https://pixelotes.com/tags/vulnerabilities/Recent content in vulnerabilities on Raúl PastorHugoenWed, 28 Oct 2026 08:45:00 +0100https://pixelotes.com/blog/nodejs-october-2026/Mon, 26 Oct 2026 18:20:00 +0100https://pixelotes.com/blog/nodejs-october-2026/<h2 id="in-one-paragraph">In one paragraph</h2> <p>On 21 October 2026 Node.js shipped <strong>22.23.4, 24.22.1 and 26.12.1</strong>, fixing ten vulnerabilities. The headline is <strong>CVE-2026-111497</strong>, a memory corruption bug in the bundled Brotli decompressor that researchers nicknamed <strong>Node2Shell</strong>. Any app that decompresses Brotli data from someone it doesn&rsquo;t trust is exposed, and two very common paths do it by default. CISA added it to the KEV catalog on 27 October. Node.js 20 and every other end-of-life line get no fix.</p>https://pixelotes.com/blog/php2shell/Sat, 24 Oct 2026 11:15:00 +0200https://pixelotes.com/blog/php2shell/<h2 id="in-one-paragraph">In one paragraph</h2> <p>Two flaws in the PHP engine, nicknamed <strong>PHP2Shell</strong>, let an unauthenticated attacker run commands on a server just by sending a crafted HTTP request. They trigger while PHP parses the request, <strong>before your application code runs</strong>, so it does not matter which framework or CMS you use or how well it is written. Exploitation attempts were seen four days before disclosure. Both CVEs are rated 9.2 (CVSS v4.0) and are in CISA&rsquo;s Known Exploited Vulnerabilities catalog.</p>