AI, Vulnerabilities, and the Headaches of Dependency Upgrades - October 2026

Published on November 7, 2026 by Caitlin Ridge-Sykes in

Welcome to Hot Web Dev October 2026, featuring the latest in web development. October's security edition is written by my daughter Caitlin and features what has been a crazy month in vulnerabilities and exploits. The tool of the month was found by accident and rivals all the best note-taking apps out there. More importantly it's cross platform and open source.

Table of contents:

Dependency Upgrades
Vulnerabilites and Risk Management
Pros and Cons of AI
cUrl closes their bug bounties
Features were removed from PostgreSQL 19
Recomps, Decomps, and All the Bits in Between
WOW Tool of the Month

Dependency Upgrades

I'm a fairly young software developer, in the grand scheme of things. Though I've been programming since I was decently young- often piggy backing off watching Mum develop; I only professionally became a developer when I graduated university with my degree in 2024, becoming a full stack engineer.

I joined my current place of work in the middle of a giant migration of a legacy application from Java 8 to Java 17. Which also involved upgrading several versions of the Spring Framework and Spring Boot framework, amongst other things. Keeping software up to date is a never ending battle; and can often not be as simple as incrementing a number and watching it go smoothly.

I'd say in my just over two years of experience, which isn't a lot, I have spent most of it on dependency management. Upgrading versions to the next major versions, swearing at Java just not quite working correctly. And honestly, any developer I have talked to seems to dislike this kind of thing, the act of upgrading the versions in your pom (in the case of Java), deploying, checking if something broke, checking if they suddenly removed that super important function you'd been using...

I digress. But I might be in the minority of people when I say I quite like fixing the dependencies in things. Whether its different versions of Hibernate clashing with each other, or its seeing what new changes Spring Boot introduced in version 4; I find it a rather endearing and interesting process.

Additionally, whilst in the midst of all that vulnerability upgrades, I also have grown my career alongside the incorporation of AI; which in my opinion, is a mixed bag. If you were to ask me my opinion- well, luckily for you, I got to dictate what goes in this WOW post, and you get a whole section dedicated to that, down below.

Vulnerabilites and Risk Management

In the tech world this month, there have been two decently major CVEs. CVEs themselves come up all the time, and are generally ranked betwee low, medium, and high. And on a scale from 1-10, with 10 generally containing some kind of RCE (remote code execution). The two this week are in the Linux kernel, and also in PHP, which a good chunk of the internet runs on. It is generally good practice to keep your software up to date, but as with everything, its not as easy as just updating a number in a pom file (sorry I'm a Java dev, did I forget to mention that?) or package.json. Some updates can involve major restructuring of your code, and even introduce new vulnerabilties themselves. It's a never ending uphill battle.

Photo by Sam Beebe/Ecotrust from WikiMedia Commons

With larger codebases, especially those that are enterprise, it can take months of effort to move to the latest version, especially if it is across a language version- such as Java 17 to 21. But sometimes, as with these CVEs, they provide a patch for your existing version, and it takes very little effort to apply, but is a neccessary evil in order to prevent bad actors from getting access to something they shouldn't.

Vghost

VGhost was one of the many vulnerabilities that came up, affecting many Linux distributions, and causing many people to have to patch their servers. The vulnerability persisted across years of kernal versions, and what it did was allow virtual machines to access the host system if specific conditions were met. It enabled untrustworthy users to make their accounts more privileged, and access things they should not be able to, leading to major security flaws.

Tencent used AI to find this vulnerability, and seem to have had a high rate of success with it. From my understanding, Corvus AI (which is what they call it) is a group of coding agents that work together in a strict pipeline, in order to assist in finding and resolving vulnerabilities before bad actors can take advantage of them.

I've linked below to some posts explaining this vulnerability a lot better then I can, given I mostly work in applying the fixes to mitigate these kinds of things, and not so much exploring and explaining them.

