Patch the October PHP and Node.js flaws before attackers do

By the end of this guide, every server you run PHP or Node.js on, and anything else that carries the Brotli decompression library, will be on a fixed version and restarted, and you'll have checked that the fix is the one actually running.

Who it's for

IT staff, or the person who looks after your website, web apps or servers, at a small or mid-size organization. If your website runs on WordPress or other shared hosting, the host does most of the patching, but step 1 still applies: find out what you have, then ask the host for proof that it's patched. Plan on an hour or two, plus a short restart window for each server.

Why bother: on 21 October 2026, PHP and Node.js both released urgent security updates. The two PHP flaws (CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell") let an attacker take over a web server without logging in, and security researchers have seen attacks since the day they were announced. The Node.js flaw (CVE-2026-111497, "Node2Shell") is in Brotli, a common compression format. A booby-trapped compressed upload or download can crash the program, leak its memory, or in some cases let an attacker run their own code. No attacks using the Brotli flaw had been reported as of 23 October, but researchers have already shown it working. The same Brotli code also ships in other software, not just Node.js.

Steps

1. Find everything that runs PHP or Node.js

   List your websites, web apps and servers, and write down which language each runs on. PHP powers WordPress, Drupal, Joomla, Nextcloud, Laravel apps and most hosting control panels. Node.js powers many modern web apps, APIs and self-hosted tools such as n8n, Umami and other dashboards. Don't forget software running in Docker containers: each container image has its own copy of PHP or Node.js, separate from the server it runs on. On a Linux server, these commands show what's installed:

   php -v
   node -v
   docker ps --format '{{.Image}}  {{.Names}}'

2. Update PHP first, because it's under attack

   The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Install the update from the same place PHP came from: your Linux package manager (sudo apt update && sudo apt upgrade or sudo dnf upgrade), the official Docker image, or your host's control panel. Linux distributions often patch older versions without changing the version number, so if php -v still shows an older number, check your distribution's security notice for CVE-2026-109618 before you assume you're unpatched. PHP 8.1 and older no longer get fixes from the PHP project. For those, you'll need a patched build from your distribution or hosting vendor, or an upgrade to a supported version.

3. Restart every PHP worker

   Updating the files isn't enough: the old, vulnerable code keeps running until the process restarts. Restart PHP-FPM and your web server, for example sudo systemctl restart php8.3-fpm (use your version number), plus sudo systemctl restart apache2 if you use Apache with mod_php. Apache with mod_php carries the most risk, because the attack can succeed before any of your website's own code runs. For Docker, pull the new image and recreate the container: docker compose pull && docker compose up -d.

4. Update Node.js

   The fixed releases are 22.23.4, 24.22.1 and 26.12.1. The same release also fixes nine other flaws, including several in how Node.js checks secure (TLS) connections, so it's worth installing even if you think you don't use Brotli. Node.js 20 and older have reached end of life and will not be fixed, so move those apps to 24 or 26. For apps you build into containers, update the FROM node:… line or pull the latest tag, rebuild the image, and redeploy. Then restart the app. Apps that fetch content from other websites, or that accept compressed uploads (Express 5, self-hosted Next.js image handling), are most exposed, so do those first.

5. Look for other copies of Brotli

   The bug is in Google's Brotli library itself (fixed upstream in 1.0.10, 1.1.1 and 1.2.1), so other software that includes Brotli needs updating too. Run your normal operating-system updates so the system Brotli library (libbrotli) is patched. Check Python projects with pip list | grep -i brotli and upgrade the Brotli or brotlicffi package. Update Bun to 1.4.4 or later. For appliances and commercial software, check the vendor's security page for CVE-2026-111497. Some vendors were still working on fixes this week.

6. If you can't patch today, reduce the risk

   For PHP, the project publishes temporary settings that make the attacks harder: in php.ini or the FPM pool file (not .user.ini or ini_set()), set session.upload_progress.enabled = 0, post_max_size = 8M and memory_limit = -1, then restart the workers. PHP says plainly that these settings do not make a server safe. If a PHP server can't be updated, take it off the internet or put it behind a VPN until it can. Node.js has published no workaround, so update as soon as possible, and in the meantime avoid decompressing Brotli data from sources you don't control.

Common mistakes

• Updating without restarting. PHP-FPM workers and Node.js apps keep running the old code until they restart.
• Patching the server but not its containers. Each Docker image carries its own PHP or Node.js. Rebuild or pull it, then recreate the container.
• Checking the wrong PHP. The command-line php and the PHP-FPM your website uses can be different versions. Check the one that serves web pages.
• Assuming an old version number means you're unpatched, or the reverse. Distributions backport fixes, so check the package against the vendor's notice rather than the version number alone.
• Staying on end-of-life versions. Node.js 20 and PHP 8.1 or older get no fix from the project. Plan the upgrade now, because the next flaw won't be fixed either.