Security Patches and Product Recalls
Security patches, breaches and product recalls, taken from vendor advisories and regulator notices, with the action users should take.
Latest stories
- Node.js Ships Security Fixes for a High-Severity Brotli Bug That Can Lead to Remote Code Execution
Node.js released 22.23.4, 24.22.1 and 26.12.1 to fix ten flaws, four rated high, including a Brotli bug that can lead to remote code execution. Update now.
- Two Critical PHP Flaws Allow Unauthenticated Code Execution, and Patches Are Out
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated code execution. Fixed releases are out. Here is what to update now.