On 21 October 2026, PHP and Node.js both released urgent security patches on the same day. PHP fixed two critical bugs that let attackers run their own code on a server with a single request, no login needed. Node.js fixed 10 vulnerabilities across all its supported versions, four of them rated high.

If your business runs a website, an online store, a web app or an API, there is a good chance it uses PHP, Node.js or both. PHP alone powers WordPress, Drupal, Laravel and countless custom apps. Exploit code for the PHP bugs is already public, so this is not a “next sprint” job. It is a “today” job.

This guide explains what was fixed, who is affected and exactly what your team should do now.

PHP: two critical bugs, nicknamed “php2shell”

The two PHP bugs are tracked as CVE-2026-109618 and CVE-2026-109619. Both have a severity score of 9.2 out of 10, and both allow unauthenticated remote code execution. In plain words, an attacker can send one request to your website and take control of the server.

• CVE-2026-109618: a memory bug that happens when a request runs out of memory, for example during a file upload. PHP can end up cleaning up memory the attacker controls.
• CVE-2026-109619: leftover data from one request can stay behind after a fatal error, and the next request on the same worker can use it.

Researchers call the pair “php2shell” because one request can give an attacker a shell on your server. The details leaked online a day early, on 20 October, so PHP moved its emergency release forward to 21 October. Proof-of-concept exploit code is already public, and researchers have shown working attacks against WordPress, Drupal and Joomla sites.

Who is affected: every PHP installation that serves web traffic, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team says mod_php is the highest-risk setup. This also covers PHP that comes bundled inside other software, like CMS platforms, admin panels, hosting images and legacy apps.

Upgrade to these patched versions:

• PHP 8.5 → 5.12
• PHP 8.4 → 4.27
• PHP 8.3 → 3.36
• PHP 8.2 → 2.35

Running PHP 8.1 or older? These versions are end-of-life and will not get official releases. The PHP team published minimal source backports for 7.4, 8.0 and 8.1, but the safe path is to upgrade to PHP 8.2 or newer as soon as possible. Some Linux distributions and long-term support vendors have also shipped their own patched packages, so check with yours.

Node.js: 10 fixes, four rated high

On the same day, Node.js released security updates for all three active release lines. The release fixes 10 vulnerabilities, and the highest severity is high.

The four high-severity issues are:

• CVE-2026-111497: an out-of-bounds write in the Brotli decoder that can lead to remote code execution.
• CVE-2026-105483: a TLS certificate hostname check that can be bypassed when an IP address is written with fullwidth digits.
• CVE-2026-106069: another TLS hostname check bypass, when a host loosely resolves to an IP address.
• CVE-2026-105482: resolve cuts off names that contain a NUL character.

The release also fixes three medium and three low issues, and updates dependencies including OpenSSL, c-ares, Undici and SQLite.

Upgrade to these patched versions:

• js 22.x → 22.23.4
• js 24.x → 24.22.1
• js 26.x → 26.12.1

End-of-life Node.js versions are always affected by security releases and will not be patched, so move them to a supported line.

What to do now

1. Find every PHP and Node.js install. Check dev machines, staging and production. Don’t forget the hidden ones: WordPress and other CMS sites, admin panels, legacy apps, Docker images and 1-click hosting images. Run php -v, php-fpm -v, node -v and npm -v to see your versions. Check php-fpm -v too, because the PHP version your website runs on can be different from the one on the command line.
2. Start with what faces the internet. Public websites and APIs that accept requests from anyone are the top priority.
3. Update to the patched versions listed above, for your branch and operating system. If you use a framework like Laravel or a CMS like WordPress, also install any patches the vendor releases. Updating the framework alone does not fix the PHP bug underneath.
4. Restart everything. Restart PHP-FPM, Apache or your Node.js processes so the new version is actually running, then run your regression tests.
5. Check for signs of attack. Review access logs and running processes. Watch for PHP workers starting shells or download tools. If you find something suspicious, isolate the server and keep the logs.

Can’t patch today? Reduce your risk in the meantime

These steps lower the risk, but they do not make your PHP safe. Treat them as a stopgap while you plan the update.

• Take it off the public internet. If an app doesn’t need to be public, restrict access or put it behind a VPN.
• Use your firewall and WAF. Enforce limits on request size, headers and form fields at the web server or proxy level, and keep monitoring on.
• Turn off upload progress tracking. Set upload_progress.enabled=0 in php.ini or the FPM pool config, then restart all workers. This reduces exposure to CVE-2026-109619.
• Tighten upload limits. Keep post_max_size small (8M if you don’t need uploads, 32M if you do), with upload_max_filesize

Hiding errors with display_errors or error_reporting does not help. The only real fix is updating PHP.

Update now, stay safe later

Security patches like these are a reminder that keeping your tech stack up to date is not a one-time job. It is part of running a healthy product. The good news is that the fix is clear: find every PHP and Node.js install, update to the patched versions and restart.

Not sure which of your systems are affected, or short on hands to patch everything quickly? Emveep’s engineers can help you check your PHP and Node.js versions, apply the updates safely and test that your apps still work. And if your team needs more capacity for the long run, Emveep’s Extended Team can add experienced engineers to your team in just a few weeks.