AVL Code
All cases
#025 · Emergency Response

Case study · Emergency Response

Critical Vulnerability Breaks: a Full Emergency-Response Package in 2.5 Hours

You are a security manager at a large organisation, reading a push notification at midnight that PHP and Node.js disclosed unauthenticated RCE on the same day — and nobody can produce a list of which versions the organisation actually runs. One hand-over instruction later you hold six types of files: a one-pager plus one diagram for management, an operations SOP you can search offline, and a Python detection script that finds the affected versions by itself.

PHP: two 9.2 unauthenticated RCE · Node.js: 10 flaws· Linux + Windows script· No supply-chain inventory needed· Landi N2.6-Preview· 6 deliverable types · 09:56 → 11:54

View session Download session archive Import into your AVL Code workspace to replay the full conversation View report Download deliverable bundle All 8 deliverables in one archive (PDF / PNG / HTML / PY)

Session replays & reports are original records in Simplified Chinese · Built with AVL Code + the Landi model

Overview

  1. 01

    Hand over three jobs — one instruction names every deliverable and its reader

    You state the event link and three requirements in one go: a one-pager plus one diagram for management, a searchable HTML SOP for frontline operations, and a Python detection script that needs no supply-chain inventory — closing with “plan first, then check with me before you start”.

  2. 02

    Approve three constraints — PDF with visuals, two platforms, no certificate incident

    You reply in three lines: the one-pager in PDF and not plain text, the script covering Linux and Windows, the certificate incident left out — and then stay out of the way until delivery.

Task for AVL Code

我是某单位的网络安全管理者，需要针对刚刚https://mp.weixin.qq.com/s/xie0TOiTlte-H77AdDcdtA  发生的PHP及node.js重大漏洞这一事件进行应急响应。我需要完成三件事情。第一向单位管理者（非网络安全专业）简洁易懂、清晰明了的同步事件的危害程度、紧迫程度以争取在内部发起重大应急响应的支持，以单独的一页纸+单独的一张图方式；第二需要输出针对事件的面向一线运维人员提供专业严谨、经验证的应急响应操作说明sop，以指导开展修补工作，以html页面方式（要求页面中具备搜索和索引功能）；第三需要输出一个配套的检测检查工具，以支撑运维人员在不了解系统软件供应链组成的情况下发现存在的受影响版本，支撑运维人员修复漏洞后的复核工作，要求以python脚本方式。以上先做规划，找我确认后再动手。

Prerequisites: Network access to the source article and to php.net / nodejs.org; Python 3 plus a working HTML→PDF toolchain locally (weasyprint 69.0 + Noto CJK in this session) and PyMuPDF; the detection script runs on the target host itself, Linux or Windows

Reproduction materials at the end of this article Try it yourself ↓

Separating Rumour from Fact

The article is read. The first job is not writing anything — it is deciding which numbers may be printed on the page management will read. You hand over the link:

You type → AVL Code 
需要针对刚刚https://mp.weixin.qq.com/s/xie0TOiTlte-H77AdDcdtA  发生的PHP及node.js重大漏洞这一事件进行应急响应
AVL Code runs → you see
Fetches the source article “安全大逃杀：https 证书、PHP、Node.js 三连爆” → reads it end to end
→ Flags what no vendor has confirmed: “70% of sites run PHP”, “back to PHP 5.4”, “60 million certificates”, “Cloudflare saw exploitation 66 hours before the patch”
→ Goes to primary sources: the php.net/security advisory, php.net/archive/2026.php, the nodejs.org October security release
→ Pins down the usable fields: CVE-2026-109618 / 109619 (CVSS v4.0 9.2 unauthenticated RCE), fixed in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, affecting PHP-FPM / mod_php / php-cgi / FrankenPHP / LiteSpeed
→ Node.js side: 10 flaws fixed (highest HIGH), CVE-2026-111497 (Brotli out-of-bounds write → RCE), fixed in v22.23.4 / v24.22.1 / v26.12.1
→ Writes 05 fact-verification checklist, the single source of truth for all three deliverables

Every line in the checklist carries a vendor source; unconfirmed figures go into a separate “unconfirmed” list and never reach external material. All three deliverables later share this one file — one place to fix, and every document is right.

Plan Approved Before Any Work

With the facts settled it does not start writing — it lays the plan out first: the structure and acceptance criteria of each deliverable, plus five questions only you can answer. Your reply is three lines.

You type → AVL Code 
1、一页纸用pdf格式，且不要纯文字
2、脚本平台范围覆盖linux和windows
3、不纳入证书事件
AVL Code runs → you see
Plan mode: a plan before any work → the fact table separates “confirmed” from “unconfirmed”
→ Each deliverable gets a structure and acceptance criteria: six-part one-pager, SOP split by run mode and distribution, script built as “discover → judge → verify”
→ Five open questions raised: format, script platform scope, whether the certificate incident counts, the organisation’s environment, language
→ You answer in three lines → PDF with visuals / Linux + Windows / certificate as background only
→ Three hard constraints fixed along the way: single self-contained file, zero external dependencies, exit code usable by automation

One confirmation removes every later rework: format, platform and scope are written into the plan, so every sub-agent downstream works from the same constraints instead of its own guess.

The Page for Non-Technical Readers

The first deliverable is not read by anyone who knows a CVE number — its reader has three minutes to decide how bad this is and whether to act now.

