In our daily work, we regularly encounter technical problems, security issues and unexpected software behaviour that might be interesting to others.

We've decided to occasionally share some of these experiences here. Nothing too formal — just things we've investigated, lessons we've learned and technical details we think are worth sharing.

For our first article, let's look at several serious security vulnerabilities that appeared in October 2026.

One week, several critical vulnerabilities

Between October 15 and 23, several widely used software projects released patches for critical vulnerabilities.

PHP: serious enough to shut down government websites

Two PHP vulnerabilities, collectively nicknamed PHP2Shell, could allow attackers to execute code remotely without authentication.

The issues involve memory corruption and incorrect handling of global state. Fixes arrived on October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

The potential impact was serious enough that Finland's government ICT provider, Valtori, temporarily restricted access to several public services as a precaution. Similar measures were reported in other European countries.

There was no confirmed breach behind the Finnish shutdowns — authorities simply chose not to take the risk.

Rapid7 analysis · Yle

GitLab: vulnerabilities hiding in twelve-year-old code

Four GitLab vulnerabilities originated in Onigmo, the regular-expression engine used by Ruby.

The bugs involve memory management errors and integer overflows. Under certain conditions, specially crafted input can trigger remote code execution.

Two vulnerabilities received the maximum CVSS score of 10.0 and were reported to require no authentication.

Perhaps the most surprising detail is that the affected code reportedly dates back to GitLab 7.0, released in 2014.

An initial fix also turned out to be incomplete, requiring another round of patches in October.

Ruby released corrections on October 23, followed by updated GitLab packages.

The Hacker News · Technical analysis

Node.js: a decompression bug with serious consequences

CVE-2026-111497, nicknamed Node2Shell, affects the Brotli decompressor bundled with Node.js.

A malformed compressed stream could cause an out-of-bounds memory write, potentially leading to remote code execution.

Since Brotli is widely used for HTTP compression, applications processing untrusted compressed content could be exposed.

The issue was fixed in Node.js 22.23.4, 24.22.1 and 26.12.1.

Node.js security advisory

Symfony: a few spaces can exhaust your CPU

CVE-2026-108082 is a regular-expression denial-of-service vulnerability in Symfony's HttpFoundation component.

A specially crafted HTTP header containing long sequences of whitespace can trigger excessive regex backtracking, consuming significant CPU time.

Repeated requests could make an application unavailable without requiring authentication.

The vulnerability received a CVSS score of 8.7 and was fixed in Symfony 5.4.54, 6.4.46, 7.4.19 and 8.1.7.

CVE details

A few thoughts

What caught our attention wasn't just the severity of these vulnerabilities, but how ordinary their underlying causes were: memory handling, input parsing, regular expressions and decompression routines.

Some of these bugs had apparently survived years of development and countless software releases.

It's also worth remembering that updating application code isn't enough when the vulnerability lives somewhere deeper in the dependency chain.

So, what are we going to do about it?

Looking at this whole mess, we came to a rather simple conclusion: manually keeping track of every new vulnerability and checking whether it affects our software isn't a particularly sustainable approach.

So we've decided to build ourselves a robot.

The idea is to have it continuously monitor vulnerability databases and security advisories, identify newly disclosed issues that might be relevant to our technology stack, then automatically deploy our code into isolated sandbox containers with the appropriate dependencies and configurations.

From there, it would run security scans and tests against those environments, looking for potential vulnerabilities — continuously, rather than only when someone remembers to check.

Of course, automated scanning won't catch everything. But we'd much rather have a robot checking things tirelessly than rely entirely on manual reviews and occasional security audits.

That's the plan, anyway. We'll share more as the project develops.

Want something similar for your own software? We can build one for you too. Get in touch.

Based on publicly available security advisories and technical reports as of October 24, 2026.