[PHP 비상] 이번엔 Node.js…연이은 대형 취약점에 웹서버 보안 `빨간불` - 디지털데일리

[PHP 비상] 이번엔 Node.js…연이은 대형 취약점에 웹서버 보안 `빨간불` - 디지털데일리

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page kr/news/m-ddaily/page-view-2026102611404279049, snapshot 20261026T144241Z. Copied byte for byte; every file's sha256 is in captures/20261026T144241Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

Digital Daily (Korean), 26 October, by Kim Bo-min: 'PHP emergency: now Node.js', a second runtime flaw a week later. It says Theori announced a Node.js vulnerability, 'Node2Shell' (CVE-2026-111497), a Brotli decoder out-of-bounds write that can cause denial of service, memory disclosure or remote code execution, fixed in Node.js 22.23.4, 24.22.1 and 26.12.1; this is a separate flaw from PHP2Shell, which TTMChange's report summarises (CVSS 9.2, mod_php the most exposed, code back to PHP 5.4). It gives a sequence of events: Amazon's honeypot saw an attempt on 17 October, details leaked on 20 October, Cloudflare applied emergency firewall rules and PHP published its advisory on 21 October, watchTowr and SOCRadar then reported exploit tools used in real environments, and on 24 October Palo Alto Networks warned its devices were affected. It also says the cyber-security firm Cyfirma found Korean-speaking members of a closed I2P network simulating attacks on the PHP flaws, aimed at government bodies, banks and other sectors in many countries, and raised the possibility of a link to the Lazarus group ecosystem with 'moderate' confidence.

> 사이버보안 기업 사이퍼마에 따르면, 익명성이 보장되는 폐쇄형 네트워크인 I2P 내부에서 한국어를 사용하는 특정 조직원들이 PHP 취약점을 악용한 사이버 공격을 모의한 것으로 나타났다.

_Curator's translation:_ "According to the cyber-security firm Cyfirma, certain Korean-speaking members inside I2P, a closed network that guarantees anonymity, were found to have simulated cyber attacks exploiting the PHP vulnerabilities."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "[PHP 비상] 이번엔 Node.js…연이은 대형 취약점에 웹서버 보안 빨간불 - 디지털데일리". Selected mechanically, not read by a person.

Capture notes

Language ko. Nothing in the page addresses an AI or hides text from a reader.