You type → AVL Code 
第一向单位管理者（非网络安全专业）简洁易懂、清晰明了的同步事件的危害程度、紧迫程度以争取在内部发起重大应急响应的支持，以单独的一页纸+单独的一张图方式
AVL Code runs → you see
Probes the environment: weasyprint 69.0 + pango/cairo + Noto CJK all present → takes the HTML→PDF→PNG path
→ Builds the infographic first: A4 single-page HTML (alert bar + verdict box + three fact cards + timeline + two-column advice)
→ Content overflows to 2 pages → rewrites tighter → single page 1323×1871px at 160dpi, text-block coordinates confirm no overflow or overlap
→ Then the one-pager: single page but 67mm of empty space at the bottom → adds an event timeline to fill the layout
→ That pushes it to page 2 (min-height:78mm too large) → tightens spacing and font sizes, re-renders
→ Single page holds: content reaches 291mm, 4mm gap above the footer

“One page” is not judged by eye: every version goes back through the PDF to measure text-block coordinates — bottom whitespace, where the last line lands, the gap to the footer, all numbers you can report.

Two Sub-Agents in Parallel

The remaining two deliverables do not depend on each other, so both are dispatched at once, each finishing inside its own isolated context.

You type → AVL Code 
第二需要输出针对事件的面向一线运维人员提供专业严谨、经验证的应急响应操作说明sop，以指导开展修补工作，以html页面方式（要求页面中具备搜索和索引功能）；第三需要输出一个配套的检测检查工具，以支撑运维人员在不了解系统软件供应链组成的情况下发现存在的受影响版本，支撑运维人员修复漏洞后的复核工作，要求以python脚本方式。
AVL Code runs → you see
Two sub-agents start at the same time (isolated contexts, no cross-contamination)
→ SOP: single file, 980 lines, 47,631 bytes, inline CSS/JS, live search on top + left-hand TOC anchors; sections by run mode (FPM / mod_php / php-cgi / FrankenPHP / LiteSpeed) and by distribution, each step as prerequisite → command → expected result → rollback
→ Script: single file, 1,148 lines, 46,730 bytes, standard library only, read-only by default, --dry-run prints the commands it would run
→ Script corrects two false-positive sources: the dpkg node* pattern matched 378 node-* library packages → narrowed to runtime packages; npm / pm2 -v reports the tool version → now locates node in the same directory and probes that
→ SOP self-check: html.parser finds 0 unclosed tags, external http(s) resources are only the 3 advisory links in the appendix
→ Live scan on the host: 4 affected (Node.js 20.19.4 ×2, 24.14.0, 26.11.1), exit code 1

Every threshold comes from the fact checklist: PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12, Node 22.23.4 / 24.22.1 / 26.12.1; anything outside the table is reported as “unknown” rather than guessed.

Another Agent to Find the Mistakes

All three deliverables exist. The words “professional and verified” in the instruction become the acceptance bar — and it does not sign off on itself, it spins up an assessment agent in a separate context.

You type → AVL Code 
面向一线运维人员提供专业严谨、经验证的应急响应操作说明sop
AVL Code runs → you see
Assessment sub-agent reviews independently → actually fetches the php.net / nodejs.org advisories and compares line by line
→ Runs all three deliverables: PyMuPDF on the PDFs, the script through --help / --dry-run / a default scan / --baseline, parses the SOP’s JS and self-containment
→ Verdict: 0 blockers, but 3 SOP rows disagree with the advisories — CVE-2026-106070 / 106071 should be 26.x only, CVE-2026-106072 is missing 22.x
→ Flags that the one-pager generalises “no credentials needed” to Node.js, and that “exploit method is circulating publicly” goes beyond the source facts
→ Point fixes: SOP gets 3 release lines corrected, a mitigation row added and a TOC anchor fixed; one-pager and infographic reworded then re-rendered; the script splits baseline comparison into “new/regression” and “probe degraded”
→ The script-fixing sub-agent dies on a gateway 504 mid-way → the main agent takes over the logic and repairs a 4-space indentation error it introduced itself
→ Re-verified: PDFs single page with no overflow, new wording present and old wording gone in the PDF text, all three compare_baseline branches pass unit tests

Review is not a signature: the verdict reads “0 blockers, 3 disagreements”, each with a line number and the advisory text behind it; then the same checks are run again after the fix.

Try it yourself

Download the .zsession and import it into your workspace to replay the whole run, or paste the instructions below in order (swap the link for the advisory you are handling):

View session Download session archive Import into your AVL Code workspace to replay the full conversation View report Download deliverable bundle All 8 deliverables in one archive (PDF / PNG / HTML / PY)
› I am the security manager of an organisation and need to respond to the PHP and Node.js critical vulnerabilities just disclosed in <advisory link>. Three things: (1) a plain-language one-pager plus a separate single diagram for non-technical management, to win support for a major incident response; (2) a professional, verified HTML SOP for frontline operations, with search and an index; (3) a companion Python script that finds affected versions without knowing the software supply chain, and supports post-fix verification. Plan first, check with me before you start.
› The one-pager in PDF, and not plain text
› The script has to cover both Linux and Windows
› Leave the certificate incident out
  • Step 1: replace <advisory link> with the advisory you actually hold; adjust each deliverable’s reader and medium to your own situation.
  • Step 2: the three constraints are a replaceable set — Word or PPT instead of PDF, Linux only, or the certificate incident called out separately, all go into these three lines.
  • Step 3: to get PDFs out of the one-pager and the diagram, let it probe the local HTML→PDF toolchain first (weasyprint 69.0 + Noto CJK here), then render along whatever path is available.
  • Step 4: verify against the acceptance bar — one-page PDF with no overflow, SOP opens offline with search and contents, script exit codes as expected.

Next question: The script can already inventory what is installed — how do you wire it into the image build pipeline so an unpatched PHP / Node.js is blocked before it ships?