10月21日 PHP 、 Node.js 、 Go語言 開發團隊不約而同發布資安更新，修補一系列資安漏洞，成為IT界與資安界的焦點，這樣的態勢也引起政府機關提出警告，呼籲所有企業組織立刻採取行動，修補相關弱點。

PHP2Shell 漏洞昨晚讓多國政府機關與大型服務緊急預防性下線，同時間還爆發 Node.js 與 eMudhra 憑證問題。本文整理一般讀者這幾週瀏覽網站時，該提防哪些事？ （前情提要：OpenAI GPT‑5.6 Sol 揪出 PHP 重大漏洞！影響約七成網站、砸 10 億美元補貼防守端） 先說結論：手機和電腦不必另外裝任何東西，但接下來幾週上網，要多提防釣魚信、假的更新畫面和不熟的網店結帳 ...

Node.js 26.x, 24.x and 22.x get High-rated fixes on or shortly after November 11; CVE details stay private until release.

Node.js is an open-source, cross-platform JavaScript runtime environment. For information on using Node.js, see the Node.js website. The Node.js project uses an open governance model. The OpenJS ...

Do you have any servers or tools running on Node.js? A security update has been released for Node.js versions 22, 24, and 26, ...

In October 2026, a critical vulnerability related to Node.js became a hot topic under the names "HTTP2Shell" and "Node2Shell".The identification number is "CVE-2026-111497".In short, the issue lies in ...

Node.js 於台北時間 10 月 21 日發布安全更新，現行分支 26.x、24.x、22.x 分別升級至 26.12.1、24.22.1、22.23.4，一次修復 10 項漏洞（4 高、3 中、3 低），最高嚴重度為 HIGH。

An RCE flaw was found in Brotli, a Google-built open-source data compression algorithm.

New releases for Node.js 22.x, 24.x and 26.x fix high-severity vulnerabilities and protect against compromised eMudhra certificates.

Node2Shell exploits a high-severity memory flaw in Node.js’s Brotli decoder to execute attacker-controlled code.