Two critical PHP RCE flaws leaked ahead of a 21 Oct fix; Node.js ships HIGH-severity patches the same day
PHP will ship fixes for two critical flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) on 21 Oct at 14:00 UTC after details leaked. Node.js released 22.23.4, 24.22.1 and 26.12.1 with HIGH-severity fixes. Laravel runs on PHP, and Next.js, NestJS and Angular tooling run on Node, so each inherits its runtime's risk.
4 min read