Patch reference
| Severity | What | Fix |
|---|---|---|
| Critical | PHP2Shell, 21 Oct | PHP 8.5.12 8.4.27 8.3.36 8.2.35 |
| Critical | Laravel TokenGuard, 19 Oct | laravel/framework 13.29.0 12.68.0 |
| High | Node.js, 10 CVEs, 21 Oct | Node 26.12.1 24.22.1 22.23.4 |
| Not rated | eMudhra CAs, 17–20 Oct | Node 26.12.1 24.22.1 22.23.4composer/ca-bundle 1.6.0 1.4.16Go 1.27.3 1.26.10 |
| Critical | Next.js RCEs, 14 Oct carried over | next 16.4.1 15.5.28 |
| Not rated | Symfony, 3 DoS, 15 Oct carried over | symfony/* 7.4.21 6.4.48 8.1.9symfony/yaml 7.4.18 |
What happened this week
PHP2Shell: two critical PHP RCEs
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated RCE on every branch before its fix; mod_php is the most exposed.
Do thisupgrade PHP to the fixed release for your branch, then restart every PHP process.
Exploitation and stopgaps
- The PHP project reports a demonstrated exploit against
mod_php. Media reports describe an early leak and early attack attempts; public proofs of concept are disputed. - Official stopgaps until you can patch:
session.upload_progress.enabled=0in php.ini or the FPM pool (restart workers);memory_limit=-1set where apps cannot override it, such asphp_admin_value, with a container memory limit kept as the real ceiling; andpost_max_sizeat 8M (32M with uploads). PHP says these do not make an install safe. - No releases for 8.1 or older; the PHP team published source backports for 7.4–8.1.
Sources php.net · GHSA-w8hw-w9fx-j79w · GHSA-6wmf-4rv5-p3rp · Tenable and Sansec (media and vendor research)
Laravel TokenGuard authentication bypass
On MySQL or MariaDB, a crafted token can log in as another user through the built-in token API guard (CVE-2026-114509); there is no workaround.
Do thiscomposer update laravel/framework to the fixed 13.x or 12.x release.
Sources GHSA-f9x3-7vq9-cph6 · Laravel support policy
Node.js October security release
Four High fixes, including a Brotli decoder RCE and two TLS hostname-check bypasses; end-of-life lines such as Node 20 get none.
Do thismove to the patched release of your line, rebuild images with --pull, and restart.
Sources nodejs.org · Electron releases (Navide desktop)
eMudhra CA compromise: refresh trust stores
Browsers blocked eight eMudhra intermediates whose private keys anyone could compute; tools with their own CA list still trust them until updated.
Do thisupdate Node to 26.12.1, 24.22.1 or 22.23.4, composer/ca-bundle to 1.6.0 or 1.4.16, Go to 1.27.3 or 1.26.10, and your image's ca-certificates.
Sources Mozilla · Google · Cloudflare · Node.js commit · composer/ca-bundle · Go release notes
npm supply chain advice for CLI agent users
- Prefer the native installer for Claude Code and Codex; Gemini CLI has none.
- Install from a lockfile (
npm ci);ignore-scripts=truehelps but is not enough. - Rotate npm, GitHub and cloud tokens after installing a bad version.
npm incidents to check (4)
| When | Incident | Check |
|---|---|---|
| 8 Oct | tensorlake 0.5.144 |
Use 0.5.145 |
| 2 Oct | Trusted Publishing flaw | Maintainers: re-check settings |
| 6 Aug | Shai-Hulud in keyv |
Rotate tokens if installed |
| 31 Mar | axios 1.14.1, 0.30.4 |
npm ls axios |
Also: MALFEX · @mastra · binding.gyp worm · node-ipc
Sources Claude Code · Codex · Gemini CLI
One-minute self-check
# Compare each version with the patch table above
$ php -v
$ node -v
$ composer audit --locked
$ npm ls next
# Must FAIL on a patched client
$ curl -sI https://dv-g3b-emudhra.we-have-a-problem.com/