Around October 21, PHP, Node.js and Python released security fixes for several serious vulnerabilities. Some of the PHP and Node.js flaws allow remote code execution. Customers have asked whether NetCrunch is exposed, so here is where each one stands.
PHP: Not Affected
The PHP releases fix two unauthenticated remote code execution flaws (CVE-2026-109618 and CVE-2026-109619), widely reported as "PHP2Shell". Exploitation attempts were seen before the fixes were published.
NetCrunch does not use PHP. No part of the NetCrunch Server, the web console or the monitoring probes depends on it, so there is nothing to patch on the NetCrunch side.
Node.js: Update on the Way
The October Node.js security release fixes ten CVEs. The most serious is an out-of-bounds write in the Brotli decoder (CVE-2026-111497) that can lead to remote code execution. The fixed versions are 22.23.4, 24.22.1 and 26.12.1.
NetCrunch 16 ships its own Node.js runtime, version 24.18.0, which falls in the affected range. An update that brings the runtime to the patched 24.22.1 is on the way and will be available through the regular NetCrunch update channel.
Python: Update on the Way, Low Risk
The October CPython security releases fix several issues in the standard library. NetCrunch uses Python only for certain sensors, such as WBEM. That code is pre-compiled and runs on a full Python installation that ships with NetCrunch and is kept separate from any Python installed on the server.
Python in NetCrunch is not a general-purpose scripting environment and does not process input from untrusted sources. We do not expect NetCrunch users to be affected. The updated Python runtime will be included in the same upcoming update.
Python or Node.js installed separately on the NetCrunch server, for your own scripts or other applications, is not managed by NetCrunch. Update those installations through their usual channels.
What You Should Do
No immediate action is required for NetCrunch itself. Install the next NetCrunch update when it becomes available. As usual, keep the operating system and any other software on the NetCrunch server up to date.
