· ToR Creative Studio · Website Security · 7 min read
One Wild Week: 30 Security Flaws, a Perfect 10.0, and a Certificate Key Worth 4
PHP, Node.js and GitLab patched 24 vulnerabilities on a single day, and that was only part of the week. What actually happened, in plain language, and the patch order we recommend for any business website.
If you own a business website, this was not a quiet week for the software underneath it.
A post making the rounds claimed that 30 security vulnerabilities landed in a single day: PHP, Node.js, NGINX, Go and GitLab, plus a compromised certificate authority. We went through the official advisories one by one. The real story is close, and in some ways worse: 24 of those flaws really did land on one day, Wednesday, October 21, 2026. The rest landed earlier in the same stretch, and one of them is not a software bug at all.
Here is the week, in plain language, with the fix for each one.
The week at a glance
| Date | What happened | Count |
|---|---|---|
| Sat, Oct 17 | eMudhra intermediate CA keys reported compromised, browsers block them within hours | Event, not a CVE |
| Mon, Oct 19 | Go ships an urgent fix that distrusts those certificates | 1 CVE |
| Wed, Oct 21 | PHP security release | 2 CVEs |
| Wed, Oct 21 | Node.js security release | 10 CVEs |
| Wed, Oct 21 | GitLab patch release | 12 CVEs |
| A week earlier, Oct 14 | The NGINX release people folded into this story | 5 CVEs |
Total on October 21 alone: 24 CVEs across three platforms most business websites touch every day.
Exhibit A: PHP, 2 flaws, both 9.2 Critical
PHP powers WordPress and a large share of the business web. Both flaws allow unauthenticated remote code execution, which means an attacker does not need a login to run code on your server. The pair has been nicknamed php2shell.
| CVE | What it is |
|---|---|
| CVE-2026-109618 | Remote code execution through out-of-memory state corruption |
| CVE-2026-109619 | Remote code execution through stale global state, a use-after-free |
The fix: update PHP to at least 8.2.35, 8.3.36, 8.4.27 or 8.5.12, depending on your branch. On PHP 8.1 or older there is no official fix. That is an upgrade conversation, not a patch.
Risk is highest on mod_php setups, and real on PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. There are no complete mitigations. Patching is the fix.
Exhibit B: Node.js, 10 flaws, worst rated High
Node.js runs modern sites, APIs and build tools. Its October 21 release fixed 10 distinct flaws: 4 High, 3 Medium, 3 Low. Note the ceiling: the highest severity is High, not Critical, no matter what the reposts say.
| CVE | Severity | What it is |
|---|---|---|
| CVE-2026-111497 | High | Brotli decoder out-of-bounds write, can allow remote code execution |
| CVE-2026-106069 | High | TLS certificate hostname bypass when a host loosely resolves to an IP address |
| CVE-2026-105483 | High | TLS certificate hostname bypass when the IP is written in fullwidth digits |
| CVE-2026-105482 | High | dns.resolve truncates names containing a NUL character |
| CVE-2026-105481 | Medium | Keep-alive socket can process a response written before the request was sent |
| CVE-2026-106072 | Medium | Improper certificate validation for non-canonical IPv4 hostnames |
| CVE-2026-106074 | Medium | randomUUID and randomInt entropy caches leak into startup snapshots |
| CVE-2026-106070 | Low | ZipFile returns attacker-controlled prefix bytes after failed validation |
| CVE-2026-106071 | Low | Permission Model filesystem over-grant through wildcard lookup |
| CVE-2026-106073 | Low | Permission Model bypass through fs.realpathSync |
The fix: update to at least Node 22.23.4, 24.22.1 or 26.12.1. Then check every place Node runs with node -v: laptops, CI, containers and servers. Your package audit does not cover the runtime itself. Node 20 and older are end of life and get no fix.
Exhibit C: GitLab, 12 flaws, one perfect 10.0
GitLab, self-hosted and cloud, shipped 12 security fixes on October 21: 1 Critical, 2 High, 5 Medium and 4 Low.
The critical one deserves its own line: CVE-2026-110264, CVSS 10.0. An integer overflow in GitLab’s regular expression compiler lets an unauthenticated user execute arbitrary code with a specially crafted regular expression. If you run your own GitLab, this is patch-today, not patch-this-month.
