TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
PHP released fixes on Oct. 21 for two critical, unauthenticated remote code execution flaws known as PHP2Shell, while Node.js issued fixes for 10 vulnerabilities. The releases do not protect services until patched versions are installed and running; exposure and upgrade steps depend on each deployment.
PHP identified the flaws as CVE-2026-109618, involving out-of-memory corruption, and CVE-2026-109619, involving stale global state. The project’s advisory and the two GitHub advisories rate each flaw Critical, with a CVSS v4.0 score of 9.2. According to the advisories, an attacker needs neither an account nor user interaction. Successful code execution would run with the permissions of the web worker account; the advisories do not say that this automatically grants root access.
Fixed PHP releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.6.0 RC4 is a release candidate for testing, not a production fix recommendation. The project says PHP 8.1 and older no longer receive regular project updates, though it published minimal source backports for versions 7.4, 8.0 and 8.1. Operators using those versions should check with their distribution or long-term-support vendor for a patched package, build an appropriate backport, or upgrade to a supported branch.
PHP says the affected configurations include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The advisory describes a demonstrated unauthenticated attack against mod_php before application code runs. For the stale-state flaw, the GitHub advisory says exploitation was validated against mod_php and FPM. It says no complete FPM exploit has been demonstrated for the out-of-memory flaw; that leaves the issue unresolved for FPM and does not establish that FPM is immune. Separately, Node.js released fixes for 10 vulnerabilities across its supported release lines. The supplied source does not list the individual Node.js advisories or fixed version numbers.
Security update brief / 21 October 2026
PHP2Shell and Node.js Updates Land Together
A practical patch-and-restart plan for administrators: install the fix for the runtime serving live requests, restart or reload where needed, then confirm updated workers are handling traffic.
01 / PHP2Shell
Two flaws, critical severity
Both advisories describe exploitation without an account or user interaction. Successful execution runs with the permissions of the web worker account.
Out-of-memory corruption
Rated Critical at CVSS v4.0 9.2. The supplied advisory describes a demonstrated unauthenticated attack against mod_php before application code runs.
No complete FPM exploit demonstratedStale global state
Rated Critical at CVSS v4.0 9.2. The GitHub advisory says exploitation was validated against mod_php and FPM.
Unauthenticated / no interactionImpact boundary: code execution under the web worker account can expose files and credentials available to that account. The advisories do not say this automatically grants root access, and the supplied material does not establish that every affected installation has been attacked.
02 / Fixed PHP branches
Match the fix to the live runtime
Use the upstream release or a distribution package whose changelog confirms both CVE fixes. Package version strings may differ after backports.
| PHP branch | Fixed release | Operator note |
|---|---|---|
| PHP 8.5 | 8.5.12 | Install the patched release for the active deployment. |
| PHP 8.4 | 8.4.27 | Confirm the web-serving package or image is updated. |
| PHP 8.3 | 8.3.36 | Check package changelogs when using vendor backports. |
| PHP 8.2 | 8.2.35 | Plan branch migration before end of life on Dec. 31, 2026. |
| PHP 8.1 and older | Vendor or backport | Older branches no longer get regular project updates; consult your distribution or support vendor. |
Web configurations
PHP lists PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed among configurations serving web requests.
Older branches
Minimal source backports were published for 7.4, 8.0 and 8.1. Check vendor packages, build an appropriate backport, or upgrade.
PHP 8.6.0 RC4
This is a release candidate for testing, not the production fix recommendation.
03 / Node.js
Ten fixes across supported lines
Identify the active Node.js release line, then use its corresponding security release guidance.
Security updates published
Node.js released fixes for 10 vulnerabilities on Oct. 21, 2026, across its supported release lines.
Check the project advisory
The supplied source excerpt does not include individual advisories, CVE identifiers, severity ratings or fixed version numbers. Consult Node.js release guidance for your specific line.
04 / Operational sequence
Verify fixes across live services
A version seen in a shell may not match the runtime handling web traffic. Check each deployment path.
Find every service
List PHP and Node.js applications, containers, hosts and release lines across websites, back ends and internal tools.
Check the serving runtime
Inspect the package or image used by web servers and active PHP-FPM workers, not only the command-line version.
Apply the right update
Install the fixed release or a vendor package with both PHP CVEs addressed; apply Node.js guidance for its active line.
Restart and verify
Restart or reload as the deployment requires, then confirm updated workers and live traffic use the patched code.
Backport check: for distribution packages, review the changelog for CVE-2026-109618 and CVE-2026-109619 instead of relying on the upstream version number alone. Also review access to sensitive configuration while assessing exposure.
05 / Scope and certainty
What the supplied details do—and do not—show
Use the advisories to guide patching; do not infer incident scope from release timing alone.
PHP exposure depends on setup
The listed PHP web configurations are in scope. FPM exploitation was validated for the stale-state flaw.
FPM is not cleared
No complete FPM exploit was demonstrated for the out-of-memory flaw. That absence is not proof that FPM is immune.
No incident conclusion
The supplied material does not establish vulnerable server counts, active exploitation in the wild, or compromise of a specific organization.
