Node.js Security Releases, WordPress Upgrade RCE Under Attack, Next.js Cache Leaks: Developer News for November 9, 2026

Submitted by jaypabs on Monday, November 9, 2026 - 11:35.

A new week starts with a busy calendar: a Node.js security release on Wednesday, the .NET 11 launch on Tuesday, and a WordPress bug that attackers are already hammering. Here is a plain-English roundup for Monday, November 9, 2026, focused on what PHP, JavaScript and web developers should actually do this week. Every item links to the original announcement so you can check the details yourself.

Dates and numbers below come from the linked sources. Where a company describes its own tests or counts, that is labeled as its claim.

1. Node.js Security Releases Are Coming on November 11

The Node.js project announced that new versions of the 26.x, 24.x and 22.x release lines will ship on or shortly after Wednesday, November 11, 2026. The highest severity issue in each line is rated High. As usual with these advance notices, there are no CVE numbers or details yet; those come with the release.

The project also repeats an important rule: end-of-life versions are always affected when a security release happens, and they do not get fixes. If you are still on Node.js 20 or an odd-numbered line, this is your reminder to plan an upgrade.

What to do: check which Node.js version your servers, Docker images and CI runners use (node -v). If you have not installed the October fixes yet (22.23.4, 24.22.1 or 26.12.1), do that now instead of waiting. Then block some time on Wednesday or Thursday to install the new builds. Remember that npm update only updates packages; it does not replace the Node.js runtime itself, and running processes need a restart.

2. Attackers Are Probing the WordPress Upgrade-Window RCE (CVE-2026-119977)

On October 28, WordPress released 7.1.4 plus security releases for older branches back to 4.7. One of the fixes, CVE-2026-119977, is a race condition in core updates: during a full-package upgrade, WordPress unpacks a copy of the new version, including the installer, into a predictable folder under /wp-content/upgrade/. An unauthenticated attacker who reaches that installer during the short upgrade window can end up running code on the server.

Wordfence says attackers started targeting the bug on the day it was disclosed and that its firewall had blocked over 240,000 exploit attempts, with a peak of more than 74,000 on October 30 (Wordfence's own numbers). CISA added the CVE to its Known Exploited Vulnerabilities catalog on November 3. Wordfence also points out that it is hard to win this race in practice, and that the blocked requests do not mean many sites were actually taken over.

There is one awkward detail: the update that installs the fix still runs the old upgrade code one last time. What to do: make sure every WordPress site you manage, including old client sites and capstone demos, is on 7.1.4 or the patched release for its branch. Before updating, block web access to PHP files in /wp-content/upgrade/ at the web server or CDN, as Wordfence recommends, then update as soon as possible rather than postponing.

3. Next.js 16.4.5 and 15.5.29 Fix Cache Leaks Between Tenants and Users

Vercel published the Next.js November 2026 security release with fixes in v16.4.5 (Active LTS) and v15.5.29 (Maintenance LTS). The most serious issue, rated High (GHSA-mfr8-8qww-v76h), affects apps with Cache Components enabled: when the same public use cache function is called both directly and inside unstable_cache, a cold cache fill can hand one tenant's cached result to another.

The other six advisories are rated Medium. They include more use cache mix-ups (nested cache functions and binary arguments that produce the same cache key), shell cache poisoning in self-hosted next start apps, an internal x-middleware-set-cookie header that can expose HttpOnly cookie values on Edge routes, and an SVG check bypass in image optimization.

What to do: run npm install [email protected] or npm install [email protected], depending on your line, then redeploy. If you build multi-tenant apps (one codebase, many schools or shops), read the cache advisories closely.

4. Hijacked npm Packages Hid a Loader That Reads Its Server from Ethereum

Sonatype Research Labs reported on November 4 that 12 releases across 10 hijacked npm packages contained a hidden loader. Affected names include cdeops 13.5.31, server-hemera-mongo 0.0.15 and 0.0.16, and several packages under @adminide-stack, @cdmbase and @pubngo-stack. Sonatype links the code to an earlier campaign called PolinRider.

Two details make this one worth understanding. First, the loader looks up its payload server's address inside Ethereum transactions sent from a fixed wallet, so the attacker can switch servers without publishing a new package. Second, there was no install or postinstall script. The code runs when your app loads the package, so npm install --ignore-scripts would not have stopped it.

What to do: search your package-lock.json, yarn.lock or pnpm-lock.yaml for the package names in Sonatype's table. If an affected version ever ran on a laptop, CI runner or server, Sonatype says to treat that machine as compromised and rotate any credentials it could reach, such as npm tokens, GitHub tokens and cloud keys.

5. Chrome 157 Makes HTML-in-Canvas Stable

After an origin trial, Chrome 157 ships the HTML-in-Canvas API as a stable feature. It lets a page draw real, live DOM elements into 2D, WebGL and WebGPU canvases. According to the Chrome team, that HTML keeps working like normal HTML: text can be selected, forms still work, screen readers can read it, and Find-in-Page and translation still apply. You opt in by adding content="drawable" to the canvas and a drawable attribute to each element you want to draw.

This is good news for games, charts, 3D product viewers and image editors that used to rebuild text and buttons by hand. It is still Chrome-only, so the Chrome team's own guide recommends feature detection and a fallback for other browsers.

6. .NET Conf 2026 Starts Tomorrow with the .NET 11 Launch

Microsoft's .NET Conf 2026 runs November 10 to 13 as a free virtual event, and it is the official launch of .NET 11. The opening keynote with Scott Hanselman starts on November 10 at 8 AM PST, which is 12:00 AM on November 11, Philippine time. The first two days are Microsoft sessions, including what's new in C#, ASP.NET Core and Blazor, .NET MAUI and Aspire. November 12 and 13 are Community Days run by volunteers.

If you are a student using C# or ASP.NET for your capstone, the "What's new in C#" and ASP.NET Core sessions are the ones to watch. Sessions are usually available on demand afterward, so you do not have to stay up past midnight.

7. MariaDB Enterprise Platform 2027 Is Out

On November 4, MariaDB plc made MariaDB Enterprise Platform 2027 generally available, along with a new brand identity. The bundle includes MariaDB Enterprise Server 12.3, MariaDB Exa for analytics, MariaDB GridGain, MaxScale, Enterprise Manager and a Kubernetes operator. New AI-focused features include Agent Memory and a Semantic Cache, and an AI Retrieval service that turns natural-language questions into read-only SQL is due in public preview on MariaDB Cloud later this month.

MariaDB claims 56% higher peak throughput than its last major release, based on a benchmark it sponsored, and up to 30% more vector search queries per second. For most students and small projects, nothing changes: this is the paid enterprise line, and the free community MariaDB you install with XAMPP or your Linux distribution keeps its own release schedule.

Your Checklist for This Week

Node.js: install the October fixes now, then the new builds after November 11. Move off end-of-life versions.
WordPress: block /wp-content/upgrade/, then update every site to 7.1.4 or its branch's fixed release.
Next.js: upgrade to 16.4.5 or 15.5.29 and redeploy.
npm: check lockfiles for the hijacked packages; rotate credentials if any of them ran.
C# developers: catch the .NET 11 launch sessions live or on demand.

Search