Security
CVE tracker
Every CVE we have a check-and-fix guide for, newest first. Each row has the affected stack, the fixed version, and a free, no-signup check in the guide.
| CVE | Affected stack | Fixed version | Published | Check & fix |
|---|---|---|---|---|
| CVE-2026-97229 | Upgraded GitLab and still vulnerable? The Ruby patch behind CVE-2026-97229GitLab / Ruby (Onigmo) | Ruby 3.3.13, 3.4.12, 4.0.9 | ||
| CVE-2026-111497 | Node2Shell in Python: the Brotli bug (CVE-2026-111497) in requests, aiohttp, pyarrow and PillowPython (brotli, pyarrow, Pillow) | brotli 1.2.1 | ||
| CVE-2026-111497 | Node2Shell beyond Node.js: Brotli CVE-2026-111497 in Go, Java, .NET, PHP, Ruby, Linux and proxiesGo, Java, .NET, PHP, Ruby, proxies, Linux | Brotli 1.2.1 (per platform) | ||
| CVE-2026-111497 | Node2Shell: Node.js Brotli decoder vulnerability (CVE-2026-111497), check and patchNode.js (Brotli) | Node 26.12.1, 24.22.1, 22.23.4 | ||
| CVE-2026-96889 | Next.js CVE-2026-96889 security vulnerability: check and patch (October 2026)Next.js (image optimizer / sharp) | Next 16.4.1, 15.5.28; sharp 0.35.5 | ||
| CVE-2026-109618, CVE-2026-109619 | PHP2Shell (CVE-2026-109618, CVE-2026-109619): check and patch your PHPPHP | PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
Also useful: the October 2026 security roundup lists every fixed version in one place, and security patching covers having the fixes done for you.
Want these patched for you?
Run the free check in each guide to see what you are exposed to, then hand the fixes to me — most CVE patches ship same week.
See the gigs