Trust Center

Summary

On October 21, 2026, CVE-2026-111497 was publicly disclosed when the Node.js project published its security releases. This is vulnerability in the Brotli decompression library used by Node.js and other software. A remote, unauthenticated attacker may be able to submit specially crafted compressed data to trigger memory corruption, cause a denial of service, disclose sensitive memory, or potentially execute arbitrary code.

Our Exposure

Our review identified uses of this library requiring assessment and remediation. We identified applicable versions and deployment configurations, with priority given to systems that could be accessed from the internet. Where affected systems are identified, the responsible teams are implementing the recommended security updates. Exposure assessments and remediation status will continue to be validated as work progresses. As information becomes releasable, Dotmatics will do so here.

Dotmatics recommends subscribing to our Trust Center to receive up to the moment notifications of updates to security-related communications.

Remediation and Compensating Controls

• Patching: Affected installations are being prioritized for security updates to supported fixed releases, or vendor-supported
  remedies where applicable.
• Interim controls: Installing a supported fix is the primary remediation. Where immediate updates are not feasible,
  applicable interim protections may include restricting unnecessary functionality, enforcing appropriate request and
  memory limits, and limiting network access.
• Detection and threat hunting: Security Operations continues to review relevant security telemetry and indicators
  associated with these vulnerabilities. The assessment has not identified evidence establishing compromise related to these
  vulnerabilities in the information reviewed to date. Monitoring and investigation will continue as appropriate, and any
  confirmed security incident would be managed through established incident response procedures.
• Edge and scope: The review includes Brotli and Node.jse components embedded in applications, containers, and third-party
  technologies, in addition to directly managed services. Teams are validating that updates are applied and protective
  controls remain in place where required. Where remediation could affect availability, measures are coordinated to protect
  both service continuity and security.

Customer Guidance

No customer action is required at this time with respect to our products that incorporated the affected Node.js components.

Supporting Information

• Node.js project: official advisory: Node.js Brotli decoder out-of-bounds write permits remote code execution

An April 2025 script error at Certificate Authority eMudhra generated eight catastrophically weak intermediate CA private keys with values as low as 4, allowing attackers to easily forge HTTPS website security certificates. Discovered by researchers in October 2026, the flaw triggered an immediate global response as major web browsers blocked the compromised infrastructure. Consequently, eMudhra's board voted to permanently exit the global SSL/TLS business, while downstream software platforms issued CVEs to hardcode blocks against the weak keys.

Associated CVEs include: CVE-2026-111943, CVE-2026-114406, and CVE-2026-91403

Regarding the October 2026 notification, Dotmatics has performed a review of implemented software across the organization and can confirm that we do not have certificates from this provider in our infrastructure and are not impacted by this vulnerability.

Summary

On October 21, 2026, the PHP project released security updates addressing two critical vulnerabilities in PHP core (CVSS v4.0 9.2 each). Under certain conditions, these vulnerabilities may permit unauthenticated remote code execution in web-serving PHP environments, including where application-level code is current. We initiated a prioritized review of potentially affected systems and are coordinating remediation with responsible technical teams. Available industry reporting indicates exploitation, underscoring the importance of timely updates. Our response emphasizes verified remediation, appropriate protective measures, and continued security monitoring.

Statistics

• 9.2 / 9.2: CVSS v4.0 Base for CVE-2026-109618 CVE-2026-109619 as rated by PHP
• Reported: Exploitation attempts reported by multiple vendors; As of October 22, 2026, neither vulnerability has been identified in publicly available reporting as listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
• Prioritized: Updates and risk reduction for affected systems

Our Exposure

Our review identified PHP installations requiring assessment and remediation. We identified applicable versions and deployment configurations, with priority given to systems that could be accessed from the internet. Where affected systems are identified, the responsible teams are implementing the recommended security updates. Exposure assessments and remediation status will continue to be validated as work progresses. Each customer will be contacted if their product is impacted and will send final communications next week.

