Not Just PHP and Node.js: NGINX, GitLab, Go and a Hacked Certificate Authority Also Need Patching This Week

This week we covered PHP2Shell, the critical PHP bug, published a step-by-step guide to patching it, and broke down the Node.js Brotli flaw that hits Next.js apps. But PHP and Node.js were only part of the story. In the same few days, NGINX, GitLab and Go all shipped security fixes, and an Indian certificate authority called eMudhra lost control of eight of its signing keys.

A post doing the rounds on X summed it up as: PHP 2 CVEs, Node.js 10, NGINX 5, Go 1, GitLab 12, plus the eMudhra certificate compromise. We checked every number against the official advisories. Here is what holds up, what each one means in plain language, and what to update.

Fact Check: Is the Viral List Accurate?

Short answer: yes. Every count matches the vendors' own releases, with a few details worth knowing.

• PHP: 2 CVEs. Correct. CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), fixed October 21. Covered in our original article.
• Node.js: 10 CVEs. Correct. The October 21 release fixed ten issues, four rated High, including the Brotli remote code execution bug. Covered in our Node.js article.
• NGINX: 5 CVEs. Correct. Fixed in NGINX 1.30.6 and 1.31.7. These came out on October 14, a week before the others, so they are easy to miss in the noise.
• Go: 1 CVE. Correct. CVE-2026-111943. It is not a bug in Go's own code. It is Go's response to the eMudhra incident: Go now refuses the compromised certificates.
• GitLab: 12 CVEs. Correct. One Critical (CVSS 10.0), two High, the rest Medium and Low, all in the October 21 patch release.
• eMudhra: CA compromise. Correct. Private keys for eight intermediate certificates were recoverable. Browsers blocked them between October 17 and 20.

One nuance: the NGINX project itself rates its five issues as "medium", while F5 (the company behind NGINX) scores the three worst at 8.1 High on CVSS 3.1 and 9.2 Critical on CVSS 4.0. Whether you are exposed depends on your configuration, which we explain below.

The 30-Second Version

• Run self-hosted GitLab? Patch today. This is the most dangerous item on the list.
• Run NGINX anywhere (directly, in Docker images, or as a Kubernetes ingress)? Update to 1.30.6 or 1.31.7.
• Build software in Go? Upgrade to Go 1.26.10 or 1.27.3 and rebuild your binaries.
• Run any server or container? Update the system's list of trusted certificates (the ca-certificatesCopy to clipboard package) because of eMudhra.
• Still haven't patched PHP or Node.js? Do that first. Our PHP fix guide and Node.js guide have the exact versions.

GitLab: A Perfect 10 That Goes Back to 2014

GitLab is where many software teams keep their code, run their builds and store deployment secrets. If you host your own GitLab server, this is the one to worry about most.

The headline bug, CVE-2026-110264, has the maximum severity score of 10.0. An attacker does not need an account. The flaw sits in how GitLab handles regular expressions (text-matching patterns) through the Ruby language it runs on, and reports trace the entry point to GitLab displaying a certain kind of document file (.orgCopy to clipboard) stored in a repository. A crafted pattern triggers an integer overflow, which can lead to running code on the server. Every version since GitLab 7.0, released in 2014, is affected, in both Community and Enterprise editions.

The trap: GitLab also shipped a critical fix on October 12 for a different 10.0 bug (CVE-2026-97229). If you patched then, you are still vulnerable to this one. You need the October 21 builds.

The same release fixed two High-severity issues as well: CVE-2026-15723 (8.2), an account takeover when SAML sign-in and LDAP auto-linking are both enabled, and CVE-2026-112212 (7.5), poisoning of the OAuth/OIDC discovery cache.

What to do

1. Upgrade to one of the fixed versions: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10Copy to clipboard or 18.11.13Copy to clipboard.
2. There is no workaround or config switch. Upgrading is the only fix.
3. Older release lines are out of support and get no patch. Plan an upgrade path now.
4. 19.4.3 and 19.3.6 include database migrations, so schedule a short maintenance window and take a backup first.
5. GitLab.com (the hosted service) is already patched. If you only use gitlab.com, you have nothing to do.

As of October 22, researchers had not confirmed any attacks in the wild or a public exploit. That window rarely stays open long for a bug this severe.

NGINX: Five Fixes, Some Bugs Nearly 20 Years Old

NGINX is the web server and reverse proxy sitting in front of a huge share of websites, including many Laravel, WordPress and Node.js apps. It is also baked into lots of Docker images (for example the popular PHP-FPM + NGINX images) and Kubernetes ingress controllers, so you may be running it without realising.

