--- title: "Two critical PHP RCE flaws leaked ahead of a 21 Oct fix; Node.js ships HIGH-severity patches the same day" summary: "PHP will ship fixes for two critical flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) on 21 Oct at 14:00 UTC after details leaked. Node.js released 22.23.4, 24.22.1 and 26.12.1 with HIGH-severity fixes. Laravel runs on PHP, and Next.js, NestJS and Angular tooling run on Node, so each inherits its runtime's risk." description: "Fixed Node.js versions, the PHP flaws awaiting a patch, how Laravel, Next.js, NestJS and Angular are affected, and what to update first." section: "News" published: 2026-10-21T11:45:41.000Z modified: 2026-10-21T12:58:55.000Z canonical: https://builtbynpcs.com/stories/php-critical-rce-leak-node-security-releases-21-oct-2026 publisher: "Built by NPCs" disclosure: "Our team picks every story and reviews it before it goes out; AI helps with research and drafting." topics: ["PHP", "Node.js", "Laravel", "Next.js", "security"] --- # Two critical PHP RCE flaws leaked ahead of a 21 Oct fix; Node.js ships HIGH-severity patches the same day :::callout tone="warning" title="Status as of 21 Oct 2026, 6:30 PM IST (13:00 UTC)" Node.js fixes are out. PHP's release is scheduled for 14:00 UTC (7:30 PM IST) and is not yet published. PHP version numbers below are unofficial until the project posts them. ::: ## PHP: two critical code-execution flaws leaked before the fix Remote code execution (RCE) means an attacker can run commands on the server. PHP's security team announced on 20 Oct a release for 21 Oct at 14:00 UTC fixing two critical flaws, both rated 9.2 on the CVSS v4.0 scale (10 is the maximum), and may ship earlier if attacks start ([php.net](https://www.php.net/archive/2026.php)). Details leaked anyway. watchTowr says the bugs are real and reproduced CVE-2026-109618, and [CERT-EU](https://cert.europa.eu/publications/security-advisories/2026-018/) lists both CVEs (CVE-2026-109618 and CVE-2026-109619) as potential unauthenticated RCE. Reported, not confirmed by PHP: the flaw sits in `session.upload_progress`, on by default since PHP 5.4, and a crafted upload request triggers it before application code runs. [Sansec](https://sansec.io/research/php2shell) says every web server on PHP 5.4 or later is exposed. That includes the current releases (8.5.11, 8.4.26, 8.3.35, 8.2.34). Unofficial reports expect fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and none for end-of-life 8.1 and older. Reports on exploitation conflict. Huntress and watchTowr saw none as of 20 Oct, while Sansec's 21 Oct timeline says Cloudflare reported early attacks and added firewall rules. Exploit bundles circulating online are unverified and may be malware. ## Node.js: fixes out for 22, 24 and 26 Node.js released 22.23.4 (LTS), 24.22.1 (LTS) and 26.12.1 (Current) on 21 Oct as security releases, after an advance [notice](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) that rated the top severity HIGH. Per the release notes: - **High:** TLS now rejects non-canonical IP addresses (CVE-2026-106069, CVE-2026-106072). DNS lookups validate inputs for null bytes (CVE-2026-105482). A Brotli compression fix (CVE-2026-111497). A TLS IP-normalization regression fix (CVE-2026-105483), in the 24 and 26 releases. - **Medium:** an HTTP agent guard (CVE-2026-105481) and crypto random caches (CVE-2026-106074). - **Low:** a permission-model path check (CVE-2026-106073), plus a zlib ZIP-header fix (CVE-2026-106070) in 26 only. The releases also update OpenSSL to 3.5.9, c-ares and undici. Node says end-of-life versions are always affected. Per release-schedule write-ups, Node 20 reached end of life on 30 Apr 2026 and Node 25 on 1 Jun 2026, so neither gets a patch. Node 22 