Microsoft and others scramble to patch Node.js flaw which could be the next PHP-level issue

An RCE flaw was found in Brotli, a Google-built open-source data compression algorithm.
YAHOO!

Microsoft and others scramble to patch 'HTTP2Shell' flaw which could be the next PHP-level issue — Node.js problem may also affect millions of sites

Multiple tech companies and projects have recently pushed patches for a vulnerability called "HTTP2Shell" which could enable remote code execution (RCE) attacks, similar to the recent "PHP2Shell" ...
The Hacker News

Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions

Node.js fixes 10 flaws, including a Brotli decoder bug that may allow code execution when apps decompress attacker-controlled ...