Critical PHP and Node.js vulnerabilities, October 2026: what happened and how to fix them

On October 21, 2026, PHP and Node.js both shipped security updates: emergency patches in PHP for two critical flaws that let an attacker run code remotely with no login needed, and fixes in Node.js for ten vulnerabilities, including a high-severity bug in Brotli decompression. If your site or backend runs on either, don't put this off.

The short version: patch the runtime itself, PHP or Node.js, and restart your services. Bumping WordPress, Laravel or your packages won't do it.

Part one: PHP2Shell

So what actually happened?

The bugs live in the PHP engine, not in your application. They're tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale, and security outlets have started calling the pair php2shell. Both come down to how memory is handled during a request:

• CVE-2026-109618: run out of memory at the wrong moment and PHP can stop while internal request data is only half set up. The cleanup step then treats that half-built data as if it were fine.
• CVE-2026-109619: some internal request state sticks around after the memory backing it is gone.

Researchers at Wiz, Calif and OpenAI's Codex Security team found them. The code involved has sat in PHP for more than a decade, and the affected range stretches back to roughly PHP 5.4. Reports say the researchers used AI models to turn these old bugs into working exploits remarkably fast.

Who's at risk?

Anything that serves web requests through PHP: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed. Yes, even a bare "Hello World" page, because the flaw sits underneath your code. Apache mod_php is the worst case, because a demonstrated exploit needs just one unauthenticated request and fires before any application code runs. There's a second worry too: an attacker may be able to read memory from the PHP worker, and that memory can hold passwords, tokens and API keys.

Cloudflare and watchTowr both reported active exploitation attempts, although as of the reporting no source had confirmed a successful break-in on a specific server. CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalog on October 26.

How to fix it

PHP 8.1 and older no longer get updates from the project. The security team did publish source backports for 7.4, 8.0 and 8.1, but those only help if you build from source, so the safer move is a supported branch.

What to do, in order:

1. Work out which version actually serves your web traffic, since it can differ from the one you get on the command line (first command below).
2. Update the package through your OS, host or container image, and remember that on Linux distributions the version number can look "old" even when the fix is in, so check the changelog for the CVE instead (second command below).
3. Restart Apache, PHP-FPM and any long-running PHP workers.
4. Look at memory_limit and post_max_size again after updating. The fix adds a new hard memory limit; when a process hits it, the process simply ends and shutdown handlers don't run.
5. Running Docker? Rebuild with --pull and check that the tag really carries the patched version.

php -v
php-fpm -v      # if you use FPM
apt changelog php8.3-cli | grep CVE-2026-109618

Can't update right now? Updating is the only complete fix. What follows closes off a few specific attack paths and nothing more, going by PHP's guidance as The Hacker News reported it. For CVE-2026-109619, set session.upload_progress.enabled=0 and restart workers (on PHP 8.5, also set fatal_error_backtraces=0). For the first flaw, enforce request-size limits at the web server or proxy. Read the official advisory on php.net before you change anything, and don't let these settings stand in for the update.

What to look for in your logs: odd multipart requests followed by memory-limit errors or a run of HTTP 500s, PHPSESSID cookies that look strangely large in responses, and PHP workers restarting for no reason you can explain.

Part two: Node.js

What was fixed

The Node.js project released updates for the 26.x, 24.x and 22.x lines, which together fix ten vulnerabilities, four of them high severity. These are the ones that matter most:

• CVE-2026-111497 (Brotli): an out-of-bounds write in the bundled Brotli decoder: feed it malformed compressed input and process memory can get corrupted, and the result might be a crash, a memory leak or remote code execution. Any code that decompresses untrusted data with node:zlib is affected. Security sources nicknamed it Node2Shell.
• CVE-2026-105482: dns.resolve*() silently cuts off hostnames that contain a NUL byte, so your app might validate one name and end up resolving a different one.
• CVE-2026-105483 and CVE-2026-106069: TLS certificate hostname checks can be bypassed when an IP address is written in an unusual way, such as fullwidth digits or leading zeros.
• Plus medium and low severity issues in keep-alive connections, random value caches inside snapshots, and the Permission Model.

Patching Node.js

Safe versions: Node.js 26.12.1, 24.22.1 and 22.23.4. End-of-life versions, Node.js 20 included, are always affected by a security release.

1. Check which version you're on, then update through your version manager, package or container image (commands below).
2. Rebuild and redeploy your Docker images. Restart PM2 or systemd services too.
3. Run npm audit, update your dependencies, commit the lockfile, and stick to a supported runtime (26, 24 or 22).
4. Temporary hardening (a sensible precaution, not a substitute): don't decompress Brotli from untrusted sources. If you don't need the br encoding on incoming request bodies, reject it.
5. Validate hostnames before calling dns.resolve*(), and strip unexpected characters such as NUL.
6. Reach internal services by name or by canonical IP addresses. Skip the unusual IP spellings.

node -v
nvm install 24 && nvm use 24
npm audit

Quick checklist

• [ ] I know which PHP and Node.js version is really running on every server and container.
• [ ] I'm on the patched versions and every worker has been restarted.
• [ ] I went through the logs looking for the patterns above.
• [ ] I confirmed with my shared host or provider that the engine is updated. On shared hosting the update isn't yours to make, but asking is.
• [ ] I have a plan for getting off end-of-life branches.

If you're after tools for tracking vulnerabilities and managing dependencies, the digital platforms on DigitalDalil are a good place to start.

Sources

• PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws (The Hacker News)
• Critical Vulnerabilities in PHP Require Immediate Patching (CISA)
• PHP.net: security announcements
• Node.js — Wednesday, October 21, 2026 Security Releases
• Node.js Brotli vulnerability allows remote code execution (Aikido)