Node.js has just released fixes for 10 security vulnerabilities that could put node-powered applications at risk and is urging everyone to update their systems.
The sky is falling… Except it isn’t. Standard nonsense self advertising. And yes, vulnerabilities exist and canleasd to badness. We agree. It has always been so.
Well, I mean, the AI advances have moved the mean time to exploit between a zero day being announced, and it actively being exploited en masse, from about 3 weeks in 2018, to about -1 day in 2026. So, things have changed a bit.
Well, they’re called “zero days” for a reason.
To be fair, this is literally the only thing AI is being sold as useful for that actually works.
Yeah, so here’s the thing. People keep trying to bash on PHP as if anything software isn’t manmade and comes baked with flaws that can be exploited. It’s the single reason why cybersecurity products are never going to stop being used because no matter what, it’s based on something somebody made.
It’s going to be flawed or be exploitable by some means. Yesterday it was Log4J, now it’s PHP, tomorrow it will be something else. It will never end. Companies deliberately also use this to force you to upgrade because they’ve abandoned “legacy” products that still work but which they no longer choose to maintain because they want more money and need to stifle you for it somehow.
Day before yesterday it was Struts 2
rihht? opencloud posted a really tacky “nextcloud is dealing with this. checkout open cloud. written in go.”
dude… do we need to drop a link to the golang cves? they had a critical bug this year.
ruby? critical regex rce this week.
nodejs? same.
php made the news because of the embargo break making it go viral and everyone loving to hate on php. But people in glass houses should be careful throwing stones.
How’s Rust holding these days I wonder? Always wished I had learned it when it first came out ha.
Rust itself doesnt get mant CVEs and its been quiet so thats nice.
its worth noting its a bit different than languages I listed and lower-level. Those languages are also runtimes that provide a large set of features that run with your code.
That means while you could write websites in Rust, reall it is what you might consider writing PHP in if you started in 2026 not an alternative. Its more closely like MUSL(did get a recent big security release 🙄) or glibc.
apparently i was wrong… https://github.com/rust-lang/rust/issues/164250
haven’t watched it yet but apparently this is a good explanation https://www.youtube.com/watch?v=4iAi5exNHv8
Super interesting ty!
Imagine working in IT security. How bad a time are you having right now? Are we expecting things to become better or worse the next few months?
Honestly let it burn.
I am… well sorta. My team has to deal with the cleanup and repercussions at least. Let’s just say this week was not fun. At all.
In addition to the eMudhra certs and the php issue, there were also issues with python, Oracle, Java, and node.js. The certs and php were definitely the highest profile. They shut down incoming traffic to university web servers for the php one. The certs would have been more of a problem if we had extremely short expiration times
When you’ve been at battle stations for 12 years it just feels like another week.
Open a ticket and add it to the list.
While the world reels from websites being taken down before critical PHP patches were released
Is it just me or did anyone else not even notice outside of articles lol… It was all resolved by the time I got off work.
some sites in my region that people use went down temporarily, but i never used them.
It’s not resolved until everyone installs the patch. And there in lies the problem.
An important point yes and I do understand that, but the major players like Steam were updated and done before I knew it. I have no doubt this could come back to bite companies/people lagging behind over the next few years, but the impact to me from websites being taken down was 0, which was my point.
The companies with well-resourced dev teams would have been able to deal with it. But for every one of those there’s 50 companies with no dev team who are sending frantic emails to the guy who quit 3 years ago asking if he’s available for some urgent work. And another 50 that are not sending any emails because they’re oblivious and will get pwned in a few months.
A lot of PHP apps are old, unmaintained or run by people with no idea. That’s kinda it’s niche.
Yeah but this wasn’t an exploit in PHP applications, this was an exploit in PHP.
Our resolution was to unzip a new directory and change the path to PHP in Apache conf
Not entirely accurate. I happen to be my company’s 1 man IT army, and I got it all plugged within 4 hours (php2shell, CA certificates, which I only had to rotate, etc). It was bad, but the noise was even worse. If IT departments are proactive and do their jobs, the actual problems should be little to none.
Then I did the same in my proxmox, everything is just fine.
