PHP2Shell (CVE-2026-109618, CVE-2026-109619) and the October 2026 Node.js Security Release: What to Patch Now

On 21 October 2026, PHP and Node.js both shipped urgent security releases. PHP fixed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), a pair of critical flaws that can let an attacker run code on your server without logging in. Node.js fixed 10 vulnerabilities, including a Brotli decoder bug that can lead to remote code execution. Here is what each vulnerability means, how to check whether you are affected, exactly what to patch, and how we build systems so advisories like these become routine updates instead of emergencies.

What is PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?

PHP2Shell is the name given to two memory-safety vulnerabilities in the core of PHP, disclosed on 21 October 2026. Because they live in the PHP engine rather than in any framework, every application running on a vulnerable PHP version inherits them: WordPress and WooCommerce sites, Laravel and Symfony apps, Magento and Drupal stores, and custom PHP ERPs and CRMs.

• CVE-2026-109618 is memory corruption triggered when PHP runs out of memory while setting up a request, which can leave request memory uninitialised.
• CVE-2026-109619 is a use-after-free: a later request handled by the same PHP worker can reuse stale state that points to freed memory.

Chained together, they allow unauthenticated remote code execution. The PHP project rates both at CVSS 9.2; early copies of the CVE records carried an incorrect 10.0. Every PHP version from 5.4 up to 8.5.11 is affected.

Who is at risk?

Any PHP installation that serves web requests. Security vendors rate Apache with mod_php as the highest risk, and also list PHP-FPM, php-cgi, FrankenPHP and LiteSpeed as affected setups. The attack paths confirmed so far go through PHP’s session upload progress feature, which is enabled by default.

Is PHP2Shell being exploited?

Treat it as actively targeted. Amazon Threat Intelligence reported an exploitation attempt on 17 October 2026, four days before public disclosure, and security teams reported attacks on the day the fix was released. National agencies including the UK’s NCSC, CERT-EU and Singapore’s CSA have issued alerts urging immediate patching.

Affected and fixed PHP versions

How to patch PHP2Shell

1. Check the version your web server actually runs. The command-line PHP can differ from the one serving requests, so check both: php -v and php-fpm -v (or phpinfo() on a protected page).
2. Upgrade through your OS packages, Docker base image or hosting control panel to a fixed release from the table.
3. Restart every PHP worker, for example sudo systemctl restart php8.3-fpm or your Apache service. Patched binaries do nothing while old workers keep running.
4. On managed hosting, ask your provider to confirm the patched version is live for your site.

Temporary mitigation if you cannot upgrade today

Disable session upload progress in php.ini or in the PHP-FPM pool configuration, then restart every worker:

; php.ini
session.upload_progress.enabled = 0

; or in a PHP-FPM pool (e.g. www.conf)
php_admin_flag[session.upload_progress.enabled] = off

Setting it with ini_set() or a .user.ini file is too late in the request to help. This blocks the confirmed attack paths, but the PHP project is clear that no configuration change fully closes the vulnerability, so upgrade as soon as you can. CERT-EU also lists a further PHP issue, CVE-2026-115560, with details due in the next PHP release, so expect to patch again soon.

Node.js October 2026 security release: 10 CVEs patched

The same day, Node.js released 26.12.1, 24.22.1 and 22.23.4, fixing 10 vulnerabilities across all supported release lines, four of them rated high severity. End-of-life versions are always affected and receive no fixes.

The release also fixes a keep-alive response-ordering bug, an IPv4 certificate validation issue, two Permission Model bypasses and a ZIP parsing flaw, and updates bundled dependencies including OpenSSL, c-ares and Undici.

How to patch Node.js

1. Check versions everywhere with node -v: servers, CI runners, Docker images and serverless functions.
2. Upgrade to 26.12.1, 24.22.1 or 22.23.4, rebuild Docker images from an updated base image (a cached node:22 layer can still be old), and redeploy.
3. If you build startup snapshots or single executable applications, rebuild them with the patched version so they stop repeating cached random values.
4. Prioritise services that decompress data from untrusted sources or connect to user-supplied URLs.
5. Move anything still on Node.js 20 or older to a supported LTS line.

