What To Do Today About PHP2Shell And The Node.js Security Release

🔍 Read the full analysis: What To Do Today About PHP2Shell And The Node.js Security Release on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get smart everyday buys delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP released fixes on October 21 for two critical remote-code-execution vulnerabilities called PHP2Shell, while Node.js fixed ten vulnerabilities in a separate security release that day. The releases matter to website and application operators because a fix protects a system only after its runtime or managed service has been updated and the patched code is serving requests.

The PHP flaws, tracked as CVE-2026-109618 and CVE-2026-109619, were rated Critical with a CVSS v4.0 score of 9.2 each in the project’s advisories. The confirmed impact described there is unauthenticated remote code execution with the permissions of the web worker account. That does not automatically grant root access, but it could give an attacker access to files and credentials available to that account.

PHP’s fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.2 remains supported until December 31, 2026. PHP’s security team also published minimal source backports for versions 7.4, 8.0 and 8.1, which no longer receive regular project updates; operators on those versions should use an appropriate vendor or distribution package, build a backport, or upgrade. The source warns that users of the volunteer-run remirepo repository would not have updates on release day.

The PHP advisory says the exposure includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It describes a demonstrated unauthenticated exploit against mod_php and says the stale-state flaw was validated against mod_php and FPM. It also says a complete FPM exploit for the out-of-memory flaw had not been demonstrated; that is not proof that FPM is immune. Node.js issued fixes across all supported release lines, but the supplied source does not list the affected CVEs or fixed version numbers.

Patch Ownership Across PHP and Node

The practical issue is who operates the vulnerable runtime. A provider may update software it manages, but it generally cannot patch PHP or Node.js versions embedded in a customer’s own application image, virtual machine or deployment package. A service can therefore remain exposed even after a vendor publishes a fix if its owner has not rebuilt and redeployed it.

For PHP, the project says all installations serving web requests are in scope. That includes familiar websites as well as admin panels, document portals, appliances and other products with embedded PHP. Small organisations may not recognise those tools as PHP systems, so checking only the main public website can miss other exposed services. The potential access is tied to the web worker’s permissions, making the account’s access to site files, configuration and database credentials relevant.

The Node.js release broadens the day’s maintenance work beyond PHP. Node.js is used in web back ends and other applications, but the available source provides no vulnerability-by-vulnerability detail. Operators should consult the Node.js release guidance for their specific branch rather than infer affected components or severity from the count of ten fixes.

What the October 21 Releases Cover

The PHP project announced its planned security release on October 20, saying it would address two critical vulnerabilities and was scheduled for 14:00 UTC the next day. The subsequent advisories assigned CVE identifiers and described the flaws as an out-of-memory corruption issue and a stale-global-state issue. The update is a practical follow-up to earlier reporting, according to the source article, which had discussed PHP2Shell and disruption to Dutch government websites.

Cloud-provider statements distinguish provider-operated services from customer workloads. Google Cloud said its own platform was not vulnerable but that customers running PHP on it could be. AWS similarly said its services were not impacted. Those statements do not mean every application hosted on either cloud is patched: responsibility depends on the specific service and how the customer deployed PHP.

The source gives Google App Engine Standard on PHP 8.2 or newer as an example of a service that patches automatically. It says App Engine Flexible and Google Kubernetes Engine users need to redeploy or rebuild with patched PHP, while Cloud Run protection depends on whether automatic base-image updates are enabled. Marketplace images also require the provider’s update or a PHP update by the customer. The same managed-versus-self-managed distinction is the key check for Node.js deployments.

“two critical vulnerabilities, both rated CVSS v4.0 9.2”

— PHP project pre-announcement, October 20

Deployment Status Still Needs Checking

The release of fixes does not establish that a particular website or application has been patched. Current versions in production are not specified in the source, and the article does not provide a complete list of affected Node.js versions, CVEs, or individual fixes. Teams need to check the official Node.js release notes and identify the versions actually running in their environments.

The PHP advisory’s report that a complete exploit for one flaw had not been demonstrated in FPM is a limited statement about the evidence described there, not confirmation of safety. The source also mentions a separate security incident at hosting platform Railway but says Railway has not linked it to either the PHP or Node.js vulnerabilities. No connection should be assumed on the information provided.

Specific provider coverage can also depend on service configuration, runtime version and whether automatic image updates are enabled. The source does not document every cloud platform or hosting provider, so customers should check their provider’s current guidance rather than assume that hosting on a major cloud automatically patches an application.

Verify Versions and Redeploy

Administrators should first identify every system that runs PHP or Node.js, including bundled software and web interfaces on appliances. They should then confirm the runtime version in the deployed environment, not just on a workstation or in a source repository. For PHP, compare it with the fixed release for the relevant supported branch and follow the distribution or vendor’s instructions where packages are supplied through a vendor.

For customer-managed cloud workloads, the next step is to update the base image or package, rebuild and redeploy the application, and verify that the new version is active. Managed-service customers should confirm which runtime updates the provider applies automatically and whether their specific deployment qualifies. Operators using PHP 8.2 should also plan for its stated end of support on December 31, 2026.

Node.js operators should check the official release guidance for their supported line, apply the listed fix, and redeploy or restart affected services as required. Until those checks are complete, the presence of a published patch is not evidence that a system is protected.

Key Questions

What is PHP2Shell?

PHP2Shell refers to two PHP remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619. PHP’s advisories rate both Critical at CVSS v4.0 9.2 and describe unauthenticated code execution with the web worker account’s permissions.

Which PHP versions include the fixes?

The listed fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For older branches, the source says PHP published minimal source backports for 7.4, 8.0 and 8.1, but those versions no longer receive regular project updates; check your operating-system or support vendor’s package guidance.

Does hosting on Google Cloud or AWS mean PHP is patched?

No. The providers’ statements distinguish their own services from customer-run workloads. Some managed services may update runtimes automatically, while customer-built images, virtual machines and deployments may need an update and redeployment by their operators.

What should Node.js operators do?

Check the official Node.js security release information for the supported release line and fixed version used by your application. The source confirms ten vulnerabilities were addressed on October 21, but does not include the affected CVEs or version numbers.

Source: ThorstenMeyerAI.com