TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
PHP released fixes for two critical remote code execution flaws known as PHP2Shell on Oct. 21, while Node.js issued fixes for ten vulnerabilities the same day. The releases do not protect a site until the fixed runtime or vendor package is deployed and verified; exposure and patching responsibilities vary by server and host.
The PHP project rated CVE-2026-109618 and CVE-2026-109619 Critical, at CVSS v4.0 9.2 each. The advisories describe one flaw involving out-of-memory corruption and another involving stale global state. They say an attacker needs no login or user interaction and could execute code with the permissions of the web worker account. That account may have access to site files, configuration and database credentials, but the described impact does not mean an attacker automatically gains root access.
Fixed PHP releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.6.0 RC4 is a release candidate for testing, not a production fix recommendation. PHP 8.1 and older do not receive regular project updates; the advisory says minimal source backports were published for PHP 7.4, 8.0 and 8.1 for people building PHP themselves. Other users of those versions need a fixed distribution or long-term-support package, or an upgrade. The PHP 8.2 branch is due to reach end of life on Dec. 31, 2026.
The advisory identifies web-serving PHP installations as exposed, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. It describes a demonstrated unauthenticated exploit against Apache mod_php that can run before application code, so application-level checks may not stop it. The stale-state issue was validated against mod_php and FPM; the advisory says a complete FPM exploit for the out-of-memory flaw had not been demonstrated. That does not establish that FPM is immune.
Same-day response · October 21, 2026
PHP2Shell & Node.js Security Release
A practical checklist for confirming that the fixed runtime or vendor package is deployed and serving production traffic. Release announcements alone do not patch a site.
Unauthenticated remote code execution risk in web-serving PHP installations.
Fixes issued the same day. Confirm the applicable release line with the official notice and vendor.
Patch the runtime behind the site
These flaws affect the runtime processing web requests. Updating a CMS or application alone may leave the vulnerable PHP interpreter in place.
Code execution as the web worker
The advisories describe no-login, no-interaction attacks. Successful code execution can access files, configuration, or database credentials available to the web worker account; that does not automatically mean root access.
Web-serving installations
Named setups include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. An application-level check may not stop an exploit that runs before application code.
FPM is not cleared
The stale-state flaw was validated against mod_php and FPM. A complete FPM exploit for the out-of-memory flaw was not demonstrated; that is not evidence of immunity.
Match the branch, then check the package
Use the fixed release for your branch, or verify that your distribution or long-term-support provider backported both fixes.
8.5.12
Upstream fixed release for the 8.5 branch.
8.4.27
Upstream fixed release for the 8.4 branch.
8.3.36
Upstream fixed release for the 8.3 branch.
8.2.35
Upstream fixed release. This branch reaches end of life on Dec. 31, 2026.
8.6.0 RC4
For testing; not a production fix recommendation.
Verify support
PHP 8.1 and older do not receive regular project updates. Minimal source backports were published for 7.4, 8.0, and 8.1; other users need a fixed vendor/LTS package or an upgrade.
Verify fixes across production
Map ownership and follow the deployed runtime all the way to live traffic. A version string alone may not reveal a distribution backport.
Inventory services
Find every PHP and Node.js service, including web servers, application processes, containers, and managed hosting.
Confirm ownership
Ask the host what it manages and whether the fixed package is active. Self-managed servers and containers may need rebuilding.
Verify both PHP CVEs
Check the branch release or vendor advisory/changelog for CVE-2026-109618 and CVE-2026-109619.
Deploy and confirm
Update, rebuild, or replace as needed; restart relevant services, then verify the runtime serving live requests.
Ten fixes were issued. Version details are not provided here.
Use the Oct. 21 Node.js security release to identify the applicable fixed release line, then confirm the vendor package or deployed runtime. The supplied information does not list affected versions, vulnerability names, or severities.
Production verification points
The work is complete when the fixed code is deployed in the environment that actually serves requests.
Package and runtime checks
- Match the installed branch to its fixed release, or confirm vendor backports for both CVEs.
- For unsupported versions, obtain a fixed distribution/LTS package, apply an available source backport, or upgrade.
- Confirm the web server or worker uses the updated runtime after required restarts or container replacement.
Confirm the responsible party
- Consult the Node.js Oct. 21 release notice and vendor package information for the correct fixed line.
- Ask managed providers whether they update PHP or Node.js and whether the fix is already serving traffic.
- Check changelogs: distribution versions can look older when a security fix was backported.
Questions operators are asking
Which PHP versions contain the fixes?
8.5.12, 8.4.27, 8.3.36, and 8.2.35. A distribution package may include backports under a different-looking version; check its advisory or changelog for both CVE identifiers.
