Brotli是常見的網頁資料壓縮格式，Node.js內建的解壓縮功能存在CVE-2026-111497漏洞。程式在解壓縮資料時，可能將內容寫入超出預定範圍的記憶體，造成記憶體資料遭破壞，嚴重時可能讓攻擊者遠端執行程式碼。該漏洞影響三個版本分支，但官方尚未詳細說明攻擊所需條件，也未公布遭實際利用的案例。

資安署指出，Node.js廣泛應用於現代網頁前端工具鏈、後端微服務架構與各類API伺服器。這次Node.js共修補10項資安漏洞，其中4項屬高風險等級。最受矚目的CVE-2026-111497漏洞存在於Brotli解碼器中，因邊界外寫入（Out-of-bounds Write）缺陷，攻擊者可藉由惡意構造的請求觸發記憶體損壞，進而達成遠端執行程式碼（RCE）。

PHP開發團隊即將修補的2個重大漏洞，傳出在公布之前就已經曝光！此事引起多家資安公司關注並提出警告，指出這些漏洞就是CVE-2026-109618、CVE-2026-109619，並將它們稱為PHP2Shell ...

資助PHP開發與資安工作的PHP基金會（The PHP Foundation）資安工程師Volker Dusch對《華爾街日報》說，這是PHP十多年來面臨過最嚴重的資安問題，他把它比作2014年迫使全球數十萬台伺服器緊急修補的Heartbleed漏洞。

New releases for Node.js 22.x, 24.x and 26.x fix high-severity vulnerabilities and protect against compromised eMudhra ...

Node.js 26.12.1, 24.22.1 and 22.23.4 fix 10 flaws, including Brotli RCE bug CVE-2026-111497 and three TLS hostname bugs.

Mudhra is exiting global TLS after 8 CA keys, one literally the number 4, proved crackable. What happened, who's affected and ...

Ollie reports key Halloween safety tips for dogs, including managing door traffic, securing candy, choosing safe costumes, ...

When I had a local AI fix my Web game, it ended up becoming unlaunchable. In the 6th installment where I created "Stardust ...

Have you ever thought, "It would be convenient if there were a website like this"? Recently, it has become possible to create ...

Google DeepMind researchers say four Gemini 4 Argon agents beat Minecraft in 27 hours, writing 2,783 programs with no human help.

Researchers hid a message for a live fleet of rogue AI agents, and the agents wrote back.