On October 21, 2026, two of the most widely used pieces of web software shipped urgent security fixes on the same day. The PHP project released patches for two critical flaws now known as PHP2Shell, and the Node.js project shipped its scheduled security release with fixes for 10 vulnerabilities.
If your website runs on WordPress, the PHP fix matters to you, because WordPress runs on PHP. This post covers what happened, who is at risk, exactly what to update, and what we did for the sites we manage.
Not sure if your site is affected? Use the quick check below, or request a free security check and the AIPress team will look for you.
What happened: PHP2Shell
PHP2Shell is the name given to two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated Critical (CVSS v4.0 9.2) and both can allow unauthenticated remote code execution. In plain terms, an attacker who has no login could get a server to run their commands.
According to the PHP security advisory:
- CVE-2026-109618 comes from out-of-memory handling. PHP can be interrupted while request data is only partly set up, and the cleanup step may then treat bad data as valid.
- CVE-2026-109619 comes from stale state. Data from one request can outlive its memory, and a later request on the same PHP worker may use it.
Who is at risk? The PHP team says "all PHP installations serving web requests", including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers the risk highest for mod_php, where an unauthenticated request can trigger the attack before any application code runs.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get updates from the PHP project, so sites on those versions need a vendor backport or an upgrade.
CISA urged organizations to patch immediately. It said it had not observed exploitation at the time of its alert, and that systems that can't be updated, including those still on PHP 8.1 or earlier, should be taken offline until they can be.
Why WordPress sites are exposed
WordPress is a PHP application, so a WordPress site is only as safe as the PHP version its server runs. WordPress.org's own notice is clear on two points:
- The flaws "are not specific to WordPress and affect any server that hosts a PHP application."
- "No WordPress update is required or planned for these issues."
That second point catches people out. Clicking "Update" on WordPress core, your theme or your plugins will not fix PHP2Shell. The fix happens at the server level, which is usually your web host's job. Many managed hosts are already rolling out patches or firewall rules, but you should confirm rather than assume.
What happened: Node.js
Also on October 21, Node.js published its October 21, 2026 security releases for the 22.x, 24.x and 26.x lines. The release fixes 10 CVEs. The highest severity is High, and there are no Critical issues. The ones most worth knowing about:
- CVE-2026-111497 (High): a Brotli decoder out-of-bounds write that "permits remote code execution". It affects 22.x, 24.x and 26.x.
- CVE-2026-105483 and CVE-2026-106069 (High): two ways to bypass TLS certificate hostname checks, which matters for apps that make HTTPS calls to other services.
- CVE-2026-105482 (High):
dns.resolvetruncates names that contain a NUL character.
The rest are rated Medium or Low. The release also updates bundled dependencies, including c-ares, OpenSSL, Undici and the CA certificate list.
The fixed versions are Node.js 22.23.4, 24.22.1 and 26.12.1. The Node.js team also notes that "End-of-Life versions are always affected when a security release occurs." Node 18 and Node 20 are both past end of life, so they will not get these fixes.
Who is at risk? Anything that runs Node.js while handling real traffic: server-rendered sites, serverless functions, APIs and backends. Sites that only use Node to build static pages have far less exposure, but they should still move off end-of-life versions.
Check your own website: are you affected?
Most small business sites that are exposed to PHP2Shell run on WordPress. Here's how to tell in a few minutes.
1. Is your site built on WordPress? Any one of these is a strong sign:
- Adding
/wp-adminor/wp-login.phpto the end of your web address brings up a WordPress login page. - When you view the page source in your browser, you see
wp-contentorwp-includes. - You or your web person log in to a WordPress dashboard to edit the site.
If you can't tell, ask whoever built or hosts your site: "Is our site on WordPress or PHP?"
2. If it's WordPress or PHP, find your PHP version. In WordPress, open Tools > Site Health > Info > Server. Your hosting control panel usually shows it too.
3. Compare it to the fixed versions. You're patched if you're on 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer on the same branch. If your version is older on its branch, or is PHP 8.1 or older, your site is exposed.
4. If you're exposed or unsure, act now. Contact your host and ask them to confirm, in writing, that PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is patched on your plan. If your host can't confirm it, the checklist below covers what to do next.
Not on WordPress? If your site runs on Node.js (for example a Next.js app or serverless functions), check that it's on Node.js 22.23.4, 24.22.1 or 26.12.1, or newer.
Want us to check it for you? Request a free security check. The AIPress team will tell you what your site runs on, whether it's patched, and what to do if it isn't. There's no cost and no obligation.
