Critical PHP2Shell Vulnerabilities and Node.js Security Updates: CVE-2026-109618, CVE-2026-109619, and More
Critical security vulnerabilities affecting PHP and Node.js highlight the importance of keeping server software up to date. The PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, associated with PHP2Shell, have been reported as potential remote code execution risks. Meanwhile, Node.js security releases address multiple vulnerabilities affecting supported release lines.
These issues are relevant to server administrators, web developers, hosting providers, and businesses running internet-facing applications.
PHP2Shell: Understanding CVE-2026-109618 and CVE-2026-109619
PHP2Shell refers to two critical PHP runtime vulnerabilities that may allow attackers to execute arbitrary code on vulnerable systems under certain conditions.
Because these vulnerabilities concern the PHP runtime rather than a specific website application, updating WordPress, Laravel, Joomla, Drupal, or another PHP-based application alone may not resolve the underlying issue.
CVE-2026-109618: PHP Memory Corruption
CVE-2026-109618 is associated with an out-of-memory (OOM) handling issue that can result in memory corruption.
Under certain conditions, PHP may encounter partially initialized internal request data when memory allocation fails. Improper handling during cleanup may create an opportunity for exploitation.
Potential consequences include:
-
Remote code execution under affected conditions.
-
Unauthorized access to resources available to the PHP worker.
-
Potential compromise of website files and application data.
CVE-2026-109619: Use-After-Free Vulnerability
CVE-2026-109619 involves stale references to memory that has already been released. If affected internal state is reused incorrectly, memory corruption may occur and potentially allow remote code execution.
Possible consequences include unauthorized code execution, exposure of accessible application data, and compromise of services running under the affected process's privileges.
Both vulnerabilities require administrators to assess the PHP runtime used by their applications and apply the appropriate security fixes.
Affected PHP Versions and Security Updates
The reported security-fixed releases are listed below. Administrators should confirm the applicable vendor advisory and package status before making changes.
| PHP Branch | Reported Fixed Version |
|---|---|
| PHP 8.2 | 8.2.35 or later |
| PHP 8.3 | 8.3.36 or later |
| PHP 8.4 | 8.4.27 or later |
| PHP 8.5 | 8.5.12 or later |
PHP 8.1 and older branches are no longer supported upstream. Operating-system vendors may provide backported fixes, so a distribution's security status cannot always be determined from the upstream version number alone.
PHP-FPM, CGI, Apache PHP handlers, and other deployments should be reviewed to determine which runtime actually processes website requests.
Node.js Security Vulnerabilities in October 2026
Node.js security releases published on October 21, 2026, address vulnerabilities in supported release lines and bundled components.
The reported issues include memory-safety problems, DNS input handling, and TLS certificate hostname validation.
Important Node.js CVEs
CVE-2026-111497 — Brotli Decoder Memory Safety
This vulnerability involves an out-of-bounds write in the Brotli decoder and may present a remote code execution risk under affected conditions.
Applications processing untrusted compressed data should prioritize the relevant security update.
CVE-2026-105482 — DNS Resolution
Improper handling of NUL characters in DNS input may result in incorrect processing of domain names.
CVE-2026-105483 — TLS Hostname Validation
This issue concerns TLS certificate hostname validation involving IP addresses represented with fullwidth digits. It affects the reported Node.js 24.x and 26.x release lines.
CVE-2026-106069 — TLS Hostname Validation
Another hostname validation issue involves hostnames that loosely resolve to IP addresses. The reported affected release lines include Node.js 22.x, 24.x, and 26.x.
The October security updates also address additional issues involving HTTP connections, certificate validation, cryptographic operations, ZIP file processing, and the Node.js Permission Model.
Recommended Node.js Security-Fixed Versions
The reported fixed versions for the October 21, 2026, security release are:
| Node.js Branch | Reported Fixed Version |
|---|---|
| Node.js 22.x LTS | 22.23.4 or later |
| Node.js 24.x LTS | 24.22.1 or later |
| Node.js 26.x Current | 26.12.1 or later |
The affected versions vary by individual vulnerability. Check the official Node.js advisory to confirm the appropriate release for the application and branch in use.
To inspect the installed runtime, run:
node -v
npm -vIf Node.js is installed through a version manager, a hosting control panel, or a third-party repository, ensure the update applies to the runtime actually used by the production service.
How to Update PHP and Node.js
The update procedure depends on the operating system, hosting control panel, package source, and runtime configuration.
Updating PHP on Linux Servers
On supported RPM-based systems, administrators can check available package updates using the relevant package manager. For cPanel and Plesk servers, use the control panel's supported update mechanism and the operating-system vendor's security repositories.
For example:
php -vThis displays the default CLI PHP version, which may differ from the PHP version assigned to a website.
Review every installed PHP branch and verify that the corresponding packages include the required security fixes.
Updating Node.js
Check the current version:
node -v
npm -vInstall the appropriate security-fixed release using the official Node.js distribution or a trusted repository. If a version manager is used, update the version selected by the production application.
Restart or redeploy affected services as required, then confirm the running applications use the updated runtime.
Always review application compatibility and test critical services after upgrading.
Security Recommendations for Server Administrators
To reduce exposure to PHP and Node.js vulnerabilities:
-
Inventory all installed PHP and Node.js versions.
-
Identify applications using vulnerable runtimes.
-
Install the appropriate security updates.
-
Restart or reload services when required.
-
Review web-server, PHP-FPM, and application logs for suspicious activity.
-
Investigate unexpected processes, modified files, or unusual outbound connections.
-
Review application permissions, credentials, and network exposure.
Temporary controls such as access restrictions and request filtering may reduce risk but do not replace security updates.
If a system is suspected of being compromised, investigate the incident and preserve relevant logs. Updating the software alone does not establish that an existing compromise has been removed.
Frequently Asked Questions
What are CVE-2026-109618 and CVE-2026-109619?
These identifiers refer to reported critical PHP runtime vulnerabilities associated with PHP2Shell. Under affected conditions, they may allow remote code execution on vulnerable servers.
Does updating WordPress fix PHP2Shell?
No. Updating WordPress does not automatically update the underlying PHP runtime. The PHP installation or vendor package must also receive the applicable security fix.
Can a firewall prevent PHP2Shell attacks?
A firewall may reduce exposure, but it cannot guarantee protection against a runtime vulnerability. Installing a verified security-fixed PHP release remains the primary remediation.
Why should Node.js applications be updated?
Node.js security releases address vulnerabilities that may affect application availability, memory safety, DNS processing, or TLS certificate validation. Applications should use a supported, security-patched runtime.
How do I verify that a security update is installed?
Check the runtime used by the actual application, compare it with the relevant upstream or vendor advisory, and confirm that the installed package contains the fix. Some Linux distributions backport patches without changing the upstream version to the same number.
Conclusion
PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619, together with the reported October 2026 Node.js security issues, demonstrate why server-side software must be maintained regularly.
Administrators should identify affected runtimes, install verified security updates, validate production services, and investigate any signs of compromise.
Keeping PHP, Node.js, operating-system packages, and application dependencies updated is an essential part of maintaining secure web infrastructure.
