Built by NPCs
Menu

Two critical PHP RCE flaws leaked ahead of a 21 Oct fix; Node.js ships HIGH-severity patches the same day

Week 434 min read
Share
Save

Opens the assistant with a prompt. It asks for a short summary of this story, and for the assistant to remember that you saved it.

TL;DR

PHP will ship fixes for two critical flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) on 21 Oct at 14:00 UTC after details leaked. Node.js released 22.23.4, 24.22.1 and 26.12.1 with HIGH-severity fixes. Laravel runs on PHP, and Next.js, NestJS and Angular tooling run on Node, so each inherits its runtime's risk.

On this page

PHP: two critical code-execution flaws leaked before the fix

Remote code execution (RCE) means an attacker can run commands on the server. PHP's security team announced on 20 Oct a release for 21 Oct at 14:00 UTC fixing two critical flaws, both rated 9.2 on the CVSS v4.0 scale (10 is the maximum), and may ship earlier if attacks start (php.net). Details leaked anyway. watchTowr says the bugs are real and reproduced CVE-2026-109618, and CERT-EU lists both CVEs (CVE-2026-109618 and CVE-2026-109619) as potential unauthenticated RCE.

Reported, not confirmed by PHP: the flaw sits in session.upload_progress, on by default since PHP 5.4, and a crafted upload request triggers it before application code runs. Sansec says every web server on PHP 5.4 or later is exposed. That includes the current releases (8.5.11, 8.4.26, 8.3.35, 8.2.34). Unofficial reports expect fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and none for end-of-life 8.1 and older.

Reports on exploitation conflict. Huntress and watchTowr saw none as of 20 Oct, while Sansec's 21 Oct timeline says Cloudflare reported early attacks and added firewall rules. Exploit bundles circulating online are unverified and may be malware.

Node.js: fixes out for 22, 24 and 26

Node.js released 22.23.4 (LTS), 24.22.1 (LTS) and 26.12.1 (Current) on 21 Oct as security releases, after an advance notice that rated the top severity HIGH. Per the release notes:

  • High: TLS now rejects non-canonical IP addresses (CVE-2026-106069, CVE-2026-106072). DNS lookups validate inputs for null bytes (CVE-2026-105482). A Brotli compression fix (CVE-2026-111497). A TLS IP-normalization regression fix (CVE-2026-105483), in the 24 and 26 releases.
  • Medium: an HTTP agent guard (CVE-2026-105481) and crypto random caches (CVE-2026-106074).
  • Low: a permission-model path check (CVE-2026-106073), plus a zlib ZIP-header fix (CVE-2026-106070) in 26 only.

The releases also update OpenSSL to 3.5.9, c-ares and undici. Node says end-of-life versions are always affected. Per release-schedule write-ups, Node 20 reached end of life on 30 Apr 2026 and Node 25 on 1 Jun 2026, so neither gets a patch. Node 22 is in maintenance until 30 Apr 2027. The notes do not describe how each flaw can be exploited.

Are Laravel, Next.js, NestJS and Angular affected?

Neither advisory names a framework bug. Each framework inherits the risk of the runtime under it, and a PHP flaw does not touch a Node app or the reverse. The Node fixes sit in TLS, DNS, HTTP and compression code that server-side Next.js, NestJS and Angular apps use for requests, though the notes do not say which framework features reach each bug.

Framework Runs on Exposed if
Laravel 12 and 13 PHP 8.2 to 8.5 (13 needs 8.3+) PHP is older than the fixed release
Laravel 11 PHP 8.2 to 8.4 Same, and Laravel's security support ended 12 Mar 2026
Laravel 10 and older PHP 8.1 or lower possible PHP is 8.1 or lower, with no fix expected
Next.js 16 Node 20.9 or newer Node older than 22.23.4, 24.22.1 or 26.12.1, or on Node 20 or 25 (no patch)
NestJS 11 Node 20 or newer Same
Angular 20 to 22 Node ^20.19, ^22.12 or 24+ Same, for build tools, dev server and server-side rendering

Laravel's maintenance mode and middleware run after PHP parses the request, so they do not stop the PHP bugs, per CVE Tools.

What to do

PHP
  1. Find every PHP installCheck the PHP the web server loads, not just php -v: containers, staging, admin tools, hosting panels.
  2. Reduce exposure nowSet session.upload_progress.enabled = 0 and reload. PHP core developers call this a stopgap, and patching the only fix.
  3. Patch at 7:30 PM ISTInstall the fixed version, rebuild Docker images, restart PHP-FPM, queue workers, Horizon and Octane.
  4. Handle old PHP8.1 and older get no upstream fix: move to 8.2+ or ask the distro for a backport.
  5. Look for a break-inCheck since 15:00 UTC on 20 Oct for new .php files, PHP-FPM crashes and shells started by the web user.
Node.js
  1. Find every Node versionnode -v, FROM node: lines in Dockerfiles, CI images, the host's Node setting.
  2. Leave Node 20 and 25Move to 24 (LTS) or 22 (maintenance).
  3. Update to the fixed release22.23.4, 24.22.1 or 26.12.1, depending on your line.
  4. Rebuild and confirmRebuild images, redeploy, and check node -v inside the running service.

Sources

  1. PHP news archive: advance notice and schedule
  2. CERT-EU advisory 2026-018: CVE ids, score
  3. Sansec: php2shell: affected range, timeline
  4. CVE Tools PHP2Shell guide: mitigations, Laravel notes
  5. Huntress: php2shell: exploitation status
  6. Node.js security releases notice: advance notice
  7. Node.js 22.23.4: CVEs, fixes
  8. Node.js 24.22.1: CVEs, fixes
  9. Node.js 26.12.1: CVEs, fixes
  10. Node.js 2026 end-of-life dates: Node 20, 22, 25
  11. Laravel support policy: PHP ranges
  12. Next.js 16 upgrade guide: Node 20.9 minimum
  13. Angular Node.js matrix: Node ranges
  14. NestJS 11 requirements: Node 20 minimum

Continue reading