Railway: the source mentions a separate incident but provides no details and says Railway has not linked it to PHP2Shell or the Node.js updates. Do not infer a connection.
06 / Quick answers
Questions administrators are asking
Which PHP versions include the fixes?
8.5.12, 8.4.27, 8.3.36 and 8.2.35. For vendor backports, check the changelog for both CVE identifiers.
Are PHP-FPM installations affected?
PHP-FPM is listed among configurations in scope. The stale-state flaw was validated against FPM; no complete FPM exploit was demonstrated for the out-of-memory flaw.
Do the PHP flaws require a login?
No. The advisories describe exploitation without privileges or user interaction. Code execution runs with web worker account permissions.
What did Node.js update?
Fixes for 10 vulnerabilities across supported release lines. The supplied source does not give individual advisories or fixed versions.
Patch the Runtime Serving Requests
A security release only reduces exposure when the fixed code is installed in the environment handling live traffic. PHP versions can differ between a command-line shell, a container image, a web server and the PHP-FPM workers serving a site, so checking one environment alone may miss an unpatched service. Administrators should verify the actual runtime and package source for each deployment.
The reported PHP impact matters to website owners because execution under the web worker account may expose files and credentials available to that account. The advisories describe remote code execution, but the supplied material does not establish that every affected installation has been attacked. Applying patches and reviewing access to sensitive configuration are practical steps while exposure is assessed.
Node.js operators also need to identify their active release line and apply its corresponding security update. The simultaneous release makes inventory important for organizations running both runtimes across websites, back-end services, AI applications or internal tools. The available source confirms the count of Node.js vulnerabilities fixed, but not their severity or individual impact.
As an affiliate, we earn on qualifying purchases.
Which PHP Branches Received Fixes
PHP announced the planned security release on Oct. 20, saying it would address two critical vulnerabilities and was scheduled for 14:00 UTC the next day. The project’s Oct. 21 advisory supplied the CVE identifiers and fixed release information. This article is a practical follow-up to the source’s earlier report about PHP2Shell and Dutch government websites; that prior report is not independently detailed in the material provided here.
PHP 8.2 is scheduled to reach end of life on Dec. 31, 2026, according to its release note, so organizations applying 8.2.35 should also plan a supported-version upgrade. The source says users of the volunteer-run remirepo repository were warned that updates would not be available there on release day and were directed toward distribution packages or building from source. Package version numbers may not match upstream releases when a distributor backports fixes; administrators should check package changelogs for both CVE identifiers.
““two critical vulnerabilities, both rated CVSS v4.0 9.2””
— PHP project, in its Oct. 20 pre-announcement
As an affiliate, we earn on qualifying purchases.
Exposure Depends on Deployment Details
The supplied material does not establish how many servers remain vulnerable, whether any particular organization has been compromised, or whether the two PHP flaws are being actively exploited in the wild. It also gives no complete exploit demonstration for the out-of-memory flaw on PHP-FPM, while explicitly describing that absence as a lack of demonstrated exploit rather than proof of safety.
Details for the 10 Node.js vulnerabilities—including CVE identifiers, severity ratings and fixed versions by release line—are not present in the source excerpt. The source also mentions a separate incident at hosting platform Railway, but provides no incident details and says Railway has not linked it to PHP2Shell or the Node.js updates. A connection should not be inferred.
web server restart and verification tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Verify Fixes Across Live Services
Administrators should identify every PHP and Node.js service they operate, determine the runtime version actually serving requests, and apply the fixed release or a vendor package containing the relevant fixes. For PHP packages with backported fixes, review the distribution changelog for CVE-2026-109618 and CVE-2026-109619 instead of relying on the upstream version number alone. Restart or reload affected services as required by their deployment, then check that running workers and traffic are using the updated code.
Teams on PHP 8.2 should include the Dec. 31 end-of-life date in their upgrade planning. Operators on older PHP branches should consult their distribution or support vendor and track the Node.js project’s release guidance for the relevant supported line. The source does not specify a single restart procedure or temporary mitigation applicable to every hosting setup.
As an affiliate, we earn on qualifying purchases.
Key Questions
Which PHP versions contain the PHP2Shell fixes?
The listed fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. A distribution package may use a different version string if it backported the fixes; check its changelog for both CVE identifiers.
Are PHP-FPM installations affected?
PHP lists PHP-FPM among the configurations in scope. Its advisory says exploitation of the stale-state flaw was validated against FPM. No complete FPM exploit was demonstrated for the out-of-memory flaw in the supplied advisory, which does not establish immunity.
Do the vulnerabilities require a login?
The PHP advisories describe the flaws as exploitable without privileges or user interaction. The reported impact is remote code execution with the permissions of the web worker account.
What did Node.js update on Oct. 21?
Node.js released fixes for 10 vulnerabilities across its supported release lines. The supplied source does not provide the individual advisories or fixed version numbers, so operators should consult the Node.js security release for their specific line.
Does the Railway incident relate to PHP2Shell?
The source describes it as a separate security incident and says Railway has not linked it to either the PHP or Node.js vulnerabilities. It provides no further incident details.
Source: Thorsten Meyer AI
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
