It wouldn't be a complete train wreck without needing to patch your node.js as well, right?
xitter.cf/markgadala/status/2112…
🚨 BREAKING: Node.js just dropped its OWN security bombshell.
4 HIGH-SEVERITY vulnerabilities patched TODAY, including one that could let hackers remotely execute malicious code on vulnerable servers.
→ 10 SECURITY FLAWS were addressed in today's Node.js release, FOUR rated HIGH severity.
→ REMOTE CODE EXECUTION: CVE-2026-111497 is a serious flaw in Node.js's Brotli decoder that could allow attackers to execute malicious code remotely.
→ TLS SECURITY BYPASS: Two separate vulnerabilities could trick affected applications into accepting certificates for the WRONG server under certain conditions.
→ Think about that. Your application could establish an encrypted connection while failing to properly verify WHO it's talking to.
→ THREE MAJOR NODE.JS VERSIONS AFFECTED: Node.js 22, 24 and 26 all required emergency security updates.
→ RUNNING NODE.JS 18 OR 20? Those versions are END-OF-LIFE and aren't receiving these official security patches.
→ PATCH IMMEDIATELY: Update to Node.js 22.23.4, 24.22.1 or 26.12.1, depending on your release line. If you're using Docker, rebuild and redeploy your containers.
PHP AND Node.js both facing major security disclosures on the SAME DAY.
If you run a website or application, TODAY is the day to check your servers.
And remember: the public release of security patches can give attackers a roadmap to systems that haven't updated.
Don't be the last one to patch.
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
A statement issued by CERT (Computer Emergency Response Team) warns of a compromise involving eMudhra’s eight intermediate CA certificates due to weak cryptographic keys, which could allow attackers to issue fraudulent TLS certificates and intercept or modify encrypted communications. The advisory outlines mitigation measures, including security updates, certificate replacement where required, and verification of certificate trust chains.
Iteratively debugging via multi-GB verbose logging files is an entirely new AI-enabled paradigm that allows for 100x more complicated software to be created that simply would not otherwise be possible.
galgitron retweeted
No one went to prison.
No home confinement. No DPAs.
No one was even charged.
Water under the bridge. Onwards!
🇺🇸 BREAKING: Bank of America has been fined $1.2 BILLION by the US government.
The bank failed to flag over $5 BILLION in suspicious transactions, the Treasury says.
The missed transactions were linked to suspected Chinese money laundering networks and illicit finance around the southern US border.
The Treasury called the bank’s money laundering and sanctions failures “egregious and continued.”
The penalty includes a $750 MILLION fine from the Office of the Comptroller of the Currency, per the FT.
If you've ever wanted to know the face of someone becoming aware that his life instantly changed from a million dollar payday to 5 years in prison, it probably looks something like this:
