PHP and GitLab the same day. Node.js too. Joyous.
On October 21, 2026:
- PHP fixed two critical vulnerabilities rated 9.2 that can allow unauthenticated code execution, in some deployments before application code runs. PHP advisory.
- GitLab patched a vulnerability rated 10.0 that could allow unauthenticated code execution under certain conditions. Affected self-managed installations need an upgrade; GitLab.com was patched. GitLab advisory.
- Node.js patched ten vulnerabilities across supported release lines, including a Brotli decompression flaw that permits remote code execution. Node.js advisory.
Add HTTP/3 memory exhaustion research and emergency trust updates following the eMudhra certificate compromise. All competing for engineering time.
Plan for more days like this
Anthropic's Deputy CISO, Jason Clinton, expects a difficult 18 months and urges security leaders to seek board support for the basics.
The timeline is uncertain. I'd start reducing the cost of each response now.
The PHP Foundation identified the underlying memory-handling problem in 2024. A fix stalled on compatibility trade-offs, limited resources, and initially no demonstrated path to remote code execution. Later reports established the impact and made remediation the priority. PHP Foundation.
Finding bugs faster increases the pressure on everyone who has to assess and remediate them.
Continuous Threat Exposure Management (CTEM) should reduce that work through scoping, discovery, prioritization, validation, and mobilization. In practice, I'd ask four questions. Gartner research.
Do we run it, and where?
Which systems run the software, in which configurations, and who owns them?
For WordPress, establish the PHP runtime serving requests and who can update it. Our PHP2Shell response guide covers deployment checks and remediation.
Assign someone to resolve each unknown, with a deadline.
What needs action first?
Check reachability, exploitation conditions, business impact, and whether controls block the attack path.
Cloudflare reports PHP attack traffic and attempts to bypass protections. It recommends patching even behind its WAF. Update priorities as that evidence changes. Cloudflare analysis.
Record why the exposure gets that priority.
Who's doing the work?
Assign an owner, an action, and a deadline.
Establish who can approve downtime, redirect engineering time, or escalate to a provider before several teams need help at once.
Investigate suspected compromise alongside remediation. Patching doesn't establish whether someone already got in.
How do we know it's handled?
Confirm the fixed code is running, configuration changes took effect, and provider updates cover your deployment.
Give temporary mitigations and exceptions a review date. Use the gaps you find to improve discovery, ownership, and validation.
In VulnOps, Minus the Mythology, we showed triage, exploit assessment, and detection engineering working from shared context.
I expect more days like this. CTEM should leave us spending less time reconstructing context and more time reducing exposure.
That's the work we're focused on at Mallory.
- jcran