What to do now
WordPress and PHP checklist
- Find your PHP version. In WordPress, go to Tools > Site Health > Info > Server. Your hosting panel usually shows it too.
- Compare it to the fixed versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Anything older on the same branch is exposed.
- Ask your host directly whether PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is patched on your plan, and get the answer in writing.
- Manage your own server? Install your distribution's updated PHP packages or build from source, then restart PHP-FPM or your web server so the new version actually loads.
- On PHP 8.1 or older? You are past upstream support. Get a vendor backport or upgrade to a supported branch. If you can't do either soon, follow CISA's advice and take the site offline until it's fixed.
- Don't rely on workarounds. PHP lists some configuration changes that reduce specific attack paths, but says plainly that they "do not make an installation safe". Updating is the fix.
- Then do the usual hygiene. Keep WordPress core, themes and plugins current. It won't fix PHP2Shell, but it closes the other doors.
Node.js upgrade checklist
- Find every place Node runs: your server, serverless functions, build settings (
.nvmrc,NODE_VERSION,enginesinpackage.json) and CI workflows. - Upgrade to a fixed release: 22.23.4, 24.22.1 or 26.12.1.
- Move off Node 18 and 20. They are end-of-life and will not be patched.
- Pin the exact version in your build settings so you can prove which build you are running.
- Redeploy, then confirm the new version in your build log or by logging
process.versiononce from a function. - Do runtime first. Servers and functions that handle live traffic come before build-only sites, but don't leave the build-only ones behind.
What AIPress did
Within 24 hours of the October 21 releases, we checked every client site we manage and finished the Node.js upgrades.
PHP2Shell: no client site was exposed. None of our client sites run PHP or WordPress. We confirmed that in the code (no PHP files or WordPress installs in any site repository) and on the live sites (none serve PHP, and the usual WordPress login and API addresses don't exist on them).
Node.js: upgraded. Our sites use Node.js, and by the morning of October 22 we had moved them to the patched 22.23.4 release. Anything that runs Node while serving visitors went first, and static sites, which only use Node to build pages, were upgraded in the same wave.
Why our stack makes days like this smaller
We build most client sites as static sites on Netlify. The pages are built ahead of time and served as plain files from a global CDN. There is no PHP runtime, no WordPress admin login and no plugin folder for an attacker to reach. That is why PHP2Shell was a non-event for our clients: the software it attacks simply isn't there.
It doesn't mean "nothing can ever go wrong." Node.js still runs at build time, and a few sites use small serverless functions. Advisories like the Node.js release still apply to us, and we still have to act on them. The difference is scale. A small attack surface means there are fewer things to patch, they're easier to find, and the fix is usually a one-line version change and a redeploy, not an emergency weekend with a plugin-heavy WordPress install. We wrote more about that tradeoff in WordPress Security Breaches: What Business Owners Must Know.
Security patching is part of the service, not a billable extra. When an advisory affects a stack we run, our team checks every client site, upgrades what needs it and verifies the result on the live site. You don't have to read CVE bulletins or ask your developer whether you're affected. We tell you.
If you're on WordPress and tired of patch days, our WordPress to static migration guide shows what moving looks like, including how to keep your SEO intact.
Get a free site security check
Not sure what your site runs on, or whether your host has patched it? Request a free audit. The AIPress team will check your platform and PHP or Node version, flag anything that's unpatched or end-of-life, and show you what a smaller attack surface would look like for your business.
FAQ
Does PHP2Shell affect my WordPress site?
If your site runs on PHP, which every WordPress site does, it is exposed until your server runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a vendor build with the fix). WordPress.org says no WordPress update is required or planned. The fix is a PHP update.
Will updating WordPress or my plugins fix PHP2Shell?
No. The flaw is in PHP itself. Updating WordPress core, themes or plugins is still good hygiene, but only a patched PHP closes these two holes.
Which Node.js versions fix the October 21, 2026 vulnerabilities?
Node.js 22.23.4, 24.22.1 and 26.12.1, per the Node.js advisory. End-of-life lines such as Node 18 and Node 20 get no fix, so move them to a supported line.
Were AIPress client sites affected by PHP2Shell?
No. We checked every client site and none run PHP or WordPress. For the Node.js fixes, we moved our sites to the patched Node.js 22.23.4 release within 24 hours of the October 21 advisories.
How do I get a security check for my site?
Request a free audit. The AIPress team will check what your site runs on, whether it is on a patched version, and what it would take to shrink its attack surface.