TL;DR

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

PHP released fixes for two critical, unauthenticated remote code execution flaws known as PHP2Shell on Oct. 21, 2026. Node.js issued fixes for 10 vulnerabilities the same day. Administrators need to check whether their systems are running fixed builds; the supplied source does not include Node.js version details or a complete account of exposure.

PHP released fixes on Oct. 21 for two critical remote code execution flaws known as PHP2Shell, while Node.js published fixes for 10 vulnerabilities. The releases matter to organizations running websites and back-end services because protection depends on deploying fixed code and confirming that it is handling requests.

The PHP security advisories identify the flaws as CVE-2026-109618 and CVE-2026-109619. Both are rated Critical, with a CVSS v4.0 score of 9.2. According to the advisories, an attacker does not need privileges or user interaction to exploit them. Successful exploitation could allow code to run with the permissions of the PHP web worker account, which may have access to website files, configuration and database credentials.

The PHP project published fixed releases for four supported branches: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The source material says PHP 8.6.0 RC4 is for testing, not production. PHP 8.1 and older do not receive regular project updates; minimal source backports were published for some older branches, but administrators who do not build PHP themselves should check their distribution or long-term support vendor for packages containing both fixes. PHP 8.2 is scheduled to reach end of life on Dec. 31, 2026.

The advisories describe exposure across PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The supplied material says an unauthenticated exploit was demonstrated against Apache with mod_php. It also says the stale-state flaw was validated against mod_php and PHP-FPM; the absence of a complete demonstrated PHP-FPM exploit for the other flaw does not establish that configuration as safe. Node.js released fixes for 10 vulnerabilities across its supported release lines, but the source material does not name the affected versions or individual flaws.

Patching Must Reach Live Servers

A security release closes a vulnerability only on systems that actually run the fixed code. Sites can remain exposed if an update was downloaded but not applied, if an old worker continues serving requests, or if traffic reaches a different server that was missed during deployment. Operators need to verify the version and package in use across their infrastructure, including any separate staging, production or regional instances.

The PHP advisory’s description of an attack that can begin before application code runs matters for site owners: application-level checks may not stop a request from reaching the vulnerable runtime. The potential access is bounded by the web worker’s permissions, rather than automatically granting system administrator access, but those permissions can still expose sensitive files and credentials. Node.js operators also need to act on the release, though the provided source does not specify the vulnerabilities’ severity or impact.

For smaller organizations that rely on a hosting provider, responsibility may be divided. A provider may manage the runtime for one service while leaving customer-managed containers, virtual machines or applications for the customer to patch. Asking who controls each runtime and obtaining confirmation of the deployed package can help close gaps.

PHP Fixes and Branch Support

The PHP project’s Oct. 20 pre-announcement said that two critical vulnerabilities would be addressed the next day, with both rated 9.2 under CVSS v4.0. Its Oct. 21 advisory described one flaw involving out-of-memory corruption and another involving stale global state. The supplied material attributes these descriptions to the PHP and GitHub security advisories.

The affected mechanisms differ, but the stated result is remote code execution under the web worker’s account. PHP’s advisory lists several ways to serve web requests, so organizations should inventory the PHP runtime behind each site rather than assume that an application framework or a particular web server removes the risk.

PHP 8.2.35 is a fixed release, but the branch’s support is due to end on Dec. 31, 2026. The source also says users of the remirepo repository were advised that it would not have updates on release day and were directed to distribution packages or a source build. Package version strings can differ when vendors backport patches, so the source recommends checking package changelogs for both CVE identifiers.

“Two critical vulnerabilities, both rated CVSS v4.0 9.2”

— PHP security advisory

Deployment and Exposure Gaps

The source material does not establish how many PHP or Node.js systems remain unpatched, whether any of the flaws have been exploited in the wild, or whether the updates have reached particular hosting providers. It also gives no Node.js release numbers, vulnerability identifiers or severity ratings, limiting what operators can infer about which installations need which package.

For PHP-FPM, the supplied advisory summary says a complete exploit for the out-of-memory flaw had not been demonstrated, while the other flaw was validated against FPM. That distinction describes the evidence cited in the source; it does not confirm that all FPM deployments are protected from the first flaw. The source also mentions a separate Railway security incident but does not provide enough detail to establish its scope or connect it to either software release.

Verify Packages and Runtime Status

PHP administrators should install a fixed release or a vendor package containing both CVE fixes, then confirm that the updated runtime is the one serving requests. They should check every relevant server and deployment, review package changelogs when vendor version numbers differ from upstream releases, and account for PHP workers or services that may need restarting to load the new code.

Organizations using PHP 8.2 should also plan for the branch’s stated end-of-life date. Node.js operators should consult the project’s release information for the affected versions and install the applicable security release across supported lines. The supplied material does not identify a deadline or report a later status, so patch progress and any additional provider guidance remain to be confirmed.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used in the supplied source for two PHP remote code execution flaws: CVE-2026-109618 and CVE-2026-109619. PHP rated both Critical at 9.2 under CVSS v4.0.

Which PHP releases contain the fixes?

The listed fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For older versions, check with the distribution or long-term support vendor for a package containing both fixes.

Does PHP-FPM avoid the vulnerabilities?

The supplied material does not establish that PHP-FPM is safe. It says the stale-state flaw was validated against FPM and that a complete FPM exploit for the other flaw had not been demonstrated.

What did Node.js patch?

Node.js released fixes for 10 vulnerabilities across its supported release lines on Oct. 21, 2026. The source material does not list affected versions, identifiers or severity ratings.

How can an operator confirm a patch is in place?

Check the installed package or runtime on every relevant server and verify the package changelog includes both PHP CVE fixes where applicable. Confirm that the updated runtime is serving requests; version strings may differ for vendor backports.

Source: Thorsten Meyer AI