Key points
- PHP patches fix two critical PHP2Shell flaws allowing unauthenticated remote code execution.
- Node.js updates resolve ten vulnerabilities, including high-severity Brotli decompression issues.
- Next.js and Apache Tomcat releases address remote execution and authentication bypass risks.
The short version
- PHP servers require immediate updates to versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
- Node.js users should deploy patched releases 26.12.1, 24.22.1 or 22.23.4 to fix runtime flaws.
- Next.js deployments need updates to 16.4.1 or 15.5.28 to address separate server component risks.
The details
October 21, 2026 saw a convergence of emergency security disclosures, forcing teams to patch multiple critical infrastructure components simultaneously. According to Cyber Security News, PHP servers faced urgent remediation needs due to the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both flaws carry CVSS scores of 9.2, classified as critical severity, and permit unauthenticated remote code execution under specific configurations.
One defect corrupts memory during out-of-memory operations, while the other allows subsequent requests to access invalid data from prior operations. Researchers demonstrated code execution against Apache mod_php before application code execution began. Cloudflare reported early attack attempts targeting these flaws, though it did not confirm successful compromises. Administrators must deploy the specified PHP versions, restart affected services, and verify that web workers are using the patched build.
Node.js security updates addressed ten vulnerabilities, including four rated high severity. CVE-2026-111497 affects Brotli decompression and enables code execution through out-of-bounds memory writes. Other flaws weaken TLS hostname validation or mishandle DNS names. The patched releases, 26.12.1, 24.22.1 and 22.23.4, also refresh certificate trust following the eMudhra incident. Teams must rebuild container images to ensure deployments include the updated runtime. Updating Node.js alone does not resolve these issues if application dependencies remain outdated.
The context
These runtime updates coincide with critical fixes for Next.js and Apache Tomcat released earlier in October. On October 14, Next.js released patches for remote execution flaws involving React Server Components caching behavior and SVG image processing on Linux systems using glibc. Affected teams must move Next.js deployments to versions 16.4.1 or 15.5.28.
Separately, Apache Tomcat issued eight security fixes, including CVE-2026-101296. This vulnerability allows authentication without the correct password when JNDIRealm uses non-GSSAPI SASL mechanisms. The convergence of these incidents means recovery work for earlier breaches collided with fresh disclosures, complicating remediation efforts for production systems.
What should you do?
- Verify current PHP, Node.js, Next.js and Tomcat versions against the patched lists provided.
- Rebuild container images after updating Node.js to ensure the runtime includes security fixes.
- Restart all affected PHP services and confirm web workers are loading the patched binary.
- Monitor logs for signs of exploitation attempts, particularly unauthorized code execution or authentication bypasses.
For customers and users
Teams should verify whether their infrastructure relies on the affected software versions listed in the advisory. Check internal documentation to identify which services run on PHP, Node.js or Next.js. Review authentication logs for unusual activity, especially around the time of the disclosures. Be cautious of phishing emails claiming to offer emergency patches or support for these vulnerabilities, as attackers often exploit urgency. Ensure that all deployment pipelines include the updated runtime versions before pushing changes to production. Verify that certificate trust stores are refreshed if using Node.js.
What to do and how to stay safe: PHP
- Audit all production servers for the specific PHP, Node.js, Next.js and Tomcat versions mentioned.
- Rebuild and redeploy container images to incorporate the latest Node.js runtime security patches.
- Restart PHP services and verify that web workers are actively using the patched binaries.
- Monitor access logs for anomalies that could indicate exploitation of the disclosed vulnerabilities.
General security guidance from the DataSafe Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which PHP versions contain the fix for PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 address CVE-2026-109618 and CVE-2026-109619.
Does updating Node.js fix the Next.js vulnerabilities?
No, updating Node.js does not update Next.js application dependencies; separate patches are required.
What is the severity of the Brotli decompression flaw in Node.js?
CVE-2026-111497 is rated high severity and allows code execution through memory writes.