The rest, in short: an OmniAuth and LDAP account takeover (8.2), OAuth/OIDC discovery cache poisoning (7.5), a GraphQL work item email access flaw (6.8), a SAML/LDAP membership lock bypass (5.9), and eight lower rated access control, credential exposure and cleanup flaws between 4.3 and 2.7.
The fix: update to 19.5.1, 19.4.3 or 19.3.6. The 10.0 flaw was also backported to 19.2.9, 19.1.9, 19.0.10 and 18.11.13. Worth knowing: GitLab patched a different 10.0 regex flaw on October 12. Being patched last week does not cover this one.
NGINX: 5 real flaws, wrong day
The five NGINX flaws in the viral count are real: buffer overflows in alias with rewrite and in script evaluation, HTTP/3 request body injection, TLS session ticket forgery, and a use-after-free in AIO with SSI. CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97629 and CVE-2026-97205, all rated medium by nginx.org, all fixed in 1.31.7 and 1.30.6.
They were just not this week. That release shipped October 14. The NGINX release on October 21, version 1.31.8, contained no security fixes. If your server runs NGINX older than those fixed versions, the date does not matter. Update anyway.
Go: 1 flaw, and it is really about eMudhra
Go released 1.27.3 and 1.26.10 on October 19 with one urgent fix, CVE-2026-111943: crypto/x509 now filters out certificate chains containing a small set of compromised intermediate certificates. Go programs need to be rebuilt with the patched release for the protection to apply.
Which brings us to the strangest story of the week.
eMudhra: a certificate key worth 4
Certificate authorities are the notaries of the web. Browsers trust them to say “this site really is who it claims to be.”
Eight intermediate CA certificates from eMudhra (emSign) had private keys that were not really private. Through a flaw in a key generation ceremony back in April 2025, the keys were generated as tiny numbers, all under 256. One of them was literally the number 4. Anyone who did the math could recover those keys in under a second, and with them, forge a trusted certificate for any website.
A researcher reported it on Saturday, October 17. Chrome blocked the keys the same evening. Mozilla blocked them within hours and later removed the root certificate from Firefox and NSS. eMudhra revoked all eight intermediates on October 18, saying its infrastructure was never breached and none of the eight had issued end-entity certificates. Chrome removes the root entirely on October 27, and roughly 30,000 legitimate certificates that chain to it need to move before then.
This is not a CVE by itself. It shows up inside other products’ fixes, including the Go release above and a certificate update inside the Node.js release. It is also a useful reminder: some of the most serious security events are not bugs in code you run. They are failures in the trust underneath everything.
What this means if you run a business website
You do not need to memorize CVE numbers. You need to know what your site runs, and whether it is patched. In order:
- Ask what your site runs on. PHP version, Node version, server software. If nobody can answer, that is finding number one.
- Patch the critical and high items first. PHP to the fixed versions above, self-hosted GitLab immediately, Node runtimes next.
- Check for end-of-life software. PHP 8.1 and older, Node 20 and older: no patches are coming. Budget the upgrade now, on your schedule, instead of during an incident.
- Rebuild and redeploy, not just update. Runtime fixes only count when the live site is actually running them. Go services need a rebuild. Node services need a redeploy.
- Check your certificate chain. If your certificate chains to the eMudhra G3 root, it stops working when Chrome removes that root on October 27. Your host or certificate provider can tell you in one look.
Not sure what your site is running?
That is exactly what our free scanner is for. Run the AI Readiness Scanner at torstudio.dev and you will see how your site looks to search engines, AI tools and security checks in about a minute, no login, no cost.
And if the scan, or this article, just told you something is out of date, talk to us. Keeping client sites patched, current and findable is the job. Weeks like this one are why it matters.
Sources
- PHP: php.net security advisory, October 21, 2026
- Node.js: nodejs.org, October 2026 Security Releases, October 21, 2026
- GitLab: GitLab patch release 19.5.1, October 21, 2026
- NGINX: nginx.org security advisories and news, October 14 and October 21, 2026
- Go: go.dev release history and golang/go issue 82345, October 19, 2026
- eMudhra: Mozilla CA incident report (Bugzilla 2083449), Google Chrome Root Program blog, Mozilla Security Blog, eMudhra statement, October 2026
