[
  {
    "id": "node-2026-10",
    "runtime": "node",
    "date": "2026-10-21",
    "severity": "HIGH",
    "cves": [
      "CVE-2026-111497"
    ],
    "fixed": {
      "22": "22.23.4",
      "24": "24.22.1",
      "26": "26.12.1"
    },
    "summary": "A flaw in Brotli decompression can crash an app, expose memory, or allow remote code execution when it decompresses data from an attacker.",
    "source": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"
  },
  {
    "id": "php-2026-10",
    "runtime": "php",
    "date": "2026-10-21",
    "severity": "CRITICAL",
    "cves": [
      "CVE-2026-109618",
      "CVE-2026-109619"
    ],
    "fixed": {
      "8.2": "8.2.35",
      "8.3": "8.3.36",
      "8.4": "8.4.27",
      "8.5": "8.5.12"
    },
    "summary": "Two flaws can allow unauthenticated remote code execution on PHP that serves web requests.",
    "source": "https://news-web.php.net/php.announce/512"
  }
]