hunting on Raúl Pastor

Node.js October 2026 security release: Brotli RCE and certificate checks fooled by odd IPs

Mon, 26 Oct 2026 18:20:00 +0100

In one paragraph

On 21 October 2026 Node.js shipped 22.23.4, 24.22.1 and 26.12.1, fixing ten vulnerabilities. The headline is CVE-2026-111497, a memory corruption bug in the bundled Brotli decompressor that researchers nicknamed Node2Shell. Any app that decompresses Brotli data from someone it doesn’t trust is exposed, and two very common paths do it by default. CISA added it to the KEV catalog on 27 October. Node.js 20 and every other end-of-life line get no fix.

PHP2Shell: two pre-auth RCEs in PHP itself, explained

Sat, 24 Oct 2026 11:15:00 +0200

In one paragraph

Two flaws in the PHP engine, nicknamed PHP2Shell, let an unauthenticated attacker run commands on a server just by sending a crafted HTTP request. They trigger while PHP parses the request, before your application code runs, so it does not matter which framework or CMS you use or how well it is written. Exploitation attempts were seen four days before disclosure. Both CVEs are rated 9.2 (CVSS v4.0) and are in CISA’s Known Exploited Vulnerabilities catalog.

eMudhra's guessable CA keys: what happened and how to check your estate

Thu, 22 Oct 2026 19:40:00 +0200

What happened

A certificate authority (CA) is trusted to vouch for websites and software publishers. That trust rests on one thing: nobody else can use the CA’s private key.

On 17 October 2026 an independent researcher reported that eight intermediate CA certificates from eMudhra, an Indian CA, had private keys with values below 256. A healthy P-384 key is a random number around 115 digits long. These could be found by trying at most 256 values, and one of them was literally the number 4.