A 30-minute response checklist for PHP and Node.js teams

1. List every server, container and function running PHP or Node.js, including staging and forgotten admin tools.
2. Record the exact runtime version of each one.
3. Patch internet-facing systems first, then internal ones.
4. Restart PHP workers and redeploy Node.js services so the new versions actually run.
5. Apply the PHP stopgap anywhere an upgrade is blocked, and set a deadline to remove it.
6. Review logs since 17 October for unusual multipart uploads, new files in web roots and unexpected processes. If anything looks wrong, rotate credentials and API keys.
7. Schedule upgrades away from end-of-life runtimes (PHP 8.1 and older, Node.js 20 and older).

How Tegnol approaches security in the systems we build

PHP2Shell is a reminder that risk lives in the platform as much as in your own code. You can write perfect application code and still be exposed by the runtime underneath it. That is why we design every product so that a critical advisory is a short, rehearsed update, not a weekend of firefighting:

• Supported runtimes only. We launch on actively supported PHP and Node.js LTS versions and plan upgrades before end of life, so a fix is always available.
• Reproducible builds and deployments. Infrastructure and deployments are defined in code, so patching means rebuilding and redeploying in minutes, with health checks and instant rollback.
• Automated vulnerability monitoring. Dependency and runtime alerts (Composer and npm audits, plus automated update pull requests) run on every repository we hand over.
• Defence in depth. Least-privilege access, a web application firewall, rate limiting, strict input validation, secrets kept out of code and encrypted, tested backups, so a single runtime bug does not become a full breach.
• Custom code, not AI-generated shortcuts. AI tools are great for demos, but the code they generate is rarely built for real users: weak authentication, unchecked inputs and outdated dependencies are common. In a Production Sprint we rebuild that product on a clean, custom codebase with a proper architecture, so it holds up when real users and real attackers arrive.

How our free post-launch support protects clients

Launch is when real users, and real attackers, arrive. Every Tegnol project includes 30 days of free post-launch bug support: if a critical advisory like PHP2Shell or the Node.js Brotli flaw lands in that window, we patch the runtime, rebuild and redeploy your product at no extra cost. After that, Growth Partner clients get ongoing monitoring, dependency updates and runtime upgrades as part of their plan, so their product stays secure while it keeps improving.

That is a big part of why founders choose us. They are not buying a one-off build that ages the day it ships; they get a team that stays accountable for keeping the product fast, stable and secure, and that works all year round, holidays and year end included, because vulnerabilities do not wait for office hours.

Modernising legacy PHP systems and ERPs without losing data

Many established businesses and enterprises run critical ERPs, CRMs and internal tools on older PHP versions that will never receive a PHP2Shell fix. Patching is not an option there; modernisation is. We redesign and re-architect these systems into secure, modern platforms that teams actually enjoy using:

• Audit first. We map your current system, data model, integrations and the workflows your team relies on every day.
• Secure architecture. Role-based access control, audit logs, encryption in transit and at rest, and a supported, maintainable stack.
• Zero data loss migration. Data is migrated with validation and reconciliation, and old and new systems can run in parallel until every record checks out.
• User-friendly redesign. Faster, clearer screens built around how your staff work, not around what the old system happened to allow.
• Phased rollout. Module by module, so operations never stop for a risky big-bang switchover.

For enterprise teams, a Production Sprint is the best place to start. It is not a bug-fixing exercise: in as little as 20 days (the final timeline depends on your requirements) we audit your current system, rebuild it on a new, secure codebase with an improved architecture, and launch the first modernised module. From there, the Growth Partner plan carries the rest of the migration forward at your pace. We work with Laravel, React, Next.js, Node.js and Flutter, so we can modernise PHP systems on a stack your team already knows or move them to a new one.

Frequently asked questions

Sources

• Node.js: October 21, 2026 security releases
• Unit 42: Threat brief on CVE-2026-109618 and CVE-2026-109619
• Tenable: PHP2Shell frequently asked questions
• Google Cloud: Responding to core PHP vulnerabilities
• NCSC (UK): Critical security issue affecting PHP
• CERT-EU: Critical vulnerabilities in PHP
• Sansec: PHP2Shell research and FPM mitigation
• Plesk: PHP2Shell mitigation guidance
• CSA Singapore: Critical vulnerability in Node.js