Security Advisories
Atlas Security is the byline for the company's security disclosures. Each advisory starts from the vendor's own advisory, release notes, and commits, separates what the vendor said from what we inferred, and ends with commands you can run against your own fleet. When a record changes — a CVSS score, a distro fix, a public exploit — we update the post and say so.
PHP fixed two critical (CVSS 9.2) unauthenticated RCEs in 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Proofs of concept are circulating: patch every PHP server now.
Find every runtime exposed to CVE-2026-111497, a High-severity Node.js Brotli bug fixed in 22.23.4, 24.22.1, and 26.12.1 — and never on end-of-life lines.
