"The gate you forgot you built is the one the storm finds first." Professor Synapse
On October 21, 2026, Node.js and PHP both released security patches for flaws that can let an attacker run code on a server. The same week, eight certificate authority keys from eMudhra turned out to be guessable. The quickest way to learn whether any of this touches you is to ask an AI agent that can read your code and log in to your servers to take inventory, compare what it finds with the fixed versions, and give you a report before it changes anything. Our prompt for that is below.
What changed this week
Node.js security update: ten fixes, four rated High
On October 21, the Node.js project released versions 22.23.4, 24.22.1 and 26.12.1, fixing ten vulnerabilities. The most serious, CVE-2026-111497, is a bug in the Brotli decoder (the code that unpacks compressed data) that permits remote code execution. Two others let a website certificate pass a hostname check it should fail. The release also updates Node's built-in list of trusted certificates to block the eMudhra certificates described below.
End-of-life versions, such as Node 20, are affected too and receive no fix. If you are on one of them, the update is a move to a supported line.
PHP vulnerabilities: "PHP2Shell"
On the same day, PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619, which researchers nicknamed PHP2Shell. Both are rated 9.2 out of 10 and allow remote code execution without a login. PHP says the risk is highest for servers that run PHP inside Apache (mod_php). Security firms reported the first exploitation attempts as the patches landed.
To update your PHP version, move to one of those four releases. PHP 8.1 and older no longer get fixes from the PHP project. If you cannot update today, php.net lists partial mitigations, such as turning off session.upload_progress.enabled in php.ini and restarting PHP, but it is clear that updating is the only complete fix. If a host runs your WordPress site, ask them which PHP version you are on.
Certificates: a breach and a deadline
Eight intermediate certificates from the Indian certificate authority eMudhra had private keys so weak that anyone could work them out from the public certificate. Six were for websites and two for signing code. A researcher reported it on October 17, and Chrome, Firefox, Apple and Microsoft blocked the certificates by October 20.
Browsers already block them. The remaining risk is software that carries its own copy of the trusted list: older Node.js versions, Go programs (Go 1.26.10 and 1.27.3 shipped certificate fixes on October 19), Python's certifi package, old containers, and devices that never update.
The deadline is about renewal. Public certificates have been capped at 200 days since March 15, 2026, dropping to 100 days in March 2027. Let's Encrypt moves its default to 64-day certificates on February 10, 2027 and asks anyone whose renewal is hard-coded to a fixed number of days to renew at about two-thirds of the certificate's lifetime instead.
Why hand this to an agent
Updating is rarely the hard part. Finding every place a version hides is. Node or PHP can be pinned on your laptop, in a version manager, in a Dockerfile, in a test workflow, on a server, and in a hosting dashboard, and each can say something different.
An AI agent that can read files and run commands, such as Claude Code or Codex, can sweep all of those places in a few minutes and check each one against the list of fixed versions. Our prompt makes it look first and change nothing until you approve a plan.
Before you paste the prompt
- An agent that can run commands on your computer. A chat assistant in a browser cannot see your files or servers.
- The folder where your code lives.
- Server access, if you have servers. The agent uses the SSH access you already have. For hosting platforms such as Vercel, Railway or a WordPress host, it tells you what to check in the dashboard.
- Your list of domains.
- About 20 to 30 minutes.
The prompt
Copy everything in the box, fill in the "My setup" lines, and paste it into your agent as one message.
You are helping me check whether my code and servers need this month's security patches. I am not a security expert, so explain each finding in one plain sentence.
RULES
- This is a read-only audit. Do not install, upgrade, restart, redeploy or edit anything until I approve a written plan.
- Never print passwords, API keys, tokens or the contents of .env files. If you find a secret, tell me only where it is.
- Only connect to the servers I list below, and only run commands that read.
- If you cannot check something, say so. Never guess a version.
WHAT CHANGED (as of October 23, 2026)
- Node.js: fixed in 22.23.4, 24.22.1 and 26.12.1 (October 21, 2026). Ten vulnerabilities, four rated High, including remote code execution in the Brotli decoder. Any other line, such as Node 20 or 25, is end of life and gets no fix.
- PHP: fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (October 21, 2026) for CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"), remote code execution without a login. Exploitation attempts have been reported. PHP 8.1 and older get no fix from the PHP project.
- Certificates: eight eMudhra intermediate certificates were compromised (disclosed October 20, 2026). Software that carries its own list of trusted certificates needs updating: Node.js (the versions above), Go 1.26.10 or 1.27.3, Python's certifi package, and the operating system's ca-certificates package.
- Certificate lifetimes are shrinking: Let's Encrypt moves to 64-day certificates on February 10, 2027, and the industry maximum drops to 100 days in March 2027.
- Before you report, check https://nodejs.org/en/blog/vulnerability and https://www.php.net/ for anything newer than this list.
