🔍 Read the full analysis: Did You Patch PHP2Shell And The Node.js Security Release Yet? on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
PHP released fixes on October 21 for two critical remote code execution vulnerabilities, while Node.js issued fixes for ten vulnerabilities across its supported release lines. A fix only protects systems after it is installed and running; cloud customers may need to rebuild or redeploy their own PHP and Node.js workloads. The available source does not provide Node.js version numbers or the full cloud-platform patch matrix.
PHP released fixes on October 21 for two critical remote code execution vulnerabilities known as PHP2Shell, and Node.js issued fixes for ten vulnerabilities the same day. The updates do not protect a server until the fixed runtime is installed and running, leaving website owners and administrators to check their versions and determine whether they or their provider must act.
The PHP flaws are listed as CVE-2026-109618 and CVE-2026-109619. The PHP project’s advisories rate both Critical, with CVSS v4.0 scores of 9.2. The described impact is unauthenticated remote code execution with the permissions of the web worker account. That account is not automatically a system administrator, but it may be able to access website files, configuration data and database credentials available to the application.
Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.6.0 RC4 is a pre-release build for testing, not a production replacement. PHP’s security guidance says versions 8.1 and older no longer receive regular project updates; minimal source backports were published for some older branches, but users generally need a vendor package or an upgrade to a supported branch. The guidance also says PHP 8.2 reaches end of life on December 31, 2026.
The PHP advisory covers web-request-serving installations including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. It describes a demonstrated unauthenticated attack against Apache mod_php before application code runs. The stale-state flaw was validated against mod_php and FPM, while the advisory says a complete FPM exploit for the out-of-memory flaw has not been demonstrated; that is not a statement that FPM is immune. Node.js also shipped security fixes on October 21, but the supplied source does not give the affected CVEs, release numbers or technical details.
Infographic 01 · Which PHP version is safe
Four fixed releases. Everything older needs a plan.
PHP fixed CVE-2026-109618 and CVE-2026-109619 on 21 October 2026. Only these releases, or a vendor package that contains both fixes, close the hole.
| Branch | Fixed release | Status | What to do |
|---|---|---|---|
| 8.5 | 8.5.12 | Fixed | Supported branch |
| 8.4 | 8.4.27 | Fixed | Supported branch |
| 8.3 | 8.3.36 | Fixed | Supported branch |
| 8.2 | 8.2.35 | Fixed, EOL soon | End of life on 31 Dec 2026: plan the upgrade now |
| 8.6 pre-release | 8.6.0 RC4 | Testing only | Release candidate, not for production |
| 8.1 · 8.0 · 7.4 | none | No official release | Minimal source backports in php-src; get a vendor/LTS package or upgrade |
| Older (7.3 and below) | none | Unsupported | BSI: all known versions back to at least PHP 5 are affected. Upgrade |
Distribution and LTS packages may carry the fix under an older-looking version number. Check the changelog for both CVE IDs.
Sources: php.net security advisory (21 Oct 2026); GHSA-w8hw-w9fx-j79w; GHSA-6wmf-4rv5-p3rp; BSI warning v1.1.
Powered by Thorsten Meyer AI
Patch Status Depends on Deployment
The immediate issue is not just whether a vendor has published a fix, but whether the software exposed to requests is actually using it. Self-managed servers, containers and application deployments may need a package update, image rebuild or redeployment. A patch applied to a development machine or host does not necessarily change the runtime serving production traffic.
The PHP project says all PHP installations serving web requests are in scope, so administrators should look beyond their main website. Admin panels, appliances and other bundled products may include PHP without being managed as ordinary websites. If the runtime is exposed and remains unpatched, successful code execution could give an attacker the web worker’s access to files and secrets. The source does not establish that every installation has been attacked.
The same operational distinction applies to Node.js: the release is relevant to organisations running affected Node.js software, but the supplied material does not identify which versions are affected or how each platform distributes its fixes. Teams should consult the official Node.js release information and their provider’s guidance rather than infer coverage from the announcement alone.
