PHP, Node.js and Go Patch RCE, TLS and Certificate Trust Flaws

Security updates for PHP, Node.js and Go fixed flaws tied to remote code execution and certificate security, including two critical PHP bugs and four high-severity Node.js vulnerabilities. PHP and Node.js released updates Oct. 21; Go announced its patched versions Oct. 19, and its advisory appeared Oct. 21.

PHP fixed CVE-2026-109618 and CVE-2026-109619, critical flaws that can let an unauthenticated attacker execute code on systems processing web requests. The patched releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The update follows an earlier warning about the two PHP flaws.

The Node.js release lists 10 vulnerabilities, four rated high severity. They include an out-of-bounds write in the Brotli decoder that can enable remote code execution, DNS name truncation and two TLS certificate hostname-validation bypasses. Patched versions are 26.12.1, 24.22.1 and 22.23.4, across the three release branches covered earlier.

Go addressed CVE-2026-111943 in crypto/x509. Under certain network and certificate conditions, an attacker could impersonate a legitimate server and intercept or alter communications. Versions 1.26.10 and 1.27.3 add a denylist that blocks trust in affected intermediate certificates.