Так, NodeJS выкатил апдейт, в том и в связи с дуркой с сертификатами https://t.me/tech_b0lt_Genona/7171 https://nodejs.org/en/blog/vulnerability/october-2026-security-releases dns.resolve truncates names containing NUL char (CVE-2026-105482) - (high) This vulnerability affects Node.js 26.x, 24.x, and 22.x. TLS certificate hostname bypass when the IP is written fullwidth digits (CVE-2026-105483) - (high) This vulnerability affects Node.js 26.x and 24.x. TLS certificate hostname bypass when the host loosely resolves to an IP address (CVE-2026-106069) - (high) This vulnerability affects Node.js 26.x, 24.x, and 22.x. Node.js Brotli decoder out-of-bounds write permits remote code execution (CVE-2026-111497) - (high) A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution. This vulnerability affects Node.js 26.x, 24.x, and 22.x. Неделя вообще не скучной получается. _______ Источник | #tech_b0lt_Genona Две RCE подтвердились https://t.me/tech_b0lt_Genona/7176 Выпустили пост официальный по поводу уязвимостей в PHP Всем заинтересованным крайне рекомендую ознакомиться https://www.php.net/archive/2026.php#2026-10-21-5 PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs. The vulnerabilities: RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid. RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it. _______ Источник | #tech_b0lt_Genona ——— чем больше уязвимостей тем меньше уязвимостей ——— @F_S_C_P ▪️Генерируй картинки и видео в Mini App: Flux + Veo 3 + Wan 2.2 + MidJourney v7 + другие