Waiting on a Node.js Upgrade? Build a Stopgap with the Controls You Own

Qualys reports several critical and high-impact vulnerabilities disclosed in October 2026, including unauthenticated remote code execution in PHP (PHP2Shell), a remote code execution flaw in the Node.js Brotli decoder, compromised eMudhra intermediate CA certificates enabling fraudulent certificate issuance, and a Windows Defender local privilege-escalation chain. Organizations are advised to patch affected software, replace or revoke compromised certificates, and apply compensating controls where upgrades are delayed.