Blog
Critical PHP and Node.js vulnerabilities: what happened, who is affected and what we did.
CategoryCloud and operations
In short. On October 21, 2026, PHP and Node.js shipped security releases on the same day. PHP fixed two critical flaws that allow code execution on the server without logging in, and Node.js fixed ten, four of them rated high. The only complete protection is to update, to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and to Node.js 26.12.1, 24.22.1 or 22.23.4, and to restart the services. At Editando Ideas we have already updated Node.js in our website and client portal, and confirmed that our clients’ PHP sites run patched versions.
What was fixed on October 21?
PHP powers WordPress and a large share of websites; Node.js runs APIs, web applications and many of the tools used to build websites. With both shipping critical fixes on the same day, almost every web stack needed a review.
The official advisories are on php.net and nodejs.org. This post summarizes what they say and what we did with our own systems and our clients’.
Why are the PHP flaws so serious?
The two PHP flaws, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 out of 10 (CVSS v4.0) and can let someone run code on the server without logging in. The first appears when PHP runs out of memory mid-request and later treats half-initialized data as valid; the second, when request data survives in memory that has already been freed and the next request handled by the same process uses it.
The PHP team is explicit: there are no complete mitigations, and updating is the only safe choice. The fixed versions are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35. This branch reaches end of life on December 31, 2026, so plan a move to a newer one.
- PHP 8.1 and older no longer receive fixes: a site on those versions needs a migration, not just an update.
What changes in Node.js, and why isn’t updating packages enough?
The Node.js release fixes ten vulnerabilities across its three supported lines. The most serious, CVE-2026-111497, is in the Brotli decoder bundled with Node.js: malformed compressed input can write past an internal buffer and cause a crash, a memory leak or code execution. Any application that decompresses data it did not produce itself is exposed.
Because the flaw lives in Node.js itself, updating npm packages does not fix it: you have to change the Node.js version. The other three high-severity issues affect certificate and IP address validation. The fixed versions are:
- Node.js 26.12.1
- Node.js 24.22.1 (the latest LTS)
- Node.js 22.23.4
- End-of-life versions are always affected: move to a supported line.
How does this affect the internet?
Flaws that can be exploited without logging in are among the most sought after: all an attacker needs is an unpatched server. That is why hosting providers rolled out fixes within hours, and cybersecurity agencies in several countries issued alerts urging companies to update as soon as possible.
The real risk sits in what nobody reviews: self-managed servers that were set up once and never touched again, sites on unsupported PHP versions, and tools or applications that ship their own copy of Node.js and do not update with the system.
What did we do at Editando Ideas?
We reviewed every place where PHP or Node.js runs, both in our own systems and in the sites we maintain:
- We updated Node.js to 24.22.1 in our website, our client portal and its API. Our automated tests and deployments already use that version.
- We confirmed that our clients’ PHP sites, hosted on Hostinger, run patched versions.
- Our website is published as static pages: it runs neither PHP nor Node.js when someone visits it, so it was not exposed to these flaws.
- We follow the php.net and nodejs.org advisories, and each project records its versions in its own repository, so we always know what needs updating.
What should you check if you run a website or an application?
If you manage your own server, or are not sure who does, this is the minimum checklist:
- Which PHP version your site uses. In WordPress it is under Tools → Site Health → Info → Server.
- Which Node.js version your applications use, including tools that bundle their own Node.js.
- That services are restarted after updating: a process that keeps running keeps the old version.
- If your site runs PHP 8.1 or older, or PHP 8.2, a plan to move to a supported version, tested first in a staging environment.
- A recent backup before you update.