October 21 Security Roundup: PHP2Shell's Backstory, Java, HTTP/3, Node, Railway and OVH
How PHP2Shell went from a 2024 audit finding to an emergency patch, how to apply the fix correctly (PHP-FPM, Debian changelogs, EOL branches), plus Java CVE-2026-91403, the HTTP/3 QPACK flaw, Node.js security releases, the Railway environment variable incident and the OVHcloud CLI supply-chain attack.
10 min read · #security #php #java #nodejs #cve
