agencies and official channels for PHP and Node.js have released critical security bulletins regarding vulnerabilities that allow unauthorized attackers to achieve remote code execution (RCE) or trigger a denial-of-service (DoS) attack.

Since the vulnerabilities exist in the language runtime or built-in libraries, simply updating front-end applications like WordPress plugins or npm packages will not protect a server; the language runtime itself must be upgraded.

Vulnerabilities in Major Technology Stacks

1) PHP (“PHP2Shell” Vulnerability)

- Remote code execution vulnerabilities: CVE-2026-109618, CVE-2026-109619 (CVSS score 9.2, critical risk)- Summary: Flaws exist in underlying memory management and global state handling. When an out-of-memory (OOM) error is triggered, it may lead to memory corruption or use of stale state by a later request handled by the same worker.Scope of impact: All unpatched PHP websites and servers. Attackers can launch attacks without any credentials or privileges.

2) Node.js

The Brotli decoder and network security vulnerabilities include CVE-2026-111497 (Brotli memory out-of-bounds write) and multiple TLS/DNS authentication vulnerabilities.- Summary: The built-in Brotli compressed data decoder has a memory out-of-bounds write defect; it also has the risk of bypassing credential and hostname verification.- Scope of impact: Handling untrusted Brotli compressed data, external network connections, and Node.js services for proxy servers.

3) Go Language and Related Frameworks

- Security patches have been released for relevant network protocols, standard libraries, and mainstream open-source frameworks, such as HTTP proxies and network management interfaces.- Scope of impact: Cloud-native services that use specific versions of Go modules or depend on them.

Urgent Actions for Server Administrators

Traditional package dependency checks (such as package.json or composer.json scans) cannot detect vulnerabilities in the runtime. It is necessary to check the runtime version running on the server and/or containers.

Older versions of language runtimes that have reached end-of-life (such as PHP below version 8.2 or Node.js below version 20) will not receive official patches. Applications running on these end-of-life versions must be either upgraded to a supported, patched version or isolated from the internet.

If resources are limited, server administrators can follow these steps in sequence:

1) Quick Asset Inventory (Version Check)

Log in to each server or container and confirm whether the version of the language runtime is impacted.

- For PHP, check if the running version is older than the patched version (see list below). Note: Some Linux distributions backport patches, so versions older than 8.2 may still receive patches. Check the official announcements or package logs for your distribution.

- For Node.js, check if you are using an affected 22.x, 24.x, or 26.x version.

2) Upgrade to a Patched Version Immediately

Upgrade your environment to the corresponding patched version below and restart the service process (such as PHP-FPM or the Node application) to clear residual memory:

- Patched PHP versions:PHP 8.5 series: upgrade to 8.5.12 (or later)PHP 8.4 series: upgrade to 8.4.27 (or later)PHP 8.3 series: upgrade to 8.3.36 (or later)PHP 8.2 series: upgrade to 8.2.35 (or later)

Patched Node.js versions:Node.js 22.x: upgrade to 22.23.4 (or later)Node.js 24.x: upgrade to 24.22.1 (or later)Node.js 26.x: upgrade to 26.12.1 (or later)

Note: Support for Node.js 20 and earlier versions has ended. You must upgrade to a supported release as soon as possible.

3) Rebuild Containers and Images

If you are using Docker or other cloud-native containers, simply changing the tag is not enough; the image must be rebuilt to ensure that the underlying runtime is updated and the service is redeployed.

Check your front-end web application firewall (WAF) or load balancer to confirm whether protection rules against abnormal POST traffic and malicious compressed packets are enabled.

The above is only an overview. In specific cases, technical personnel must urgently identify and remove risks based on their respective environments to maintain information security.

Copyright © 1999-2026 Minghui.org. All rights reserved.

Category: Media Reports