Between 20 and 22 October 2026, Node.js, PHP and the public certificate authority (CA) trust stores all shipped emergency fixes. The PHP flaw is being exploited right now. Repositories that pin exact versions or image digests do not pick these fixes up on their own. Snapshot taken 23 October 2026.
CVE-2026-109618 (memory corruption during out-of-memory handling) and CVE-2026-109619 (use-after-free across requests). Unauthenticated remote code execution and worker memory disclosure: passwords, tokens, API keys.
Details leaked on 20 Oct, the emergency release went out on 21 Oct, and honeypots saw attacks the same day.
CVE-2026-111497: a Brotli out-of-bounds write that a single malformed response can trigger, because fetch() and Express 5 decompress automatically. There are also two TLS certificate-hostname bypasses and a DNS truncation bug.
No exploitation reported yet. Node 20 and 25 are end of life and will get no fix.
CVE-2026-111943: eight intermediate CA private keys could be guessed in 256 tries. Anyone holding them could forge a trusted HTTPS certificate for any site on clients that still trust them.
Browsers blocked them on 17 to 22 Oct. Containers, curl, Go binaries and older Node versions still trust them until updated. No rogue certificates have been found in the Certificate Transparency logs yet.
| Repository | What was stuck on a vulnerable version | Risk | Status |
|---|---|---|---|
| mobile | Node pinned to exactly 24.14.0 in .node-version, package.json and eas.json. Every EAS build ran a vulnerable Node. Now 24.22.1. | Node | Fixed |
| framework | PHP image php:8.3-cli-alpine@sha256:f8a0… and an older Go 1.27 patch release. Now php:8.3.36 and Go 1.27.3. | PHPGo CA | Fixed |
| salesforce | node:24-bookworm-slim@sha256:0e0f… ops image. Now node:24.22.1-bookworm-slim. | NodeCA | Fixed |
| cloud | debian:trixie-slim@sha256:a99c… (old CA bundle), older Go and observability images. Now refreshed digests, Go 1.27.3, Prometheus, Loki and Tempo patch releases. | CAGo CA | Fixed |
| collections | postgres:18.0-bookworm@sha256:786f… migrate image and flagged lockfile packages. Now a refreshed digest and patched packages. | CA | Fixed |
| agents | Go 1.27.1 and flagged tooling packages. Now Go 1.27.3 and patched packages. | Go CA | Fixed |
| docs | Node floats on 24; flagged lockfile packages (dompurify, sharp, undici). Now patched. | Low | Fixed |
| planning | Node floats on 24; flagged tooling packages. Now patched. | Low | Fixed |
On 23 October 2026, every Omniyat repository that pinned a vulnerable Node, PHP, Go or CA bundle got a security - … pull request. Each one moved exact versions and image digests to the patched releases and fixed lockfile advisories flagged high or critical.
All 8 repositories were patched and merged between 04:26 and 04:32 UTC, after CI passed on each pull request. No advisory-related change was skipped.
To publish this page, the temporary artefact hosting service was bootstrapped the same morning. It gained an opt-in public mode, recorded as an owner decision in plan 381, and the hosting Worker went out through the cloud release pipeline. A cleanup bug found during the first publication was fixed and merged at 05:15 UTC.
cloud-cli-v release so the engine and dashboard images rebuild on the new base images.