Does PHP-FPM avoid PHP2Shell?
No such assurance is given. The stale-state flaw was validated against FPM, and no complete FPM exploit for the out-of-memory flaw had been demonstrated.
What should PHP 8.1 and older users do?
Regular project updates are unavailable. Seek a fixed vendor or long-term-support package, use an available source backport, or upgrade to a supported branch.
Is there evidence of exploitation in the wild?
The supplied material identifies no affected websites and provides no evidence of exploitation in the wild. It also does not link the separate Railway security incident to either runtime flaw.
Patch the Runtime Behind the Site
These flaws affect the runtime that processes web requests, so updating a content management system or application alone may leave the vulnerable PHP interpreter in place. A successful attack could run code with the web worker’s permissions, which can expose data and credentials available to that account. The practical result depends on the server’s permissions and configuration.
Responsibility varies by deployment. A managed host may update its runtime, while a business running its own server or container may need to rebuild and redeploy it. Operators should check the actual package or image serving traffic and confirm the vendor says it includes both PHP fixes. The same verification principle applies to the Node.js security release; the supplied source does not give the affected Node.js versions or individual vulnerability details.
hardware security keys for two-factor authentication
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Two Runtime Updates on October 21
The PHP project previewed its release on Oct. 20, saying two critical vulnerabilities would be addressed the next day. Its security advisories then described the two flaws and the fixed releases. A separate follow-up published Oct. 22 framed the task for site owners as checking whether patched code is actually serving requests.
PHP 8.2 remains supported only until Dec. 31, 2026, according to the supplied release information, so operators on that branch face a near-term upgrade decision alongside this patch. The source also warns that users of the volunteer-run remirepo repository were told updates would not be available that day and were directed to distribution packages or source builds.
The source reports that Node.js released fixes for ten vulnerabilities on Oct. 21 across its supported release lines. It also mentions a separate security incident at hosting platform Railway, while saying Railway had not linked that incident to either runtime vulnerability. No details about the Railway incident are provided here.
““two critical vulnerabilities, both rated CVSS v4.0 9.2””
— PHP project pre-announcement, Oct. 20, 2026
PHP security patch management tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Exposure Depends on Deployment
The supplied material does not identify which websites have been attacked or provide evidence of exploitation in the wild. It also does not specify affected or fixed Node.js version numbers, the names or severity ratings of its ten vulnerabilities, or a version-check procedure for that release. Administrators should consult the relevant Node.js release notice and their vendor’s package information.
PHP’s advisory says no complete exploit for the out-of-memory issue had been demonstrated against PHP-FPM, while reporting validation of the stale-state issue against FPM. The available information does not establish that FPM is safe from the first flaw. The supplied source also does not identify which cloud platforms automatically update PHP or Node.js, so operators need to confirm responsibility directly with their provider.
A package version can also look older than the upstream fixed release if a distribution has backported the patch. The source advises checking package changelogs for both PHP CVE identifiers; version numbers alone may not settle whether a system is fixed.
Node.js vulnerability scanning tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Verify Fixes Across Production
Administrators should identify every production service that runs PHP or Node.js, including web servers, application services, containers and managed hosting environments. For PHP, check the installed package or runtime against the fixed release for its branch, or confirm through the vendor’s advisory or changelog that both CVEs are addressed. Where the version is unsupported, obtain a fixed vendor or long-term-support package, apply an available source backport, or upgrade to a supported branch.
After deployment, verify which runtime is serving live traffic and check that any relevant service or container has been restarted or replaced as required by the deployment method. Ask hosting providers what they manage and whether the fixed package is already active. Node.js operators should use the Oct. 21 release information to identify the applicable fixed release line and confirm deployment. The next status update depends on package availability and each operator’s verification; the supplied material gives no broader deadline.
web server runtime verification tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
Which PHP versions contain the fixes?
The listed fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. A distribution package with a different-looking version may include a backport, so check its advisory or changelog for both CVE identifiers.
Does PHP-FPM avoid the PHP2Shell flaws?
No such assurance is given. The supplied advisory says the stale-state flaw was validated against FPM, and says a complete FPM exploit for the out-of-memory flaw had not been demonstrated. That is not evidence of immunity.
What should operators of PHP 8.1 or older do?
Those versions no longer receive regular updates from the PHP project. Operators need to check for a fixed package from their distribution or long-term-support vendor, use an applicable source backport if they build PHP themselves, or upgrade.
What did Node.js fix on Oct. 21?
The supplied source says Node.js issued fixes for ten vulnerabilities across supported release lines, but it does not list the affected versions or flaw details. Operators should consult the Node.js release notice for the version relevant to their deployment.
Source: Thorsten Meyer AI
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