is in maintenance until 30 Apr 2027. The notes do not describe how each flaw can be exploited. ## Are Laravel, Next.js, NestJS and Angular affected? Neither advisory names a framework bug. Each framework inherits the risk of the runtime under it, and a PHP flaw does not touch a Node app or the reverse. The Node fixes sit in TLS, DNS, HTTP and compression code that server-side Next.js, NestJS and Angular apps use for requests, though the notes do not say which framework features reach each bug. | Framework | Runs on | Exposed if | |---|---|---| | Laravel 12 and 13 | PHP 8.2 to 8.5 (13 needs 8.3+) | PHP is older than the fixed release | | Laravel 11 | PHP 8.2 to 8.4 | Same, and Laravel's security support ended 12 Mar 2026 | | Laravel 10 and older | PHP 8.1 or lower possible | PHP is 8.1 or lower, with no fix expected | | Next.js 16 | Node 20.9 or newer | Node older than 22.23.4, 24.22.1 or 26.12.1, or on Node 20 or 25 (no patch) | | NestJS 11 | Node 20 or newer | Same | | Angular 20 to 22 | Node ^20.19, ^22.12 or 24+ | Same, for build tools, dev server and server-side rendering | Laravel's maintenance mode and middleware run after PHP parses the request, so they do not stop the PHP bugs, per [CVE Tools](https://cve.tools/blog/php2shell-cve-2026-109618-cve-2026-109619). ## What to do :::steps title="PHP" - Find every PHP install | Check the PHP the web server loads, not just `php -v`: containers, staging, admin tools, hosting panels. - Reduce exposure now | Set `session.upload_progress.enabled = 0` and reload. PHP core developers call this a stopgap, and patching the only fix. - Patch at 7:30 PM IST | Install the fixed version, rebuild Docker images, restart PHP-FPM, queue workers, Horizon and Octane. - Handle old PHP | 8.1 and older get no upstream fix: move to 8.2+ or ask the distro for a backport. - Look for a break-in | Check since 15:00 UTC on 20 Oct for new `.php` files, PHP-FPM crashes and shells started by the web user. ::: :::steps title="Node.js" - Find every Node version | `node -v`, `FROM node:` lines in Dockerfiles, CI images, the host's Node setting. - Leave Node 20 and 25 | Move to 24 (LTS) or 22 (maintenance). - Update to the fixed release | 22.23.4, 24.22.1 or 26.12.1, depending on your line. - Rebuild and confirm | Rebuild images, redeploy, and check `node -v` inside the running service. ::: :::sources - [PHP news archive](https://www.php.net/archive/2026.php): advance notice and schedule - [CERT-EU advisory 2026-018](https://cert.europa.eu/publications/security-advisories/2026-018/): CVE ids, score - [Sansec: php2shell](https://sansec.io/research/php2shell): affected range, timeline - [CVE Tools PHP2Shell guide](https://cve.tools/blog/php2shell-cve-2026-109618-cve-2026-109619): mitigations, Laravel notes - [Huntress: php2shell](https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities): exploitation status - [Node.js security releases notice](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases): advance notice - [Node.js 22.23.4](https://nodejs.org/en/blog/release/v22.23.4): CVEs, fixes - [Node.js 24.22.1](https://nodejs.org/en/blog/release/v24.22.1): CVEs, fixes - [Node.js 26.12.1](https://nodejs.org/en/blog/release/v26.12.1): CVEs, fixes - [Node.js 2026 end-of-life dates](https://ecorpit.com/hire-nodejs-developers/): Node 20, 22, 25 - [Laravel support policy](https://laravel.com/docs/12.x/releases): PHP ranges - [Next.js 16 upgrade guide](https://nextjs.org/docs/app/guides/upgrading/version-16): Node 20.9 minimum - [Angular Node.js matrix](https://www.herodevs.com/blog-posts/angular-supported-node-js-versions-the-complete-compatibility-matrix): Node ranges - [NestJS 11 requirements](https://tech-insider.org/nestjs-vs-nextjs-2026/): Node 20 minimum :::