Products Worth Considering
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
Canon PIXMA TR160 Wireless Portable Color Inkjet Printer
LG UltraGear evo 27-inch 5K Mini-LED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
What the Advisories Say
The PHP project announced on October 20 that an update addressing two critical vulnerabilities was scheduled for 14:00 UTC the following day. Its advisories describe one flaw involving cleanup after an out-of-memory error leaves request data partially initialized, and another involving request-owned state used after its memory has been freed. Both can lead to remote code execution under the described conditions.
The article published by ThorstenMeyerAI.com on October 22 presents these releases as a practical follow-up to an earlier report about PHP2Shell and Dutch government websites. It also mentions a separate security incident at hosting platform Railway. Railway has not been linked to PHP2Shell or the Node.js vulnerabilities in the supplied material, so the incident should not be treated as evidence of exploitation of either issue.
Cloud providers’ statements distinguish their own managed services from customer workloads. Google Cloud said its services were not vulnerable while warning that customers running PHP could be. AWS likewise said its services were not impacted. Those statements do not establish that customer-built applications on either platform are patched; responsibility depends on the service and deployment method.
“two critical vulnerabilities, both rated CVSS v4.0 9.2”
— PHP project pre-announcement, October 20
Coverage and Exploitation Remain Unclear
The supplied source does not report whether either PHP vulnerability or any of the ten Node.js flaws has been exploited in the wild, nor does it provide a complete account of affected Node.js versions. It also does not establish how many systems remain unpatched. Absence of those details is not evidence that systems are safe; operators should use the relevant advisories to identify affected releases.
Cloud coverage is not uniform. The source says Google App Engine Standard on PHP 8.2 or newer is patched automatically, while older versions require an upgrade and redeployment. It says App Engine Flexible and Google Kubernetes Engine customers must redeploy or rebuild as applicable, and Cloud Run coverage depends on automatic base-image updates. The source’s cloud-platform table is incomplete, so it cannot support a full list of provider responsibilities. The status of the separate Railway incident and its relationship to other events are also not detailed, beyond the statement that it has not been linked to these vulnerabilities.
Verify, Patch, Then Redeploy
Administrators should inventory PHP and Node.js versions across production servers, containers, hosted applications and products that bundle either runtime. For PHP, compare the running version with the fixed releases listed above and check the specific advisory for any vendor-provided backport. Do not assume an old branch is protected simply because its package number differs from the upstream release; confirm the vendor’s security notice.
Where the runtime is self-managed, apply the provider or project update, rebuild affected images if needed, and redeploy the workloads. Then verify that production processes are using the fixed code, rather than relying only on a successful package installation. For managed services, check the platform’s current update guidance and whether automatic base-image updates are enabled. Teams using Node.js should consult the official release notice for the affected versions and upgrade path, as those specifics are not included in the supplied source.
Organisations still on PHP 8.2 should also plan for its stated December 31, 2026 end-of-life date. The immediate milestone is confirming that exposed services have received the October 21 fixes; the source provides no later deadline or report of patch completion.
Key Questions
What is PHP2Shell?
PHP2Shell is the name used for two PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The PHP advisories rate both Critical at CVSS v4.0 9.2.
Which PHP versions include the fixes?
The fixed releases listed by the source are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For older branches, check the relevant distribution or long-term-support vendor guidance, or upgrade to a supported release.
Does hosting on a cloud platform mean PHP is patched automatically?
No. Coverage depends on the specific service and how PHP is deployed. Some managed environments may update automatically, while customer-built images and applications may need an update, rebuild or redeployment. Check the provider’s service-specific guidance.
What did Node.js announce on October 21?
Node.js released fixes for ten vulnerabilities across its supported release lines, according to the supplied source. It does not provide the affected version numbers or CVE details, so administrators should consult the official Node.js release notice.
Source: ThorstenMeyerAI.com
