Security Alert: Important PHP (PHP2Shell) and Node.js Web Vulnerabilities You Should Know About
On October 21, 2026, the PHP and Node.js security teams disclosed critical vulnerabilities, including two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) and a Node.js Brotli decoder flaw (CVE-2026-111497), which allow attackers to execute unauthorized code on affected web servers and applications. Patches are available now. Details: PHP Security Announcement and Node.js Security Releases.
Website owners and developers: take action now.
Update PHP: Upgrade your PHP environment to the latest secure release: 8.2.35, 8.3.36, 8.4.27, or 8.5.12 (or later). If you are running older PHP versions such as 7.4, 8.0, or 8.1, upgrade to a supported PHP release or apply security fixes provided by your operating system vendor or hosting provider.
Update Node.js: Upgrade runtime environments to the latest patched releases: v26.12.1, v24.22.1, or v22.23.4 (or later). Pay immediate attention to applications processing external or compressed (Brotli) data.
Delaying updates could leave your website, APIs, and services vulnerable to attacks, service disruptions, and data theft.
Not sure if you're affected, or need time to safely patch? Use the PHP2Shell Risk Assessment Tool to quickly identify potential exposure, understand your security risk, and get guidance on next steps. If you need immediate protection while testing and deploying updates, deploy TrendLife PHP Vulnerability Web Shielding to protect your website in minutes, adding an adding an instant defense layer with zero code changes or complex server configuration.
Users: what you should do. While these vulnerabilities primarily affect websites and web infrastructure, and website owners must act immediately, consumers should also be prepared:
Change your password if an organization whose website or app you use tells you it was impacted by this issue.
Be vigilant against scammers. Cybercriminals frequently exploit breaking security news. If you receive a text or email claiming a security issue and directing you to a link, don’t click it right away. Go directly to the company’s official site or contact the company another way to verify.
Check your digital health. Make sure your web browsers (Chrome, Edge, Firefox, Safari) and everyday desktop apps (such as Slack and Discord, which rely on underlying web engines) are updated and restarted on all devices.
For more details on affected PHP versions, potential risks, and recommended protection measures, visit the TrendLife Support articles for PHP and Node.js.