The only site I knew was affected was the next cloud homepage which I checked for updates if they already had a patched version for there docker containers. So I thought it quite funny that the site I visited to see if they had fixed it was also affected.
I mean I’ll update my Node version, but until someone actually finds an exploit chain on a real system (instead of a vibecoded PoC) I don’t see any reason to panic. All these "could"s and "would"s in the article suggest that it’s kind of a nothing-burger imo
I’ll bet this is another “AI found a known vulnerability so people are making a big deal about it” like the PHP one.
I’m with you on the first part but I believe that 2/4 PHP exploits have been observed in the wild.
Uhm. There’s a release called Node2Shell, linked in the article.
Who cares if it’s vibecoded? The exploit is the exploit.
Pure sensationalism. We should celebrate new tools helping us to make oir software safer … but, nah, the end is nigh … start digging, and buy non-perishables, bullets, and lube
If it’s really a PoC, it would actually execute and therefore exploit something (otherwise it wouldn’t be a proof). In which case it doesn’t matter if it’s vibecoded or not. If you succeed in breaching a system with it, there’s an issue that needs to be fixed.
That’s exactly the thing. They call themselves PoCs, but most of the time the exploit chain that they “prove” relies on some extremely unrealistic condition, like the intruder already having elevated privileges. Or it’s just completely made up and the PoC only “works” because the AI changed the source code. It’s incredibly unreliable.
I see. Yeah then it’s crap.
I think you’re speaking in general and not about this specific case. This is an unauthenticated remote code exploit. All that needs to happen is your website accepts a brotli from a client or from an external api and tries to read it.
This is a bad one. Broke my no deploys on Friday rule for it.
How many apocalyptic security flaws can fit into a week?
I never noticed how long the sales guy’s hand is
“This bad boy can hold so many limes”
yes
INB4 Pheonix devs
What about Lua? https://hachyderm.io/@ell1e/117480515499692140 I think e.g. nginx and OpenDKIM have Lua scripting integrations.
Depends on how you handle the OOM error though, aborting the process is fine while “try to recover and continue” is the problem.
No. Put the Genie back in the bottle. We need air traffic control for this shit. Or we just have to shut down all the PHP and NodeJs servers. (This is sarcasm…mostly.)
as an aside, i think the title is too sensationalist? click-baity?
A direct quote from the article:
Node.js flaws follow the PHP scare. Is this the end of the web?
So yeah, click-baity. The structure of the article was awkward too with lots of repetition, which makes me suspect at least some LLM use.
the technique of repetitions there didn’t do the expected subject emphasis for me.
now that you mention it, influence of llms could be what it is.
I run a la. Not even a full lamp. Its just a slack box with base apache html.
For years i’ve been mocked. But that bitch has never been compromised and it’s damned near impossible. Who’s laughing now.
What does it do? Serve pictures of cats?
mostly your mum
every time the sun rises, shines and sets; a million new node vulnerabilities are discovered
be careful, obviously, but don’t let it turn your entire nervous system into pure crystallized cortisol
you can deal with it on Monday
It is kinda funny to hear the manager say “Brotli” as if it were some cursed ancient artefact tho. I’m down to not tell the managers that this is overblown bs. Let them think that we saved the system from certain doom.
If only it were that easy, if you do that, the managers will be grateful certainly, but they will also endlessly demand more proof and validation that the system is now completely safe from certain doom until they feel comfortable, which is never. In a lot of cases it’s simply easier to convince them that the system was never vulnerable to certain doom in the first place, because you were of course already 5 steps ahead of this even in the planning stages, and for some reason they have an easier time accepting that, as long as they still have every reason to believe you are a brilliant tech god who would never personally fall victim to such a common vulnerability. I suppose it’s really less about the reality of the situation and more about what kind of corporate image you are cultivating and maintaining for yourself.
These vulnerabilities are only news stories because developers don’t develop strategies to patch their products rapidly enough.
Node has literally always been like this. It’s just a risk you accept when you choose to use it.
Yeah back then update and patch can go after month because problem found in months too or year, now because automated tools called LLM exist, those who find problem or even make on and exposing vulnerability can do it in minutes, it is inevitable.
What.
