Security advisory · Published 23 October 2026 · By Prasad C G
Between 17 and 21 October 2026, three security issues landed that affect most web stacks. One of them is already being exploited. This page gives you the short version, what to do first, and links to a full guide for PHP and for Node.js.
01 · PHP
Critical · Exploited PHP2Shell: remote code execution in PHP itselfCVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2 each. No login needed.
Patch today →02 · Node.js
High Node.js: Brotli RCE, TLS and DNS fixesTen CVEs, four rated High. No confirmed exploitation yet.
Patch within 48 hours →03 · Certificates
High eMudhra (emSign) CA keys compromisedEight intermediate CA keys can be recovered, so certificates could be forged.
Act this week ↓Are you affected?
Check each row against what you actually run, including servers, containers, CI runners and developer machines, not just production.
| If you run | You are exposed when | You are safe on |
|---|---|---|
| PHP serving web requests | Any version below 8.2.35, 8.3.36, 8.4.27 or 8.5.12 in its branch, and every end-of-life branch (8.1 and older) that has not been patched | 8.2.35, 8.3.36, 8.4.27, 8.5.12, or a distribution package that includes the fix |
| Node.js | 22.x, 24.x or 26.x below the fixed release, and every end-of-life line (18, 20, 25) | 22.23.4, 24.22.1, 26.12.1 or newer |
| A certificate from eMudhra / emSign | It chains to emSign ECC Root CA - G3 or one of the compromised intermediates | A replacement certificate from another CA |
| Any TLS client (apps, scripts, devices) | Its trust store has not been updated to block the compromised intermediates | An updated OS, runtime or CA bundle |
What to do, in order
- Today: PHP. Upgrade every PHP install that serves web traffic, then restart PHP-FPM, Apache or whatever runs PHP so the new binary is actually loaded. Treat any server that was internet-facing and unpatched since 20 October as possibly compromised. PHP guide.
- Within 48 hours: Node.js. Move to 22.23.4, 24.22.1 or 26.12.1 everywhere Node runs, and rebuild container images. Move off Node 18 and 20, which will not be fixed. Node.js guide.
- This week: certificates. Replace any eMudhra-issued certificate before Chrome removes its root, and update trust stores in the software you ship or run.
Key dates
| Date (2026) | What happened |
|---|---|
| 17 Oct | The eMudhra key compromise is reported to the Chrome Root Program. Chrome blocks the affected keys the same evening. |
| 20 Oct | PHP pre-announces two critical fixes. Details of the bugs leak, and a proof-of-concept tool called "PHP2Shell" appears. Google publishes its eMudhra notice. |
| 21 Oct | PHP releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Node.js releases 22.23.4, 24.22.1 and 26.12.1. watchTowr reports PHP2Shell being exploited against its honeypots. |
| 27 Oct (expected) | Chrome removes the emSign ECC Root CA - G3 from its root store. |
01. PHP2Shell Critical
Two memory-safety bugs in the PHP engine let an attacker run code on a server without logging in. They sit in the way PHP sets up and tears down each request, so the application on top (WordPress, Laravel, a custom site) makes no difference. On Apache with mod_php, the PHP team says a working exploit fires before any application code runs at all.
- CVE-2026-109618: running out of memory while request data is half built leaves corrupted state that cleanup later trusts.
- CVE-2026-109619: state from one request survives after its memory is freed and is used by the next request on the same worker.
Both are rated CVSS v4.0 9.2, and exploitation was seen on the day the fixes shipped. Settings changes only reduce the risk; upgrading is the fix. Read the full PHP2Shell guide for affected versions, end-of-life options, stop-gaps and how to check for compromise.
02. Node.js October 2026 security release High
The Node.js project fixed ten vulnerabilities across 22.x, 24.x and 26.x. The four rated High are:
- CVE-2026-111497: an out-of-bounds write in the bundled Brotli decoder that can lead to remote code execution.
- CVE-2026-106069 and CVE-2026-105483: two ways to get past TLS hostname checks when connecting to IP addresses.
- CVE-2026-105482:
dns.resolvesilently truncates names that contain a NUL character.
The same releases update the bundled root certificates and block the compromised eMudhra keys. Read the full Node.js guide for the complete CVE list, where untrusted Brotli data reaches your code, and upgrade steps.
03. eMudhra (emSign) CA compromise High
On 17 October, Google's Chrome Root Program was told that the private keys of eight eMudhra subordinate certificate authorities had been generated with weak randomness. In practice, anyone could recover those keys and issue HTTPS certificates that browsers would trust for any website.
What has already been done
- Chrome blocked the affected keys within two hours using its CRLSet mechanism. No browser update is needed.
- Android received an equivalent block through Google Play Services.
- Google says no certificate chaining to these CAs had been logged to Certificate Transparency before the block, so clients that enforce CT could not have been fooled. Other root stores and software maintainers are rolling out their own blocks; Node.js is one of them.
- Google is removing emSign ECC Root CA - G3 from the Chrome Root Store, expected on 27 October 2026.
What you need to do
- If your sites use an eMudhra or emSign certificate, replace it now. Once the root is removed, Chrome users will see a certificate error.
- Update trust stores on servers, containers and devices: OS packages,
Node.js, Java, and any CA bundle your application ships with (for example, a
cacert.pemin a PHP project or a language-specific certificate package). Rebuild container images so they pick up the change. - Check non-browser clients. Scripts, payment and API integrations, IoT devices and mobile apps with pinned certificates do not get Chrome's protection. They are protected only once their own trust store is updated.
- Review code-signing and mutual TLS. If you trust emSign certificates for signed software or for client certificates, review and remove that trust too.
How TechMaven can help
We run PHP and Node.js in production for clients in the UK, US, EU and Asia. If you need a second pair of hands, we can find every affected server and image, patch and restart them, and check for signs of compromise afterwards. Get in touch and a senior engineer will reply within one business day.
Sources: php.net (opens in a new tab), Node.js October 2026 security releases (opens in a new tab), watchTowr (opens in a new tab), Google Security Blog (opens in a new tab). Accurate as of 23 October 2026. Always confirm versions against your vendor's own advisory before you act.