The Vulnerabilities

CVE-2026-109618 relates to out-of-memory handling, while CVE-2026-109619 relates to stale internal state across requests. The PHP project identifies web-serving configurations, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, as potentially affected. Fixed PHP releases include 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older unsupported branches require migration or an appropriately supported vendor fix. The applicability of each vulnerability depends on the PHP version and deployment configuration.

Remediation and Compensating Controls

• Patching: Affected installations are being prioritized for security updates to supported fixed releases, or vendor-supported remedies where applicable.
• Interim controls: Installing a supported fix is the primary remediation. Where immediate updates are not feasible, applicable interim protections may include restricting unnecessary functionality, enforcing appropriate request and memory limits, and limiting network access.
• Detection and threat hunting: Security Operations continues to review relevant security telemetry and indicators associated with these vulnerabilities. The assessment has not identified evidence establishing compromise related to these vulnerabilities in the information reviewed to date. Monitoring and investigation will continue as appropriate, and any confirmed security incident would be managed through established incident response procedures.
• Edge and scope: The review includes PHP runtime components embedded in applications, containers, and third-party technologies, in addition to directly managed services. Teams are validating that updates are applied and protective controls remain in place where required. Where remediation could affect availability, measures are coordinated to protect both service continuity and security.

Supporting Information

• PHP project: official advisory: PHP security advisory; GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.
• Government guidance: advisories from CERT-EU 2026-018, the Canadian Centre for Cyber Security AL26-026 and the UK NCSC urge immediate patching.
• Industry threat intelligence: exposure data and response guidance from the Unit 42 threat brief, the Google Cloud and Wiz response and Recorded Future analysis.

Dotmatics' statement on recently disclosed PHP vulnerabilities in CVE-2026-109618 and CVE-2026-109619 can be found here.

Date: 5 December 2025

Dotmatics is providing this update to inform our customers of our investigation and response to two notable and recently disclosed vulnerabilities in the JavaScript ecosystem: CVE-2025-55182 and CVE-2025-66478.

1. CVE-2025-55182 React Server Components

On 3 December 2025 at approximately 4:12 PM ET, we became aware of a publicly disclosed vulnerability affecting certain React server-side packages (CVE-2025-55182). Reference materials are available here:

https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

https://nvd.nist.gov/vuln/detail/CVE-2025-55182

Immediately upon becoming aware of this disclosure, we initiated an internal review to evaluate whether any products within our application portfolio incorporate the affected React server-side components.

This review was completed at approximately 6:21 PM ET on 3 December 2025. Based on that assessment, no products within our portfolio were found to use the React server-side components associated with CVE-2025-55182.

2. CVE-2025-66478 Next.js (downstream impact)

At approximately 10:51 PM ET on 3 December 2025, we became aware of CVE-2025-66478 which is a downstream vulnerability impacting Next.js due to its dependency on the components associated with CVE-2025-55182. Reference materials are available here:

https://nextjs.org/blog/CVE-2025-66478

https://nvd.nist.gov/vuln/detail/CVE-2025-66478

Immediately upon becoming aware of this disclosure, we initiated an internal review to evaluate whether any products within our application portfolio incorporate the affected Next.js components.

During our review, we identified that two products in our application portfolio: Luma and Sigma components, used affected Next.js versions.

Remediation

Upon identification of these affected components, we immediately initiated our standard vulnerability response procedures, including patch application, internal testing, quality verification, and deployment. All remediation activities were completed by 4 December 2025.

Our monitoring to date has not identified any indicators of abnormal, anomalous, or unauthorized activity associated with these vulnerabilities in the context of our products or environments.

We note that vulnerabilities of this nature may evolve as additional security research becomes available. Accordingly, we will continue to monitor for updates and will take further action as necessary.

3. Customer Guidance

No customer action is required at this time with respect to our products that incorporated the affected Next.js components. If new information becomes available that changes required customer actions or materially impacts risk, we will issue updated communication.

For questions or additional information, please contact your account representative.

There have been many first hand and media reports regarding a high risk, high impact vulnerability in MOVEit file transfer software leading to compromise and ransomware attacks across multiple industries. A recent update from CISA can be found here: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a

Dotmatics has done a review of implemented software across the organisation and can confirm that we do not run this software, and are not impacted by this vulnerability.