TL;DR

Before you orderOffer from Amazon

Get privacy and security gear delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP released fixes on Oct. 21 for two critical PHP2Shell remote code execution flaws, while Node.js issued security fixes for 10 vulnerabilities across supported release lines. Operators need to confirm that patched code is running; the source material does not provide Node.js version details or a complete checklist.

PHP released fixes on Oct. 21 for two critical remote code execution vulnerabilities known as PHP2Shell, and Node.js published fixes for 10 vulnerabilities the same day. The updates matter to operators of websites and back-end services, but protection depends on whether their systems are running patched code.

The PHP flaws are CVE-2026-109618, involving out-of-memory corruption, and CVE-2026-109619, involving stale global state. The PHP security advisory and the cited GitHub advisories rate each flaw Critical, with a CVSS v4.0 score of 9.2. The source says exploitation requires neither privileges nor user interaction and could allow remote code execution under the web worker account’s permissions.

PHP published fixed releases for supported branches: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The article says PHP 8.2 reaches end of life on Dec. 31, 2026, and urges users of that branch to plan a move. PHP 8.6.0 RC4 is a release candidate for testing, not production. For PHP 8.1 and older, the project did not issue standard releases; it published minimal source backports for some versions, while advising users to obtain a fixed package from a vendor or upgrade.

The source material says the PHP advisory covers installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It reports that an unauthenticated exploit was demonstrated against mod_php before application code runs. A complete exploit for the out-of-memory flaw in PHP-FPM was not demonstrated in the cited advisory; the material says this does not establish that FPM is immune. Separately, Node.js announced fixes for 10 vulnerabilities across supported release lines, but the supplied material gives no affected components, severity ratings or fixed version numbers.

Why Runtime Updates Affect Websites

The reported PHP impact is remote code execution without authentication, which could let an attacker act with the web worker’s permissions. That account may have access to site files, configuration or database credentials, depending on how the server is set up. The source explicitly distinguishes this from root access: the reported consequence is execution as the web worker, not automatic control of the entire server.

The same-day Node.js release broadens the maintenance task for teams running both runtimes. The source says Node.js is used in web back ends and other applications, but does not describe the 10 flaws or their severity, so their specific risk cannot be assessed from the supplied information. In both cases, a release announcement alone does not patch a running service; operators must identify their deployed versions and apply the relevant updates.

PHP Branches and Exposure

PHP’s Oct. 20 pre-announcement said the next day’s release would address two critical flaws rated 9.2 under CVSS v4.0 and set a release time of 14:00 UTC. The security advisory published with the fixes described the flaws as an out-of-memory corruption issue and a stale-state issue. The supplied article characterizes this as a practical follow-up to an earlier report on PHP2Shell, rather than a new account of how the vulnerabilities were found.

PHP’s advisory says versions that no longer receive updates from the project need a vendor or long-term-support package, a source backport, or an upgrade. It also warns that the volunteer-run remirepo repository would not have updates that day. The source advises checking vendor changelogs for both CVE identifiers because a distribution package may contain the fixes even if its displayed version number differs from PHP’s release number.

““two critical vulnerabilities, both rated CVSS v4.0 9.2””

— PHP project, in its Oct. 20 pre-announcement

Details Operators Still Need

The supplied material does not list the Node.js fixed versions, name the 10 vulnerabilities, or say which Node.js deployments are affected. Those details are needed before operators can map the release to their installations. For PHP, the source says a complete exploit for the out-of-memory issue in PHP-FPM had not been demonstrated, while noting that absence of a demonstrated exploit does not prove immunity.

The source also does not provide the promised full operational checklist or establish which cloud platforms apply these patches automatically. A separate security incident at hosting platform Railway is mentioned, but the material provides no incident details and says Railway has not linked it to either vulnerability. No connection should be inferred from timing alone.

Verify Patches on Live Servers

Operators should identify which PHP and Node.js versions their services are actually running, then apply the appropriate vendor or project updates. For PHP, the source recommends checking package changelogs for CVE-2026-109618 and CVE-2026-109619, especially when distribution packages use version numbers that differ from upstream releases. Teams on PHP 8.2 should also plan for its stated end-of-life date, Dec. 31, 2026.

Teams using Node.js need to consult the release information for the affected and fixed versions, which are not included in the supplied source material. They should confirm that updated code is serving production traffic after deployment. The source offers no confirmed schedule for further advisories or details on the Railway incident.

Key Questions

What did PHP fix on Oct. 21?

PHP released fixes for CVE-2026-109618 and CVE-2026-109619, two critical remote code execution flaws known as PHP2Shell.

Which PHP versions include the fixes?

The source lists 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as fixed releases. Check your vendor’s changelog too, since package version numbers may differ.

Did Node.js also release security fixes?

Yes. Node.js released fixes for 10 vulnerabilities across supported release lines on Oct. 21. The supplied material does not name the fixed versions or describe the vulnerabilities.

Does PHP-FPM avoid the PHP2Shell risk?

The source says a complete exploit for the out-of-memory flaw in PHP-FPM had not been demonstrated, but that is not proof that FPM is immune. The cited advisory says the stale-state flaw was validated against both mod_php and FPM.

Has Railway linked its security incident to PHP2Shell or Node.js?

No such link is reported in the supplied material. It says Railway’s separate incident was not linked to either vulnerability.

Source: Thorsten Meyer AI