PHP, GitLab, Node.js patch critical RCEs same day; researcher says open internet is ending
ChrisGPT · x · 2026-10-22
Security researcher ChrisGPT argues yesterday's vulnerability wave is 'the assassination of Archduke Franz Ferdinand for the internet' — the beginning of the end of the open internet:
- Same-day patches: two critical unauthenticated PHP RCEs, a CVSS 10.0 regex RCE in GitLab (CVE-2026-110264), and a high-severity Brotli decoder RCE in Node.js (CVE-2026-111497); LiteLLM also disclosed a release with credential-stealing malware
- Core argument: more capable AI lets attackers automate 'checking the locks' at machine speed, finding and exploiting flaws before defenders can patch — exposing millions of users' data or taking critical services offline
- Prediction: sensitive systems will move behind private intranets with tightly controlled gateways and strict per-person/per-agent access limits
Fixes: PHP 8.5.12/8.4.27/8.3.36/8.2.35, Node.js 22.23.4/24.22.1/26.12.1, GitLab security patches available.
More from AGI Musings
- 60% of chatbot responses miss critical safety warnings — what does that mean for autonomous agents? — fortiplus84 · 2026-10-22
- mdancho84: The Valuable Ones Architect Systems — Agents, Workflows, Memory, Eval Loops — mdancho84 · 2026-10-22
- AutoResearch: AI Agents That Run the Full Research Loop Autonomously — mdancho84 · 2026-10-22
- 'Understanding debt': AI can find the proof, but skipping comprehension is costly — gerardsans · 2026-10-22
- Reddit debate: why AI's pDoom wouldn't pass airline-safety standards — East-Firefighter8377 · 2026-10-22
- Anthropic survey asks businesses how much money it'd take to stop using AI tools for a month — aloncarmel · 2026-10-22