🔍 Read the full analysis: How To Patch And Check Systems For PHP2Shell And Node.js Security Issues on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
PHP released fixes for two critical remote-code-execution flaws known as PHP2Shell on Oct. 21, 2026, while Node.js issued fixes for ten vulnerabilities. Operators must confirm that patched runtime versions are actually deployed; cloud providers patch only services they manage, not every customer-built application or server.
The PHP advisories identify CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. The first involves an out-of-memory error leaving request data partially initialized; the second involves request-owned state remaining after its memory has been freed. The advisories describe the confirmed impact as unauthenticated remote code execution with the permissions of the web worker account. That account may be able to access site files and configuration, including database credentials, but the reported impact does not itself mean an attacker gains root privileges.
Fixed PHP releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.2 is scheduled to reach end of life on Dec. 31, 2026, so operators using it should plan a supported-version upgrade as well as apply the current fix. PHP 8.1 and older no longer receive routine project updates; the security team published minimal source backports for some older branches, while other users are directed to a vendor package or a supported branch. The source material warns that remirepo packages would not be updated on release day.
The PHP advisory says the issue applies to web-serving installations, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. It describes a demonstrated unauthenticated attack against Apache with mod_php before application code runs. The stale-state flaw was validated against mod_php and FPM; the advisory says a complete FPM exploit for the out-of-memory flaw had not been demonstrated. That caveat is not evidence that FPM is immune. Separately, Node.js released fixes for ten vulnerabilities across supported release lines; the supplied material does not list their CVE numbers or fixed version numbers.
Infographic 01 · Which PHP version is safe
Four fixed releases. Everything older needs a plan.
PHP fixed CVE-2026-109618 and CVE-2026-109619 on 21 October 2026. Only these releases, or a vendor package that contains both fixes, close the hole.
| Branch | Fixed release | Status | What to do |
|---|---|---|---|
| 8.5 | 8.5.12 | Fixed | Supported branch |
| 8.4 | 8.4.27 | Fixed | Supported branch |
| 8.3 | 8.3.36 | Fixed | Supported branch |
| 8.2 | 8.2.35 | Fixed, EOL soon | End of life on 31 Dec 2026: plan the upgrade now |
| 8.6 pre-release | 8.6.0 RC4 | Testing only | Release candidate, not for production |
| 8.1 · 8.0 · 7.4 | none | No official release | Minimal source backports in php-src; get a vendor/LTS package or upgrade |
| Older (7.3 and below) | none | Unsupported | BSI: all known versions back to at least PHP 5 are affected. Upgrade |
Distribution and LTS packages may carry the fix under an older-looking version number. Check the changelog for both CVE IDs.
Sources: php.net security advisory (21 Oct 2026); GHSA-w8hw-w9fx-j79w; GHSA-6wmf-4rv5-p3rp; BSI warning v1.1.
Powered by Thorsten Meyer AI
Patch Ownership Across Web Runtimes
The immediate operational issue is patch ownership. A provider may maintain the underlying platform while leaving the customer responsible for PHP or Node.js installed in a custom image, virtual machine or application deployment. A security update only reduces exposure after the relevant version is installed, the service is restarted or redeployed where required, and the running system is checked.
Operators should look beyond obvious websites. PHP can be bundled into content-management systems, admin tools, document portals and network appliances. An organization that does not knowingly manage a PHP website may still have a PHP-based service exposed to requests. Node.js also runs web back ends and other applications, so its same-day fixes warrant a separate inventory and deployment check rather than being overlooked while teams focus on PHP2Shell.
For both runtimes, an inventory should include production and staging systems, containers, serverless functions, third-party appliances and services that may be maintained by another team. Teams should check the runtime actually serving requests, not only a developer workstation or package file. Where compromise is suspected, patching alone does not establish whether an attacker accessed the system; incident response and review of logs and credentials may also be needed.
PHP security patch management tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What the Advisories Say
The PHP project announced on Oct. 20 that an update addressing two critical vulnerabilities was scheduled for the following day. Its advisories describe different failure conditions—partially initialized request data and stale request state—but both identify possible remote code execution. PHP says the web worker’s permissions define the direct access available after execution.
