Web Development

JavaScript, TypeScript, Node.js, React, Vue, Angular, Next.js, Nuxt, Svelte, HTML, CSS, Tailwind CSS, WordPress, WordPress plugin, WordPress theme, WordPress development, WooCommerce, PHP, Laravel, Django, Flask, FastAPI, GraphQL, REST API design, web performance, Core Web Vitals, SEO, web accessibility, WCAG, PWA, web app, frontend, backend, full-stack, Vite, Webpack, npm, pnpm

21 stories

Cybersecurity

Urgent PHP Windows Builds Patch Critical HTTP2Shell Vulnerability

The PHP project has released updated Windows builds to mitigate a serious flaw known as HTTP2Shell. Announced on October 26, 2026, the new packages are PHP 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1; each Windows build now includes an updated Brotli library (1.2.1) that fixes CVE-2026-111497. Administrators running PHP on Windows should treat these updates as urgent and apply them promptly. Release details The "-1" suffix in the version numbers denotes Windows…

Saugata DattaOct 27, 20263 min read11

Cloudflare

Cloudflare Issues Emergency WAF Rules for CVE-2026-111497 Brotli Flaw

Cloudflare has released an emergency Web Application Firewall (WAF) ruleset update tied to CVE-2026-111497, a memory flaw in Node.js’s Brotli decoder. Published on October 25, 2026, the update adds two new detections designed to surface potentially risky traffic related to the vulnerability while leaving blocking decisions to customers by default. What Cloudflare added The release introduces two rules: one that detects requests declaring a Brotli-compressed request body and another that…

Saugata DattaOct 26, 20263 min read14

Linux

Windows 11 KB5127936: Microsoft removes a hidden app-launch slowdown

Microsoft has quietly been squeezing more speed out of Windows 11, and one of the latest tweaks targets a small but perceptible friction point that slows app launches. In the newest Release Preview update, KB5127936, Windows will stop spawning a temporary process when you open a link or launch Edge from the Taskbar or Start menu if the browser is already running. That unnecessary detour lengthens the launch path; removing…

Saugata DattaOct 26, 20263 min read14

Cybersecurity

PHP2Shell and the PHP scare that nearly stopped the web

On Wednesday, a pair of long-dormant vulnerabilities in PHP sparked an emergency scramble across the internet. The bugs—dubbed PHP2Shell and assigned CVE‑2026‑109618 and CVE‑2026‑109619—allow unauthenticated remote code execution on affected systems. Once researchers demonstrated exploitability, vendors and web hosts rushed to apply patches released by the PHP Foundation, while companies and governments warned users and some organizations temporarily took services offline to protect themselves. What happened Security researchers at Calif…

Saugata DattaOct 24, 20264 min read50

Cybersecurity

Brotli Decoder Bug Sparks Cross-Platform RCE Risk — What to Know and Do

A memory-corruption flaw in Google's Brotli decoder (tracked as CVE-2026-111497) has rippled through numerous runtimes and libraries that embed the decoder, creating potential crash, memory-leak, or remote code execution vectors when untrusted Brotli-compressed data is processed. The issue was disclosed on October 21 after fixes began appearing in Node.js and Google’s Brotli source, and researchers from Imperva demonstrated code execution against an unpatched Node.js build. No confirmed in-the-wild exploitation has…

Saugata DattaOct 24, 20264 min read57

Cybersecurity

Node2Shell: Crafted Brotli Data Lets Code Run in an Official Node.js Build — What Operators Need to Know

Imperva researchers have demonstrated a proof-of-concept exploit—dubbed “Node2Shell”—that uses crafted Brotli-compressed data to achieve remote code execution (RCE) against an official Node.js 24.22.0 build for Linux arm64. The issue, tracked as CVE-2026-111497, was disclosed by Node.js and patched on October 21, 2026. While the demonstration did not work reliably on every attempt and targeted a specific build and architecture, it highlights a real risk for services that decode untrusted Brotli…

Saugata DattaOct 23, 20265 min read86

Cybersecurity

PHP’s New Warning: Narrow Unpatched RCE Path After PHP2Shell Fixes

PHP released a short advisory on October 23 warning of a separate, unlikely path that could let an attacker run code on a web server — just two days after emergency fixes for the critical PHP2Shell flaws. While the newly disclosed issue (CVE-2026-115560) is not being treated as an emergency, administrators should understand the configuration that creates the risk, confirm whether their apps are affected, and apply the recommended mitigation…

Saugata DattaOct 23, 20264 min read91

Cybersecurity

Global websites taken offline after critical PHP vulnerability forces emergency patches

Websites around the world went dark this week after security researchers uncovered a serious flaw in PHP, the programming language that underpins roughly 70% of the web. Governments and organisations ordered precautionary takedowns while a patch was released, but experts warned that a long tail of unmaintained sites could remain vulnerable for weeks or months — creating a persistent window for exploitation. What happened Researchers reported a critical vulnerability in…

Saugata DattaOct 22, 20264 min read110

Web Development

Fake PuTTY in Google Search: How Attackers Trick IT Admins with a Trojanized Installer

IT administrators hunting for a trusted SSH client on Google can be lured to a convincing fake download page that drops a trojanized installer. The malicious MSI appears to install the legitimate PuTTY executable so the program opens and looks normal, while a stealthy Node.js-based loader runs in the background and connects to attacker-controlled infrastructure. Because the visible application behaves as expected and the bundled PuTTY binary is signed, many…

Saugata DattaOct 14, 20264 min read129

Cybersecurity

WordPress Imagick RCE (CVE-2026-65640): What Site Owners Need to Know

WordPress has just released a security-focused update — version 7.0.4 — to close a remote code execution flaw that can be triggered when images are processed with the Imagick extension and Ghostscript. The vulnerability, tracked as CVE-2026-65640 and described in GHSA-8vr3-7mxf-gx8w, was responsibly disclosed by researchers at pwn.ai. While exploitation requires an authenticated Author-level account or higher, the bug’s mechanics mean multi-author sites, membership platforms, and installations with broad contributor…

Saugata DattaAug 13, 20264 min read184

Cybersecurity

70% of WordPress Sites Running Outdated PHP Versions, Leaving Millions Exposed

A recent analysis of publicly accessible WordPress installations has revealed a startling reality: a large majority of sites are running PHP versions that are no longer supported, creating a widespread and avoidable security risk. While WordPress itself issues regular updates, the underlying server-side language many sites rely on—PHP—has lagged behind in adoption. The result is an ecosystem where millions of sites are exposed to known vulnerabilities, automated scanning, and opportunistic…

Saugata DattaJul 8, 20264 min read255

Cybersecurity

Photo ZIP Campaign Targets Hospitality Industry with Node.js Implant for Persistent Access

Microsoft Threat Intelligence has identified an active, multi-stage intrusion campaign that has targeted organizations in the hospitality and hotel industry since April 2026. Attackers delivered browser-downloaded photo-themed ZIP archives that contained executable shortcut files disguised as images. When opened, these shortcuts kicked off an obfuscated PowerShell chain that fetched a Node.js–based implant, established dual registry persistence, and initiated command-and-control (C2) communications over non-standard ports. Observed post-compromise behaviors include beaconing to…

Saugata DattaJun 26, 20265 min read192

Free Tools: IP, DNS, SSL