[Internet Fundamental Software Exposes Security Risks Within a Day, Involving PHP, Node.js, and Go] BlockBeats News, October 22: Multiple internet fundamental software projects released security updates within a single day, addressing issues such as remote code execution, TLS certificate validation bypass, and certificate trust risks. Among them: PHP fixed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both of which could lead to unauthenticated remote code execution, impacting PHP environments handling web requests. The patched versions include 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Node.js announced ten vulnerabilities, four of which are classified as high-risk, including remote code execution caused by out-of-bounds writes in the Brotli decoder, DNS name truncation, and two issues related to TLS certificate hostname validation bypass. The patched versions are 26.12.1, 24.22.1, and 22.23.4. Additionally, Go's crypto/x509-related risk is identified as CVE-2026-111943, rated as "important" by Red Hat with a CVSS 3.1 score of 6.8. Under specific network conditions and with relevant certificates, attackers could impersonate legitimate servers to intercept or tamper with communications. Go versions 1.26.10 and 1.27.3 have added a denial list to block trust in compromised intermediate certificates.