Waiting on a Node.js Upgrade? Build a Stopgap with the Controls You Own

Qualys security intelligence highlights critical and high-severity vulnerabilities disclosed in October 2026, including unauthenticated remote code execution in PHP (PHP2Shell), a remote code execution flaw in the Node.js Brotli decoder, compromised eMudhra intermediate CA certificates enabling fraudulent certificate issuance, and a Windows Defender local privilege-escalation chain. The feed emphasizes urgent patching, asset discovery, runtime reachability, compensating controls, and detection of affected systems.