{
  "version": "2026.10.23-1",
  "generated_at": "2026-10-23T23:37:00Z",
  "rules": [
    {
      "id": "LA-2026-001",
      "cve": "CVE-2026-109618",
      "cve_alias": "PHP2Shell",
      "target": "php",
      "severity": "CRITICAL",
      "cvss": 9.2,
      "description": "PHP Core OOM Memory Corruption via multipart/form-data parsing",
      "safe_versions": {
        "8.5": "8.5.12",
        "8.4": "8.4.27",
        "8.3": "8.3.36",
        "8.2": "8.2.35"
      },
      "mitigation": {
        "action": "block_multipart_or_disable_upload",
        "php_ini": {
          "file_uploads": "Off",
          "session.upload_progress.enabled": "0",
          "upload_max_filesize": "0"
        }
      }
    },
    {
      "id": "LA-2026-002",
      "cve": "CVE-2026-109619",
      "cve_alias": "PHP2Shell Worker Hijack",
      "target": "php-fpm",
      "severity": "CRITICAL",
      "cvss": 9.2,
      "description": "PHP Persistent Worker Stale Global Memory Reuse",
      "mitigation": {
        "action": "recycle_worker_state",
        "fpm_pool": {
          "pm.max_requests": "500"
        }
      }
    },
    {
      "id": "LA-2026-003",
      "cve": "CVE-2026-42945",
      "cve_alias": "NGINX Rift",
      "target": "nginx",
      "severity": "HIGH",
      "cvss": 8.1,
      "description": "ngx_http_rewrite_module URI Buffer Overflow and Worker Crash",
      "mitigation": {
        "action": "limit_request_uri",
        "nginx_snippet": "large_client_header_buffers 4 16k;"
      }
    },
    {
      "id": "LA-2026-004",
      "cve": "CVE-2026-111497",
      "cve_alias": "Node2Shell",
      "target": "node",
      "severity": "HIGH",
      "cvss": 8.6,
      "description": "Node.js Express / fetch() Brotli decompression buffer overflow",
      "mitigation": {
        "action": "sanitize_brotli_header",
        "nginx_snippet": "proxy_set_header Accept-Encoding \"gzip, deflate\";"
      }
    }
  ]
}