Critical vulnerabilities in PHP, Node.js and Laravel: what to update this week

Between 19 and 26 October 2026, urgent security patches were released for PHP, Node.js and Laravel. The most serious are two PHP flaws that allow unauthenticated remote code execution (CVE-2026-109618 and CVE-2026-109619), which CISA has already confirmed as actively exploited. If your company runs websites or applications on these technologies, the recommendation is to update today to the versions listed below.

PHP: two critical flaws already exploited

On 21 October the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix two vulnerabilities scored CVSS v4.0 9.2 (critical):

• CVE-2026-109618: remote code execution through corruption when handling out-of-memory conditions.
• CVE-2026-109619: remote code execution through internal state that survives between requests.

They affect every installation serving web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. On 26 October CISA added them to its Known Exploited Vulnerabilities (KEV) catalog. PHP 8.1 and earlier no longer receive official releases; you must rely on your distribution vendor's patches or migrate. PHP 8.2 stops receiving patches on 31 December 2026.

On 23 October PHP also issued an informational advisory about CVE-2026-115560, not yet patched, which only applies to applications that change the session serialization handler at runtime; the suggested mitigation is session.upload_progress.enabled=0. On 26 October updated Windows builds including Brotli 1.2.1 were published.

Node.js: ten CVEs fixed

On 21 October Node.js released v26.12.1, v24.22.1 and v22.23.4, which fix ten vulnerabilities. The four rated high are:

• CVE-2026-111497: out-of-bounds write in the Brotli decoder that permits remote code execution.
• CVE-2026-105482: dns.resolve truncates names containing the NUL character.
• CVE-2026-105483 and CVE-2026-106069: bypass of TLS certificate hostname validation.

Three medium-severity and three low-severity flaws were also fixed. End-of-Life versions do not receive patches and must be considered vulnerable.

Laravel: authentication bypass in the token guard

On 19 October Laravel published two advisories for laravel/framework:

• CVE-2026-114509 (critical, CVSS v4.0 9.2): the token-based API guard can be bypassed to authenticate as another user on MySQL and MariaDB. Fixed in 12.68.0 and 13.29.0.
• CVE-2026-114508 (moderate, CVSS 6.5): certain read-only endpoints can trigger data deletion in a related table. Fixed in 12.68.0 and 13.27.0.

Remember that updating Laravel does not fix PHP: both patches are required.

Next.js (previous week)

Although it was published on 14 October, it remains relevant: Next.js 16.4.1 and 15.5.28 fix two critical remote code execution flaws (GHSA-673q-mjm6-r5xr and CVE-2026-96889, the latter tied to the sharp library) and a high-severity denial of service in Server Actions (GHSA-p3m5-59mp-jv5r).

What to do in your company

• Inventory the servers, containers and images that run PHP or Node.js, including those of vendors and test environments.
• Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart all PHP-FPM or Apache workers.
• Update Node.js to 26.12.1, 24.22.1 or 22.23.4 and rebuild container images.
• Run composer update laravel/framework and npm audit to update Laravel and Next.js dependencies.
• If you cannot update immediately, apply the temporary mitigations from php.net, bearing in mind that they do not replace the patch.
• Review access and error logs since 21 October for anomalous activity.
• Plan the migration of unsupported versions (PHP 8.1 or earlier, End-of-Life Node.js).

How IT2S can help

Through its IT Area and the it2sCloud service, IT2S can audit your servers, identify vulnerable versions and apply these patches within a planned maintenance window. If you need support, you can contact us.

Sources

• PHP: October 2026 news and security advisories
• CISA: two known exploited vulnerabilities added to the KEV catalog (26/10/2026)
• Node.js: October 2026 Security Releases
• Laravel: GHSA-f9x3-7vq9-cph6 (CVE-2026-114509)
• Laravel: GHSA-5wcm-3v2w-8362 (CVE-2026-114508)
• Next.js: 14 October 2026 security update

Related services and products

• it2sCloud: Servers, hosting and domains.

Back to news