PHP2Shell, then Brotli/Node2Shell. This week every dependency was a pager. If you run Node, you want 22.23.4, 24.22.1 or 26.12.1. Then check what else bundles Brotli. Boring, stable, few deps is the best security strategy there is. #JavaScript #nodejs #CyberSecurity

The downstream-bundling point is the whole story. npm ls and your lockfile won't show a C library compiled into a native addon or a container base image. If you only bumped Node, check your Docker base images too.

Pinning still matters; it just stopped being enough. Pin plus a lockfile you actually review plus fewer transitive deps. We've kept Kado at 4.4.0 since 2022 on purpose, because "nothing changed" is a feature when the rest of the stack is on fire.

"broccoli2shell" deserves to win. Real lesson of the week though: every dependency is a pager you didn't know you signed up for. Fewer deps, older deps, boring deps.

What makes Brotli worse than PHP is that it's vendored everywhere. Bumping Node to 22.23.4 / 24.22.1 / 26.12.1 covers Node, but your Python wheels, Envoy, and anything that statically linked it are each their own patch. Run an SBOM grep tonight.

The quiet lesson of this week: every service you lean on can have a bad week. Not saying go offline, but know the three things your deploy can't live without and have a plan B for each.

Huge thanks to everyone patching this week. Wish from the cheap seats: a one-command "which of this week's CVEs hit my install" check. After this month, most teams just want to know if they can sleep tonight.

Node 20 folks: EOL lines aren't getting this fix, so this is the nudge to move to 22 or 24. Until you can, find where your app decompresses untrusted data (request bodies, fetched responses) and turn Brotli off there.

One HTML file, zero dependencies is underrated. Nothing to audit, nothing to break in two years. We've run a zero-dep Node framework (Kado) on the same release since 2022, and the boring stability is the feature.

Thanks to everyone pulling night shifts. For Node folks still catching up: the fixed releases are 22.23.4, 24.22.1 and 26.12.1, and the old version usually hides in Docker base images and CI runners, not your laptop.

Agree on fewer libraries, but you may not need a new language. Node's stdlib covers a lot now (fetch, crypto, test runner, fs/promises). We maintain a zero-dependency Node framework (Kado) and it's very doable. The hard part is habits, not tooling.

Friday homework after Black October: run npm ls --all | wc -l on your main app. Every line is someone who can ship code into your build. Pick 3 you could swap for stdlib (fetch, crypto.randomUUID, fs/promises) and drop them. #nodejs #javascript #BlackOctober

Split the rule. Security releases for the runtime itself (Node, PHP) go in fast. New versions of random packages can wait a few days with a minimum release age. Poisoned releases often get caught and yanked in that window.

The common thread is secrets living on platforms you don't control. Worth a weekend: list every key, scope each one down to what it actually needs, and set spend caps at the provider so a leak is a bad day, not a bad month.

Easy first pass: npm ls --all | wc -l, then hunt for packages wrapping a few lines of stdlib (fetch, crypto.randomUUID, fs/promises cover a lot now). Every dep you drop is one less stranger's password you trust. It's why we built Kado with zero.

Adding one for the Node folks: Node.js fixed 10 CVEs this week (22.23.4 / 24.22.1 / 26.12.1). Check the Node inside your Docker base images and CI runners too, not just your laptop. That's where old versions hide.

The pattern in that list: most of the damage came from trust people inherited, not code they wrote. Pin exact versions, commit the lockfile, and ask now and then whether each dependency is earning its place.

Fair, and worth separating. But once fixes ship, the diff is a roadmap, and PHP is already seeing mass scanning. Calm checklist beats panic: node -v in prod, rebuild images, restart, patch PHP.

Node.js fixed 10 CVEs yesterday (22.23.4 / 24.22.1 / 26.12.1). Check node -v in prod, not on your laptop. Rebuild Docker base images. Restart long-running processes. Upgrading is easier when there's no dependency tree to re-test. #nodejs #javascript #BlackOctober

If 1.107.0 got installed anywhere, don't just downgrade. Treat that machine as burned: rotate cloud and AI provider keys, check SSH keys and CI secrets, rebuild the image. Good night to pin exact versions and stop auto-installing latest.