mailwal

NodeJS Security Release, PHP2Shell Critical Vulnerabilites, Railway Security Incident

Shruti Kapoor

👋 Hey, Shruti here! Welcome to another issue of my weekly frontend and AI roundup. Each week, I focus on the 5 stories that actually matter for senior engineers building in production. Paired with things worth watching and the releases you can’t afford to miss, it’s your one stop for everything at the intersection of React and AI. If you’re new here, welcome to a community of 4,600+ frontend engineers who care about shipping real things:

1️⃣ NodeJS Security Release

Node.js released security updates this week fixing multiple vulnerabilities across the 26.x, 24.x, and 22.x release lines.

Here are the 2 most severe ones:

  1. Brotli Decoder Out-of-Bounds Write (CVE-2026-111497): A high-severity flaw in Node.js's bundled Brotli decoder allows malformed compressed input to write past an internal buffer during streaming decompression. Decompressing untrusted data via node:zlib can corrupt process memory, leading to process crashes, memory leaks, or potential remote code execution.

  2. DNS & TLS Hostname Validation Flaws (CVE-2026-105482, CVE-2026-105483, CVE-2026-106069): High-severity parsing errors in dns.resolve() silently truncate hostnames containing NUL bytes, causing applications to act on IP records for a different domain than the one validated. Related flaws in tls.checkServerIdentity() allow attackers to bypass TLS server identity checks when hostnames use fullwidth digits or non-canonical IPv4 literals with leading zeros, authenticating connections with mismatched certificates.

It is recommended to upgrade Node.js installations to v26.12.1, v24.22.1, or v22.23.4 according to project's active version requirement.

Check out the full release post

💸 Sponsor: Preparing for System Design Interviews? Practice on GreatFrontEnd

Sign up with this link and use code “SHRUTI” to get an additional discount

⚡ Quick Hits

2️⃣ PHP Security Release after Critical Vulnerabilities

PHP released security updates fixing two critical remote code execution (RCE) vulnerabilities across the 8.5.x, 8.4.x, 8.3.x, and 8.2.x release lines.

Here are the vulnerabilities addressed:

  1. RCE via OOM Corruption (CVE-2026-109618): An out-of-memory corruption flaw occurs when a request reaches PHP’s memory_limit at a critical point, leaving partially initialized internal data that is later treated as valid. An unauthenticated attacker can trigger this to corrupt process memory and execute arbitrary code-demonstrated under default settings on Apache with mod_php before application code runs, as well as on PHP-FPM.

  2. RCE via Stale Global State (CVE-2026-109619): A fatal error at a critical execution point leaves internal global state pointing to memory allocated to a previous request. A subsequent request handled by the same worker reuses that freed memory, triggering a use-after-free condition, worker crashes, and remote code execution against real-world applications.

It is recommended to upgrade PHP installations to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 according to project’s active version requirement to maintain environment security.

Check out the full post

3️⃣ Railway Security Incident | Official Blog

A targeted cyberattack breached Railway’s internal infrastructure between October 20 and October 22, 2026. Forensic evidence indicates that attackers used sophisticated exploits to target high-value AI provider API keys, such as those from OpenAI and Anthropic - to execute model distillation attacks. By escalating privileges within Railway’s build pipeline, the malicious actors queried and decrypted stored environment variables, exposing sensitive credentials across approximately 1.85% of platform workspaces (roughly 100,000 projects).

To neutralize the threat, Railway halted build pipelines, invalidated user sessions, and revoked internal credentials, keeping live workloads online while ejecting the intruder. Railway also partnered directly with vendors like GitHub, OpenAI, and Anthropic to proactively revoke potentially exposed API keys.

Follow Railway’s official blog and status page for live updates.

Check out the full preliminary report

4️⃣ Compromise of 8 eMudhra Intermediate | Cloudflare Blog

eMudhra operates as a Certificate Authority (CA) that issues intermediate digital certificates to authenticate remote endpoints and establish secure web connections. Web browsers, operating systems, and enterprise cloud networks widely trust eMudhra’s intermediate certificates to verify domain identities and protect encrypted HTTPS traffic across global infrastructure.

On October 19, 2026, security teams discovered that private keys belonging to eight eMudhra intermediate certificates were compromised due to key weaknesses. This cryptographic compromise enables threat actors to forge valid SSL/TLS certificates for any domain. With forged credentials, attackers can impersonate web servers, intercept sensitive communications, and modify encrypted network traffic.

The incident affects operating systems, proxy networks, web applications, and client software that rely on eMudhra’s compromised intermediate certificates. System administrators must immediately update client tools - such as Cloudflare WARP and Cloudflare Tunnel (cloudflared) - refresh mutual TLS trust stores, and patch application software dependencies. Furthermore, security teams must audit origin server TLS settings while keeping active certificate verification enabled to prevent server spoofing.

Check out the full post

5️⃣ Future of CSS | Josh Comeau

Major browser vendors are collaborating under the Interop initiative to establish unified cross-browser support for upcoming web technologies. In a preview of candidate proposals for Interop 2027, Josh Comeau in this blog - highlights ten high-impact CSS features aimed at eliminating common workarounds, improving accessibility, and enabling advanced layout and animation control.

  • Custom Functions & Dynamic Inheritance: The proposed @function rule brings reusable custom logic directly into stylesheets, while inherit() allows developers to mathematically modify inherited parent property values inside calc() expressions.

  • Native Geometry & Border Styling: Properties like corner-shape and border-shape generate squircles, bevels, and custom paths that natively modify an element’s true border box, while gap decorations introduce native line separators between grid cells.

  • State & Layout Sensitivity: Level 2 Anchored Container Queries detect positional flipping for tooltips, scroll state container queries style sticky elements when anchored to the viewport, and reading-flow syncs keyboard navigation with responsive visual layouts.

  • Advanced Animations: The interpolate-size property enables smooth transitions to keyword lengths like height: auto, while scroll-triggered animations run keyframe sequences when elements reach specified scroll thresholds.

Check out the full post

❤️ Enjoyed this newsletter?

Give this issue a ❤️ and restack it so someone can benefit from this knowledge. It helps more people find this.

Want to sponsor this newsletter?

© 2026 Shruti Kapoor
522 W Riverside Ave Ste N, Spokane, WA 99201