🔍 Read the full analysis: PHP2Shell And Node.js Security: What To Patch And Verify Today on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
PHP released fixes for two critical remote-code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on Oct. 21, 2026. Node.js also issued fixes for 10 vulnerabilities that day. Administrators must verify whether their own servers, applications and bundled products are running patched runtimes; provider-managed services may be updated automatically, but customer-built deployments often are not.
The PHP flaws are CVE-2026-109618, involving out-of-memory corruption, and CVE-2026-109619, involving stale global state. The PHP project’s advisories rate both CVSS v4.0 9.2, Critical. They describe unauthenticated remote code execution under the privileges of the web worker account. That does not by itself mean an attacker gains root access, but the worker account may be able to read site files, configuration and database credentials.
Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP project says the vulnerabilities affect web-serving installations, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Its advisory describes a demonstrated exploit against Apache mod_php that can run before application code; it also says the stale-state issue was validated against mod_php and FPM. For the out-of-memory flaw, it reports no complete FPM exploit demonstrated, which is not evidence that FPM is immune.
The October 22 report by Thorsten Meyer also notes that Node.js released fixes for 10 vulnerabilities across its supported release lines on Oct. 21. The source material does not identify the individual Node.js advisories or fixed version numbers, so operators should consult the official Node.js release notice for the versions applicable to their deployments rather than rely on a single version number.
Infographic 01 · Which PHP version is safe
Four fixed releases. Everything older needs a plan.
PHP fixed CVE-2026-109618 and CVE-2026-109619 on 21 October 2026. Only these releases, or a vendor package that contains both fixes, close the hole.
| Branch | Fixed release | Status | What to do |
|---|---|---|---|
| 8.5 | 8.5.12 | Fixed | Supported branch |
| 8.4 | 8.4.27 | Fixed | Supported branch |
| 8.3 | 8.3.36 | Fixed | Supported branch |
| 8.2 | 8.2.35 | Fixed, EOL soon | End of life on 31 Dec 2026: plan the upgrade now |
| 8.6 pre-release | 8.6.0 RC4 | Testing only | Release candidate, not for production |
| 8.1 · 8.0 · 7.4 | none | No official release | Minimal source backports in php-src; get a vendor/LTS package or upgrade |
| Older (7.3 and below) | none | Unsupported | BSI: all known versions back to at least PHP 5 are affected. Upgrade |
Distribution and LTS packages may carry the fix under an older-looking version number. Check the changelog for both CVE IDs.
Sources: php.net security advisory (21 Oct 2026); GHSA-w8hw-w9fx-j79w; GHSA-6wmf-4rv5-p3rp; BSI warning v1.1.
Powered by Thorsten Meyer AI
Patch the Runtime Behind Each Service
A security release only protects a service after the fixed runtime is running. On managed platforms, the provider may update the runtime automatically; on customer-managed virtual machines, containers and application deployments, the operator may need to update packages, rebuild images and redeploy. A successful package installation on one server does not establish that every live instance, worker or environment is patched.
The possible impact also reaches beyond obvious public websites. PHP can be bundled into admin panels, appliances and other software with web interfaces. Small organisations may not know those products depend on PHP. An exposed vulnerable service could put data available to its worker account at risk, including configuration and credentials. The advisory describes potential execution as that account, not automatic control of the underlying host.
Cloud hosting does not settle the question on its own. Google Cloud and AWS said their own services were not affected, while warning that customers running PHP on their infrastructure could still be vulnerable. The practical distinction is provider-managed runtime versus customer-managed code: the latter generally requires action by the customer.
As an affiliate, we earn on qualifying purchases.
Which PHP Branches Receive Fixes
The PHP project announced the planned security release on Oct. 20, saying it would address two critical vulnerabilities, each rated CVSS v4.0 9.2, and scheduled the release for 14:00 UTC the following day. Its Oct. 21 advisories describe the flaws and list the fixed versions for supported branches.
PHP 8.2 reaches end of life on Dec. 31, 2026, according to its release note. Administrators who patch that branch should plan a move to a supported version. PHP 8.1 and older no longer receive updates from the PHP project. The security team published minimal source backports for PHP 7.4, 8.0 and 8.1 for people who build PHP themselves; other users are directed toward a vendor or distribution package, or an upgrade.
The source report says users of the volunteer-run remirepo repository were warned that it would not have updates on release day and advised to switch to distribution packages or build from source. It also describes a separate security incident at hosting platform Railway, but says Railway has not linked that incident to either the PHP or Node.js vulnerabilities.
“All PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.”
— PHP security advisory, as quoted in the Oct. 22 report
Node.js security patch management tool
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Deployment Status Still Needs Checking
The available source material does not list the Node.js vulnerability identifiers or fixed version numbers, nor does it provide details about the individual flaws. Operators should use the official Node.js release information to identify the correct update for each supported release line.
It is also not clear from a version check on one machine whether every production instance has been updated. Container images may remain unchanged until rebuilt and redeployed; load-balanced services may have multiple workers or hosts. The source describes the PHP release scope and fixes but does not establish which individual websites or products remain exposed.
For PHP-FPM, the PHP advisory’s statement that no complete exploit for the out-of-memory flaw has been demonstrated should not be read as a guarantee of safety. The same advisory reports validation of the stale-state issue against FPM. The Railway incident is described as separate, with no reported link to these runtime vulnerabilities.
As an affiliate, we earn on qualifying purchases.
Verify Versions and Live Deployments
Administrators should first identify every service and product that uses PHP or Node.js, including web interfaces, appliances, bundled control panels and container workloads. Check the runtime version on the host and in the deployed application image, then compare it with the official fixed releases and vendor guidance. For PHP, the listed fixes are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; use a supported vendor or distribution backport where applicable to older branches.
Where customers manage the runtime, apply the package or vendor update, rebuild images if needed, redeploy the service and confirm that the live workers report the patched version. Where a cloud platform manages the runtime, check its documentation and deployment configuration rather than assuming all products update automatically. Review Node.js release guidance for the fixed version matching each supported line.
The next practical milestone is verified deployment, not simply the release of a patch. Teams should also plan PHP 8.2 migration before its stated Dec. 31, 2026 end-of-life date. Public advisories and vendor notices may add details, including product-specific update instructions, as providers publish them.
As an affiliate, we earn on qualifying purchases.
Key Questions
What are the PHP2Shell vulnerabilities?
PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two PHP flaws rated Critical, CVSS v4.0 9.2. The PHP advisories describe possible unauthenticated remote code execution with the privileges of the web worker account.
Which PHP versions contain the fixes?
The fixed releases listed by the PHP project are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For older branches, check the operating-system, hosting or other vendor’s security package guidance; PHP 8.1 and older no longer receive updates from the PHP project.
Does using AWS or Google Cloud mean my PHP site is patched?
No. AWS and Google Cloud said their own services were not affected, but customers running PHP on those platforms may still be vulnerable. Whether a workload is patched depends on who manages its runtime and whether the fixed version has been deployed.
What should Node.js operators do?
Node.js released fixes for 10 vulnerabilities on Oct. 21, 2026. Check the official Node.js release notice for the fixed version on each supported release line, then update and redeploy customer-managed services. The source report does not provide specific Node.js version numbers.
Is PHP-FPM confirmed safe from PHP2Shell?
No. The PHP advisory says a complete exploit for the out-of-memory flaw had not been demonstrated against FPM, but it also says the stale-state flaw was validated against FPM. Lack of a demonstrated exploit for one flaw does not establish that the setup is immune.
Source: ThorstenMeyerAI.com
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
