--- title: "PHP2Shell and Node.js: What to Patch, What to Check" description: "October's PHP and Node.js flaws can expose server memory or allow code execution. Check the affected paths, install the right fixes, and verify what is running." canonical: "https://zainahmed.net/blog/php2shell-nodejs-security-october-2026" published: "2026-10-25" --- # PHP2Shell and Node.js: What to Patch, What to Check > Author: Zain Ahmed > Published: 2026-10-25 > Read Time: 5 min read > Category: Security > Tags: PHP2Shell, Node.js, PHP, Next.js, Security, Incident Response > Canonical URL: https://zainahmed.net/blog/php2shell-nodejs-security-october-2026 ## Excerpt October's PHP and Node.js flaws can expose server memory or allow code execution. Check the affected paths, install the right fixes, and verify what is running. --- A website can check every password correctly and still be exposed before its login code runs. PHP2Shell makes that risk concrete. On October 21, PHP and Node.js released important security fixes. These are separate vulnerabilities with different attack conditions. Both deserve prompt attention. This guide covers what changed, which systems need work, and how to check the result. ## PHP2Shell can reach below your application PHP2Shell covers two critical flaws in PHP's runtime, the engine that executes your application. Both carry a CVSS v4.0 score of 9.2. - **CVE-2026-109618:** A memory allocation failure can interrupt PHP while internal data is only partly initialized. Cleanup can then use that invalid data. - **CVE-2026-109619:** A worker can retain references to memory from a finished request. A later request can use that freed memory. Successful exploitation can allow remote code execution: an attacker runs code with the web process's permissions. Some paths can also expose sensitive memory. The [PHP security advisories](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) explain the first flaw and the [cross-request state flaw](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp). Apache with mod_php has a demonstrated attack that runs before application code. PHP-FPM also needs patching, although its attack conditions differ. Updating WordPress, a plugin, or a framework does not replace a PHP runtime update. [PHP's release notice lists the affected server setups](https://www.php.net/archive/2026.php#2026-10-21-5). Cloudflare has [observed attack traffic](https://blog.cloudflare.com/php-vulnerabilities-waf-protection). Its web application firewall adds protection, but the company still tells users to patch PHP. ## Node.js needs a different exposure check Node's **CVE-2026-111497** affects the bundled Brotli decoder. Brotli is a compression format. Malformed compressed data can write outside an internal buffer, potentially causing a crash, memory disclosure, or code execution. The key condition is specific: attacker-controlled Brotli data must reach decompression through `node:zlib`. Check upload processors, proxies, and services that decode untrusted content. Merely running a Node server does not establish that path. Node rates the issue **High**. The same release also fixes DNS and TLS validation problems, so update even if you find no Brotli exposure. [Node's advisory gives the conditions and fixed releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). For Next.js users, the runtime update is only part of the work. The October 14 framework release fixes critical issues involving Cache Components and SVG image optimization. The SVG code-execution condition concerns glibc-based Linux. Vercel advises affected Cache Components users to upgrade even without an obvious matching function. [Check the Next.js advisory](https://nextjs.org/blog/nextjs-security-update-october-14-2026). ## Install the fixes for your branch These are the minimum upstream releases for the fixes discussed here, checked on October 25, 2026. Use a newer supported patch release when available. | Component | Fixed upstream releases | | --- | --- | | PHP | 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12 | | Node.js | 22.23.4 · 24.22.1 · 26.12.1 | | Next.js | 15.5.28 · 16.4.1 | A Linux vendor may backport a fix without adopting these upstream version numbers. Check its package advisory. For managed hosting, ask the provider to confirm the fixes in the deployed build. Older unsupported runtimes need an upgrade or documented vendor coverage. ### PHP has an October 23 follow-up The emergency releases do not cover every related upload-progress risk. PHP's [October 23 notice](https://www.php.net/archive/2026.php#2026-10-23-1) describes **CVE-2026-115560**, pending a regular bugfix release. It requires an unusual setup: session upload progress stays enabled, and application code changes `session.serialize_handler` from `php_binary` or `php_serialize` to `php` before `session_start()`. PHP recommends `session.upload_progress.enabled=0` until that release. Apply the setting in server startup configuration and restart the workers. Applications that never change the handler at runtime can keep the feature enabled, according to PHP. Disabling upload progress does not fix both original PHP2Shell flaws. Hiding error messages does not protect against the stale-state flaw either. Install the runtime patches. ## Check the deployed service 1. **Find the running versions.** Check production workers, containers, and background jobs. Your laptop's runtime does not establish production's version. 2. **Update and deploy.** Update the runtime and affected packages. Rebuild container images and replace running instances. Restart PHP workers after package updates. 3. **Verify the replacement.** Confirm the running image digest and runtime build. Test login, uploads, sessions, and the application's main task. 4. **Review exposed systems.** Investigate unexpected child processes, changed files, unusual outbound traffic, and repeated worker crashes. These are investigation leads, not proof of exploitation. These local checks help with inventory: ```bash node --version npm ls next sharp --all php --version ``` PHP's command-line binary can differ from the web worker. Confirm the web service's package and configuration too. Do not leave a public `phpinfo()` page online. If you find signs of compromise, preserve logs and isolate the affected workload. Replace it from a trusted build and rotate credentials it could access. Installing a patch does not remove an existing attacker. For a hosted site, one question gets you started: “Has the PHP runtime serving my site received the PHP2Shell fixes and the October 23 follow-up mitigation?” Ask for the deployed build and restart confirmation. --- ## Related Endpoints & Navigation - **All Articles**: [https://zainahmed.net/blog](https://zainahmed.net/blog) - **Author Profile**: [https://zainahmed.net/about](https://zainahmed.net/about) - **Machine-Readable LLM Manifest**: [https://zainahmed.net/llms.txt](https://zainahmed.net/llms.txt) - **RSS Feed**: [https://zainahmed.net/feed.xml](https://zainahmed.net/feed.xml)