Security recap from the last 24 hours that actually matters.
- PHP, 2 CVEs
- Node.js, 10 CVEs
- SSL, 8 eMudhra intermediate certificates compromised
- GitLab self-managed, 1 CVE rated 10.0
What's the problem?
PHP
- CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2
- Unauthenticated remote code execution in the PHP runtime itself
- Every PHP site serving web requests is affected, so WordPress, Laravel and Drupal too
- Exploit attempts are already being reported
Fixing PHP
Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older get no official fix.
Node.js
- 4 High, 3 Medium, 3 Low
- A brotli decoder bug that can lead to remote code execution
- TLS hostname checks that can be bypassed with oddly written IP addresses
- dns.resolve breaking on names with null bytes
Fixing Node.js
Upgrade to 22.23.4, 24.22.1 or 26.12.1. EOL versions stay vulnerable.
eMudhra
- 8 intermediate certificates from this CA were compromised
- That means someone could forge HTTPS certificates
- Browsers already block them, but Node apps, containers, VPNs and CI keep trusting them until you update
Fixing eMudhra
Update Node, Go, your OS CA bundle and your container base images. If your site uses an emSign certificate, get a new one.
GitLab self-managed
- CVE-2026-110264, CVSS 10.0, unauthenticated remote code execution
- Fix is 19.5.1 plus backports. https://t.co/hTUjXKDHjb is already patched.
So, have you upgraded and patched?
If not, better talk to your team today. These are serious because the impact can be
- Attackers running code on your server without logging in
- Leaked user data and secrets
- Fake HTTPS certificates silently accepted by your backend services
Sabias que la ensalada César, fue inventada en México? : El inventor de esta ensalada fue el chef del restaurante Cardini (en Tijuana), Remigio Murgia, aunque el platillo se nombró así en honor al dueño y cocinero César Cardini.
Hubieran aprovechado para subir al avión y visitar y llevar ayuda a la gente que lo perdió todo en Reynosa a causa del huracán. ¡ah! pero dejaron en cero el presupuesto de Fonden, y los damnificados no importan, sólo el circo mediático.
Y los enlaces redundantes que tanto presume @TotalplayEmp dónde están? Ya varios días sin servicio y simplemente solo te dicen “estamos trabajando para solucionar el problema” #totalplay
Serán verdad los rumores?, que en México no hay casos de coronavirus, por el echo de que simplemente están haciendo muy pocas pruebas a los posibles casos? Que opinas?