PHP2Shell

PHP2Shell is technically two CVEs which affected PHP versions to 5.4–8.5. According to the BBC, 70% of the internet uses PHP in some capacity. [1] So when two major CVEs that allow for the possibility for remote code execution come out, the internet was in a bit of a whirlwind for a day, whilst websites were temporarily put into maintenence to patch the issue. If you were on the internet at all the day the CVE came out, you likely experienced some form of outage.

Essentially, what the issue was, was that when PHP hits an out of memory state, it is supposed to abort handling of whatever it was trying to do. In some contexts, the memory associated with the request can be accessed before its instantiated, and if the memory allocation fails, PHP forgets about the fact that it was supposed to abort handling the request, and corrupts the memory. What follows after in PHP processes can then read this invalid memory, which can then lead to remote code execution.

As with a lot of things in the developing world, AI was used to assist in finding the issue. AI use, and its existance, is a very heated and devled into topic that I'm not going to dig into here. In this case, AI was used as an assistive tool, and is disclaimed as much on Wiz Research's blog post:

Wiz Research used Wiz Atlas, Gemini 4 Argon and GPT-5.6-Sol during discovery, exploit development and patch validation. Frontier models helped work through complex exploit chains and adapt them across different deployments. Gemini 4 made a particularly significant contribution to exploit development and patch validation.

Source

Supporting:

Node2Shell

With PHP and Linux having their time to shine in regards to vulnerabilities, Node decided to join the club with a 9.2 rated CVE. Granted, this wasn't Node itself, just a dependency which they use called Brotli, make by Google. It's used for compressing things, the most common example being compressing content before being sent over network traffic. This vulnerability within Brotli allowed for the potential for a remote code execution, which meant that servers running NodeJS were at risk.

This affected every version of node ever released, and for those of us running servers with Node, was quite a scary one, as if it was exploited, it could lead to outcomes such as allowing a user to access sensitive information, crash your server, so on and so forth. Not exactly something you want.

This vulnerability doesn't just affect Node however, the package is used within various projects- so its always worth checking, esepcially if you use Python (as an example) or Istio (as another example). Luckily, in this case, it was remidied by updating your Node version, but serves as a reminder to us all to keep our software up to date, to make these sorts of mitigations easier. By leaving yourself on legacy and deprecated versions, you open yourself up to allowing these vulnerabiltiies to be taken advantage of, and make resolving them much harder.

A vulnerability has been discovered in the Brotli library that could allow for remote code execution. Brotli is a compression algorithm developed by Google and commonly used to compress web content before it is sent over HTTP. Successful exploitation could allow an unauthenticated remote attacker to trigger memory corruption, disclose sensitive information, crash affected processes, or potentially achieve remote code execution (RCE). Web servers and applications that decompress Brotli data from untrusted sources, such as those running Node.js, may be affected.

Pros and Cons of AI

Like I just mentioned, AI is a controversial top in the tech industry right now. Love it or hate it, it's very much enveloped in development as a whole. If you were to ask my opinion, I've described it as being a bit like a hammer; it is only as useful as the person behind it.

In the right hands, AI is an useful assistive tool. But where things can go wrong is where people use AI to make programs, without any kind of knowledge of how the code generated works. I'm sure if you have spent any time on the internet, you will have seen the memes of people accidentally nuking production databases because the AI ran wild without any kind of safeguards. By not understanding how the code works, you are opening yourself up to a risk of technical debt, less ability to debug, and more security risks. If you blindly click "accept" on whatever the AI gives you, you might be introducing a serious problem into your code. AI's knowledge can also be outdated, such as if you ask it for the latest version of a dependency, it will give you a version that is not current.

But AI is also good at getting a lot of code done fast. It can automate the tasks that developers don't like doing, can find things develops maybe can't, and is very good at collating a lot of information. Let's look at some examples of AI usage within the past year, the positive and negative sides.

cUrl closes their bug bounties (January 2026)

Earlier this year, cUrl, the command line tool for transfering data to and from servers, closed their bug bounty system. Bug bounties are basically where developers of a project offer a paid incentive for users to responsibly disclose and report vulnerabilities before they can be exploited.

