Taiwanese Cybersecurity Agency Urges Update of PHP, Node.js, and Go

The Taiwanese cybersecurity agency has urged government institutions and enterprises to immediately install updates for PHP, Node.js, and Go, citing potential vulnerabilities that could allow attackers to execute code remotely or intercept digital certificates. The agency reports that two vulnerabilities in PHP, rated 9.2 out of 10 on the CVSS v4.0 scoring system, could allow unauthenticated remote code execution. PHP is widely used for websites, content management systems, and management interfaces, including WordPress, Drupal, Joomla, and Magento.

Node.js has released three updates after fixing 10 vulnerabilities, four of which are classified as high-risk. The main issue involves the Brotli decoder, which could lead to memory corruption and remote code execution if it writes data outside the allocated memory range. The updates also fix ways to bypass TLS certificate validation and permission models, as well as DNS resolution errors.

Go has released two updates after a certificate authority in India was compromised, resulting in the exposure of eight known private keys. The agency warns that attackers could use these keys to launch ‘man-in-the-middle’ attacks. The new Go versions add affected intermediate certificates to a blocklist, requiring developers to recompile and redeploy their applications after updating the Go toolchain.