Cloud guidance cited in the source material draws a distinction between a provider’s own services and customer workloads. Google Cloud said its platform itself was not vulnerable, while users running PHP on Google Cloud could be. AWS likewise said its services were not affected. Those statements do not mean customer applications hosted there are patched: responsibility depends on whether the provider manages the runtime or the customer supplies and deploys it.
The source lists Google App Engine Standard running PHP 8.2 or newer as automatically patched, while older versions require an upgrade and redeployment. App Engine Flexible and Google Kubernetes Engine users must redeploy or rebuild with patched PHP; Cloud Run depends on whether automatic base-image updates are enabled. Marketplace images also require the relevant provider or customer update. These examples are specific to the listed services and should not be assumed to describe every cloud product.
“All PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.”
— PHP project security advisory
As an affiliate, we earn on qualifying purchases.
Exposure and Fix Status Still Vary
The supplied information does not provide Node.js CVE identifiers, fixed version numbers or vulnerability-by-vulnerability severity. Operators should consult the official Node.js release notice to identify the correct update for each supported release line; the count of ten fixes alone does not establish that every Node.js deployment has the same exposure.
For PHP, the advisory reports a demonstrated exploit for Apache mod_php and validation of the stale-state flaw against mod_php and FPM, but says a complete FPM exploit for the out-of-memory flaw had not been demonstrated. That statement describes the evidence reported at release, not a guarantee of safety. The material also does not establish whether a particular organization has been attacked or whether every vendor, appliance maker and cloud image has already published a patched package.
A separate Railway security incident is mentioned in the source material, but Railway did not link it to PHP2Shell or the Node.js vulnerabilities. No causal connection should be inferred. The status of individual deployments, managed services and third-party PHP products remains dependent on their providers’ notices and the versions actually running.
web server security update verification tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Verify Deployments and Provider Notices
Operators should first inventory PHP and Node.js deployments, including container images, cloud services and bundled software. For PHP, compare the runtime with the fixed release for its branch and use a supported vendor package where the project no longer provides updates. For Node.js, follow the official release notice for the applicable supported line. Rebuild and redeploy customer-managed images or applications as needed, then verify the version in the live environment and confirm that affected processes have restarted.
Teams should check provider and product advisories for managed services, distributions, hosting control panels and appliances, because publication timing may differ. If a service cannot be patched immediately, operators should apply vendor-recommended mitigations where available and treat them as temporary risk reduction, not a substitute for an update. The supplied material does not specify particular mitigations, so it does not support prescribing a universal configuration change.
After deployment, monitor relevant logs and service health, and review access to sensitive files and credentials if there is reason to suspect exploitation. The next meaningful milestone is confirmation from each operator or vendor that patched code is running—not merely that a fix has been announced. PHP 8.2 users should also schedule migration before its stated end-of-life date, Dec. 31, 2026.
PHP and Node.js security patch kits
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
Which PHP versions contain the fixes?
The listed fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Users of older branches should check their distribution or long-term-support vendor, or move to a supported branch.
Does running PHP-FPM mean a system is safe from PHP2Shell?
No. The advisory says the stale-state flaw was validated against PHP-FPM. It says a complete FPM exploit for the out-of-memory flaw had not been demonstrated, which is not the same as saying FPM is unaffected.
Will a cloud provider patch every customer workload?
No. Provider-managed runtimes may receive automatic updates, but customer-built images, virtual machines and application deployments can require the customer to rebuild, upgrade or redeploy. Check the specific service’s guidance.
What should Node.js operators do?
Review the official Node.js security release for the fixed version on each supported release line, update affected deployments and verify the version running in production. The source material reports ten vulnerabilities but does not give their identifiers or fixed versions.
Does the Railway incident relate to these flaws?
The source material says Railway had a separate security incident and did not link it to PHP2Shell or the Node.js vulnerabilities. A connection has not been established.
Source: ThorstenMeyerAI.com
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