One of the main reasons cited for the closure of this systenm, was the influx of AI reports regarding vulnerabilties. Due to the fact that many of these reports were submitted in bad faith and were often not exploitable at all, researchers were spending a lot of time investigating these issues when their time could have been better spent doing something else.

The other reasons cited were due to the fact that even the reports that weren't blatantly AI had degraded in quality, and the reports weren't made because they wanted to improve cURL, but because of the money incentive. They were just interested in the money, or improving curl, and were trying "too hard to twist whatever they find into something horribly bad and a critical vulnerability"[1]

[1] The end of the curl bug-bounty

Features were removed from PostgreSQL 19 (October 2026)

As the title implies, many features were removed from the PostgresSQL 19 release branch, after it entered its beta period. There were many reasons- or rather, suspected- reasons that this had happened, but there are two key points I'd like to highlight

They did not think it was due to "vibe-coding"
With LLM-assisted code review, bugs get found faster

In this case, AI was an assistive tool, with humans still taking the lead with development. These bugs were saved from being discovered in release, and resulted in a more secure product overall, and given that many people use PostgreSQL as their database of choice in production, even small problems could lead to potential vulnerabiltiies like the ones we discussed earlier.

It is not a bad thing to revert code that was not working properly, or had flaws in it. Nor is it a bad thing that AI found these before human developers could. It was good that these bugs were found, regardless of the source. It's just another reminder that it isn't as easy as AI bad or AI good, it's a bit more nuanced then that.

The reverts will continue until morale improves

Recomps, Decomps, and All the Bits in Between

A bit of a change in topic from the above, but AI has proven beneficial in the decompilation and recompilation scene. A decompilation, for those unawares, is where you take something; like a game, in the instances I am about to talk about, for example Pokemon Blue. You take this compiled code and work backwards to try and make code that you and I can read. Instead of all the computer code that it uses to be. This is often done with the goal of making the game run on hardware it wasn't intended for, such as on PC, and in some cases, make the software run faster, or fix years of game bugs.

The most famous example of this would be the Ship of Harkinian, which is a port of the original Legend of Zelda: Ocarina of Time for the Nintendo64,which only came into existance because of the decompilation of the game of the same name.

A recompilation is where you take the gane binaries, and write basically a conversion layer to allow them to run on something like PC natively, without the need for an emulator. So they are very similar, but with different outcomes really.

With AI, the scene has suddenly come into life with an enthusiasm that didn't really exist before. This is for good and bad. On one hand, this is allowing for many more games to get more decompiled and recompiled, and allowing newer generations of gamers to become acquainted with games from years gone by. However, there is now a vast quantity of these ports, of varying quality, some are good, some are bad. Some have been uploaded and support forgotten about; some were done just because they could.

I don't really know how to feel about it. On one hand, one of my all time favourite games Fable 2 which only came out on the Xbox360, is in the process of being recompiled. This would allow me to play it with hopefully a better experience then using an emulator, since I don't stay at home any more and don't have an Xbox to play on. But on the other hand, there is an inherent level of risk, that I am downloading something I don't understand the code for, won't get support on, and in a worst case scenario, could do serious damage to my laptop. Ship of Harkinian

WOW Tool of the Month

October's tool of the month is a cross-platform note taking app built on modern technologies. HelixNotes is an open-source note-taking app designed to combine a clean, intuitive UI with the privacy of local Markdown files. Its key features include using local storage to store notes as plain .md files on your filesystem, with notebooks organized as folders.

There is no proprietary cloud or account required. You can sync your notes using your preferred method (Nextcloud, Syncthing, Dropbox, etc.) or via optional WebDAV support. It is built with Rust and Tauri and offers a small native desktop footprint without the resource usage of Electron apps.

It's rich editor features a WYSIWYG markdown experience powered by TipTap, including a formatting toolbar and slash commands. Fast Search: Uses Tantivy, a Rust-native full-text search engine, to keep searches quick as your vault grows. Cross-Platform: Available for Linux, Windows, macOS, Android, and iOS.

Author

Cait graduated from the University of Dundee, Scotland and now works as a Software Developer. In her spare time, she likes reading, writing, gaming and various crafts.

Explore Cait's Talents on Linkedin