Weekly Security Roundup: PHP and Node.js Patches, OpenCode Breach, and More
Summary
The roundup covers critical PHP and Node.js fixes, a reported OpenCode Console breach, exposed Meta Muse share links, weak eMudhra signing keys, and security product and industry developments.
Key points
- PHP patched two critical flaws, CVE-2026-109618 and CVE-2026-109619, that could allow unauthenticated remote code execution; fixed versions are listed for PHP 8.2 through 8.5.
- OpenCode said a breach may have exposed AI provider keys for 1.4% of hosted Console users; users reported unauthorized charges and suspended Google Cloud projects.
- Node.js fixed CVE-2026-111497, a high-severity out-of-bounds write in its bundled Brotli decoder that could allow remote code execution. The advisory did not report active exploitation.
- Meta suspended Muse conversation sharing after researchers found more than 6,800 share links through passive DNS; some accessible conversations contained sensitive business and personal information.
- Researchers found that eight eMudhra signing keys could be recovered from public certificates and might enable forged website certificates accepted by vulnerable software; malicious exploitation was unconfirmed.
- Huntress documented attackers using a compromised ConnectWise application credential to access customer Microsoft 365 tenants and establish further access in two tenants.
- The roundup also covers updates to MITRE ATT&CK, proposed agent permission controls, and security industry deals and funding.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering vulnerabilities and patches, a reported breach, certificate-key weaknesses, unauthorized access, security product updates, and industry deals.
- Impact
- PHP flaws CVE-2026-109618 and CVE-2026-109619 can allow unauthenticated remote code execution, and a Node.js Brotli flaw, CVE-2026-111497, can allow remote code execution. OpenCode said API provider keys belonging to 1.4% of its hosted Console users may have been exposed; users reported unauthorized AI charges. Weak eMudhra signing keys could enable forged certificates accepted by vulnerable software, though malicious exploitation was unconfirmed. Attackers used a compromised ConnectWise application credential to access customer Microsoft 365 tenants. BeyondTrust’s Remote Support compromise involved zero-day CVE-2026-102764, persistence, and log deletion; automated triage had closed alerts before a later threat hunt found the compromise.
CVE
CVE-2026-102764triage closed the alerts as false positives. ARMORY CASTLE had exploited Remote Support zero-day CVE-2026-102764, established persistence, and deleted logs. A later threat hunt uncovered the compromise.CVE-2026-109618PHP has patched two critical CVSS v4.0 9.2 flaws, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. Fixed versions: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP provides patch andCVE-2026-109619PHP has patched two critical CVSS v4.0 9.2 flaws, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. Fixed versions: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP provides patch andCVE-2026-111497Node.js released security updates for versions 22, 24 and 26, including CVE-2026-111497, an out-of-bounds write in its bundled Brotli decoder that can allow remote code execution. Node.js rates it High. Fixes are
People
Vendors
BeyondTrustBeyondTrust detected the attack, then automated triage dismissed itConnectWiseConnectWise credentials opened customer Microsoft 365 tenantseMudhra📜 Weak eMudhra signing keys: Recoverable keys could let forged website certificates pass software’s identity checks.Meta🗣️ Meta pauses Muse sharing: Researchers found 6,800+ share links through passive DNS, some exposing sensitive information.Node.js🩹 Node.js patches a code-execution flaw: High-severity Brotli bug fixed in Node.js 22.23.4, 24.22.1 and 26.12.1.OpenCode🔑 OpenCode’s Console breach: API keys potentially exposed for 1.4% of Console users; unauthorized charges reported.PHP🐘 PHP patches critical flaws: Fixes are live for two CVSS 9.2 flaws that can allow unauthenticated code execution.Proofpoint🤝 Proofpoint’s deal for Varonis: Thoma Bravo-backed buyer agrees to a $6.3B acquisition.Varonis🤝 Proofpoint’s deal for Varonis: Thoma Bravo-backed buyer agrees to a $6.3B acquisition.
Products
BeyondTrust Remote Supportplatform’s automated triage closed the alerts as false positives. ARMORY CASTLE had exploited Remote Support zero-day CVE-2026-102764, established persistence, and deleted logs. A later threat hunt uncoveredMicrosoft 365 Apps for EnterpriseConnectWise credentials opened customer Microsoft 365 tenantsMuse🗣️ Meta pauses Muse sharing: Researchers found 6,800+ share links through passive DNS, some exposing sensitive information.OpenCode ConsoleOpenCode Console breached, users report unauthorized AI charges