We have applied important security updates to the technologies behind our website and supporting services. The fixes covered in this announcement have been installed on our server since the morning of Friday, 23 October.
π‘οΈ What did these fixes address?
Recently disclosed vulnerabilities affected technologies used by many websites. On unpatched systems, some could allow an attacker to interfere with a server without signing in. Others involved weaknesses in checking secure connections or processing incoming data.
These issues matter because protecting a community website also means protecting the systems that handle account access and keep its services available.
π Vulnerabilities ranked by severity
The PHP vulnerabilities commonly called PHP2Shell have two separate CVE identifiers. A CVE is a public reference for a specific vulnerability, making its verified advisory easy to find.
| Severity | Name and CVE | Possible impact |
|---|---|---|
| π΄ Critical β 9.2/10 (CVSS 4.0) | PHP2Shell β RCE via OOM corruption CVE-2026-109618 | Unauthorized code execution after memory-handling failure. |
| π΄ Critical β 9.2/10 (CVSS 4.0) | PHP2Shell β RCE via stale global state CVE-2026-109619 | Unauthorized code execution through stale internal state. |
| π High | Node.js β Brotli decoder out-of-bounds write CVE-2026-111497 | Crash, data exposure or unauthorized code. |
| π High | Node.js β DNS name truncation CVE-2026-105482 | Wrong destination accepted. |
| π High | Node.js β TLS hostname verification bypass CVE-2026-106069 | Untrusted connection accepted. |
| π‘ Medium | Node.js β HTTP keep-alive response confusion CVE-2026-105481 | Unexpected response accepted. |
| π‘ Medium | Node.js β Non-canonical IPv4 certificate validation CVE-2026-106072 | Mismatched certificate accepted. |
| π‘ Medium | Node.js β Predictable random values in startup snapshots CVE-2026-106074 | Predictable identifiers. |
| π΅ Low | Node.js β Permission Model bypass with fs.realpathSync CVE-2026-106073 | Path information outside allowed scope. |
The order follows the severity assigned by the maintainers. PHP also provides a CVSS 4.0 score; for Node.js we retain its High, Medium and Low categories. These are not identical numerical scores for every entry. Actual impact depends on how the technology is used; this list does not mean the vulnerabilities were exploited here.
Sources: first PHP advisory, second PHP advisory and Node.js security bulletin.
β What have we done?
We updated the affected components and checked the server afterwards. The web service is running, its configuration passes validation, and the system reports no outstanding service restarts needed to activate installed updates.
We also checked for signs that the vulnerabilities had been exploited. The checks performed found no signs of an attack or any compromise of player data.
The fixes are in place on our side. You do not need to install anything or change your game settings to benefit from them.
π What does this mean for players?
This update strengthens the foundations behind the website and account services. Its purpose is to reduce opportunities for unauthorized interference and help keep our services dependable.
Some improvements are immediately visible; others happen behind the scenes. Both matter when building a place where you can return to your account and enjoy your time in Azeroth.
Thank you for being part of our community. See you in Azeroth!
Drahy