On October 14, NGINX released 1.30.6 (stable) and 1.31.7 (mainline), fixing five issues:

• CVE-2026-15176: heap buffer overflow when alias and rewrite are used together. Affects versions all the way back to 0.1.29.
• CVE-2026-93479: buffer overflow when evaluating expressions with variables (for example in document root or log settings). Affects 1.30.0 to 1.30.5 and 1.31.2 to 1.31.6.
• CVE-2026-97205: use-after-free when SSI and asynchronous file I/O (aio) are both on. Affects 0.8.11 onwards.
• CVE-2026-95101: under HTTP/3, extra bytes can be passed to your backend as if they were part of the request.
• CVE-2026-97629: TLS session tickets can be forged because of an uninitialised key.

The common thread: each bug needs a particular feature or directive to be switched on. A default setup may not be hit by all five, but auditing years-old config files is slower and riskier than simply upgrading.

What to do

1. Check your version with nginx -vCopy to clipboard. Anything below 1.30.6 (stable) or 1.31.7 (mainline) should be updated.
2. Update through your OS package manager or the official nginx.org repository. Distribution packages may carry the fix under a different version number, so check your distro's security notice.
3. For Docker, pull the latest image tags and rebuild. Restarting a container that still uses the old image changes nothing.
4. If you use an ingress controller, managed load balancer or control panel, check that its bundled NGINX has been bumped.

eMudhra: When the Padlock Itself Can Be Faked

This one is less familiar, but it affects everyone online.

When you see the padlock in your browser, it means a certificate authority (CA) vouched that the website is genuine. Think of a CA as a passport office. Its private signing keys are the office's official stamp. If anyone else gets the stamp, they can issue convincing fake passports.

eMudhra is an Indian CA. Eight of its intermediate certificates, created in April 2025, were generated with badly broken randomness. Their private keys were so weak that researchers could work them out from the public certificate alone. Security researcher Scott Helme found that one of the keys was literally the number 4. With those keys, an attacker could create a trusted-looking certificate for any website and impersonate it.

The response was fast. A researcher reported it on October 17. Chrome and Firefox blocked the certificates within hours, eMudhra revoked all eight on October 18, Apple followed on October 19 and Microsoft on October 20. Chrome found no rogue certificates in public logs.

Why developers still need to act

Browsers are protected. Your servers, containers, scripts and apps may not be. Many programs don't use the browser's list of trusted CAs. They use a copy bundled into the operating system, the language runtime or a library. That is exactly why Node.js updated its built-in certificate list in its October 21 release, and why Go issued its one CVE.

1. Update the ca-certificatesCopy to clipboard package on every Linux server and in every container base image, then rebuild images.
2. In Python projects, update certifiCopy to clipboard (version 2026.10.19 or newer) and pip.
3. Update Node.js to the October 21 releases, which also carry the eMudhra fix.
4. Rebuild Go binaries with the patched toolchain (see below).
5. If your own website uses a certificate that chains to emSign ECC Root CA G3, replace it with one from another provider now. Chrome removes that root entirely on October 27, 2026, and sites still using it will break.

Go: One CVE, but You Must Rebuild

Go's single fix, CVE-2026-111943, teaches its crypto/x509 package to reject any certificate chain that includes one of the eight eMudhra keys. It shipped on October 19 (US time) in Go 1.26.10 and Go 1.27.3.

The catch for Go teams: Go compiles everything into a single binary. Updating Go on your laptop does nothing for programs already running in production. Upgrade the toolchain, update the version in go.mod, Dockerfiles and CI, then rebuild and redeploy. Running govulncheck ./...Copy to clipboard will flag code still built with an older Go (it reports this as GO-2026-6809).

Why This Matters for Businesses in Pakistan

A large share of websites and internal tools here run on exactly this stack: PHP or Node.js behind NGINX, code hosted on a self-managed GitLab, with tools written in Go. Many of these servers were set up once and rarely touched again. A week like this is a reminder that "it's working, don't touch it" is how outdated, exploitable servers pile up.

Your Patch Checklist for This Week

1. Self-hosted GitLab: upgrade to the October 21 release for your line. Highest priority.
2. PHP: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your vendor's backport. Full guide here.
3. Node.js: 26.12.1, 24.22.1 or 22.23.4. Details here.
4. NGINX: 1.30.6 or 1.31.7, including inside Docker images and ingress controllers.
5. Certificates: update ca-certificates and certifi; replace any emSign-chained certificate before October 27.
6. Go: 1.26.10 or 1.27.3, then rebuild and redeploy every binary.
7. Rebuild containers: pull fresh base images. Restarting old ones is not patching.

If you'd like a hand auditing or patching your servers, Team Peham can help. Book a 30-minute call and we'll walk through your setup.

Official Sources & References

• nginx.org: Security advisories
• Go 1.27.3 and 1.26.10 security announcement (oss-security)
• Go vulnerability database: GO-2026-6809
• Google: Protecting Chrome and Android users from compromised eMudhra certificates
• Mozilla Security Blog: eMudhra intermediate certificates
• eMudhra: Statement on the certificate security incident
• Node.js: October 21, 2026 security releases
• eSecurity Planet: GitLab patches second 10.0 RCE flaw in October
• The Hacker News: Eight eMudhra CA keys compromised