MY SETUP (fill in, or write "none")
- My code lives in: [folder path]
- Servers I can reach over SSH: [user@host, user@host]
- Hosting platforms I use: [for example Vercel, Railway, Render, a WordPress host]
- My domains: [example.com, app.example.com]
STEP 1: THIS COMPUTER
Report node -v and every Node version installed by a version manager (nvm, fnm, volta or asdf), php -v, go version if Go is installed, and the version of Python's certifi package if Python is installed.
STEP 2: MY CODE
For every project in my code folder, find where it chooses a Node, PHP or Go version: .nvmrc, .node-version, .tool-versions, the "engines" field in package.json, the php requirement in composer.json, go.mod, Dockerfile FROM lines, CI workflow files (for example node-version in GitHub Actions) and hosting config files. Flag floating image tags such as node:22 or php:8.3-apache. They only pick up a fix when the image is rebuilt, so tell me to check when each one was last built or deployed.
STEP 3: MY SERVERS
On each server I listed, report: the Node and PHP versions, whether PHP runs inside Apache (mod_php) or as PHP-FPM, the ca-certificates package version, running Docker containers with their image tags and creation dates, and when each service last restarted. For hosting platforms you cannot reach, tell me exactly what to look up in their dashboard.
STEP 4: MY CERTIFICATES
For each domain, connect with openssl and report the issuer, the expiry date and the days left. Flag any certificate issued by eMudhra, anything expiring within 30 days, and any renewal script or scheduled job hard-coded to a fixed number of days. Let's Encrypt recommends renewing at about two-thirds of a certificate's lifetime.
STEP 5: REPORT
Give me one table with these columns: what, where, version found, fixed version, risk (high, medium or low) and the fix in plain words. Put internet-facing PHP and Node services first. Then give me a short plan I can approve one item at a time.
STEP 6: WAIT
Stop and wait for me. When I approve an item, make the change on a separate branch or a staging copy first, run the tests, and show me the result before anything touches production.What happened when we ran it
We ran the same read-only checks on our own computer and code on October 23, 2026. Here is what came back:
- Our workstation was already patched. It runs Node 24.22.1, though an older 24.21.0 was still installed alongside it.
- Our containers were the real finding. Our Dockerfiles use floating tags such as
node:24-bookworm-slimandnode:22-alpine. They pick up the fixed Node only when the image is rebuilt, so any service deployed before October 21 keeps running the old version until it is redeployed. We redeployed ours the same day. - No PHP, so no PHP2Shell. None of our projects use PHP.
- No eMudhra. Our sites' certificates come from Let's Encrypt and Google Trust Services.
Both things worth fixing were in places we had stopped checking: an old Node install and our container images.
When the report comes back
Work through the table in order of exposure:
- Internet-facing PHP on an unpatched version. Exploitation attempts have already been reported.
- Node services that handle data from outside, such as uploads, compressed responses or calls to other sites.
- Trusted certificate lists in containers, Go programs and Python environments.
- Renewal automation, before Let's Encrypt's 64-day change in February 2027.
Approve one change at a time, let the agent test it, and keep the report. Run the prompt again next month with the new list of fixed versions. If you would like a second set of eyes on what your agent finds, book a call with us.
Header image: PHP logo by Colin Viebrock, CC BY-SA 4.0, unmodified, from php.net. The Node.js logo is a trademark of the OpenJS Foundation, used for identification only.
Frequently Asked Questions
What are security patches?
Security patches are updates that close a known weakness in software before attackers can use it. The October 2026 releases of Node.js and PHP are examples. They change little else, so they are usually safe to install quickly once you have tested them.
How do I update Node.js?
Install the fixed release for your line: 22.23.4, 24.22.1 or 26.12.1 as of October 2026. With a version manager such as nvm, run nvm install 24 and switch your projects to it. Then update the Node version in your Dockerfiles, CI workflows and hosting settings, and rebuild and redeploy anything that runs on a server.
Is PHP vulnerable right now?
PHP released before October 21, 2026 is affected by the PHP2Shell flaws, and exploitation attempts have been reported. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, so update to one of them or ask your host to. PHP 8.1 and older no longer receive fixes from the PHP project, so plan a move to a supported version.
When should system security updates and patches be applied?
Apply patches for flaws that are being exploited, or that allow remote code execution, within days, starting with internet-facing systems. Test on a staging copy first when you can. Lower-risk fixes can wait for your regular update cycle.
Do I need to do anything about the eMudhra certificate compromise?
If you only use a browser, no: Chrome, Firefox, Apple and Microsoft blocked the certificates by October 20, 2026. If you run servers or software, update the Node.js, Go, Python certifi and operating system certificate packages that carry their own trusted list. If your own site uses an eMudhra certificate, replace it.
