Skip to main content
21 October 2026 · Security response

PHP & Node.js flaws.
Get clear.
Get patched.

This check helps you see whether your website is potentially vulnerable to the PHP and Node.js security issues.

Start with a free check of your website’s public clues. If you need help afterwards, we can audit your systems and patch them to the latest compatible, supported versions available. A public check cannot prove that a website is vulnerable or safe.

Check my website for free

Free check · No sign-up · 3 checks per 24 hours

PHP: 2 critical RCE issuesNode.js: 4 high-severity issuesSources reviewed 22 October 2026
Free first look · Powered by our Stack Detector

Is your website potentially vulnerable?

This free check looks for public warning signs of potential exposure to the PHP and Node.js issues. We compare any advertised runtime versions with the 21 October fixes. Hidden versions need a manual review—not an all-clear.

Public page and headers only. No exploit payloads, logins or changes. No sign-up · 3 checks per 24 hours, shared with Stack Detector. Server limit applies per IP address.

What is happening?

Different runtimes.
A shared need to patch.

These are separate sets of vulnerabilities released on 21 October 2026. Exposure depends on your runtime, configuration and application paths—not just the name of your website platform.

PHP / Critical

Code execution without a login.

PHP’s request handling has two memory-safety flaws. Under the right conditions, a remote attacker can execute code without authenticating.

CVE-2026-109618

Out-of-memory corruption: partially initialised request data can be treated as valid. Apache mod_php has a demonstrated pre-application-code attack path.

CVE-2026-109619

Stale global state: a later request can act on memory freed by a previous request. Exploitability depends on the configuration and code path.

WordPress owners: this is a PHP issue, not a WordPress core bug. Updating plugins or WordPress alone does not update the server’s PHP runtime.

PHP’s official release & advice
Node.js / High

Trust checks and decompression.

The Node.js release fixes ten issues in total, including these four high-severity vulnerabilities across the affected supported release lines.

CVE-2026-105482

DNS name handling

Names containing a NUL character can be truncated.

CVE-2026-105483

TLS identity checks

Fullwidth-digit IP hostnames can bypass hostname verification.

CVE-2026-106069

TLS identity checks

Hostnames that loosely resolve as IP addresses can bypass verification.

CVE-2026-111497

Brotli decompression

An out-of-bounds write can allow remote code execution.

The fullwidth-digit issue affects Node 24 and 26; the other three high-severity issues affect 22, 24 and 26. Browser-side JavaScript alone does not establish a vulnerable Node.js server.

Node.js official advisory
Why it matters to your business

The risk is bigger
than a broken page.

Where a vulnerable path can be exploited, the consequences can include unauthorised code, access to data or secrets, altered content and interrupted services. A working homepage is not evidence of a patched server.

That does not mean your site has been breached. It means checking and patching should be a priority.

Customer data & credentials

Compromised application access can put customer information and service credentials at risk.

Unauthorised changes

An attacker may be able to change content or use a compromised application for further activity.

Downtime & recovery

Crashes, emergency shutdowns and recovery work can interrupt enquiries, orders and everyday operations.

The IT Boffins response

One website.
A clear plan.
A fixed-price audit.

For a site that is affected, could be affected, or has no reliable patch evidence, contact us to book an audit. We agree the scope and fixed price before starting, then review and patch the running environment with your authorisation.

  1. 01

    Establish the facts

    Confirm hosting access, the actual running runtime, vendor package revisions and relevant dependencies. Identify the affected paths and any gaps in evidence.

  2. 02

    Prepare & apply fixes

    Check backup and rollback arrangements, then patch the relevant runtime and dependencies to the latest compatible, supported versions available. Coordinate provider-managed updates where needed.

  3. 03

    Test the website

    Check agreed key journeys such as forms, login and checkout where applicable. Verify the running version after deployment—not just the build log.

  4. 04

    Leave a written outcome

    Receive the findings, changes, verification evidence and any remaining actions. If no patch is needed, you still receive the audit and report at the same fixed price.

Clear scope, a fixed price agreed upfront. We confirm access and scope before starting. Hosting/licence charges, major rewrites or migrations, and recovery from an existing compromise are agreed separately before any additional work. If a provider has not released a patch, we document the gap and coordinate verification; we never mark an unverified runtime as fixed.
The patch reference

Check the runtime.
Not just the build.

Minimum upstream versions containing the 21 October fixes, by release branch. Use newer patched versions where available. Distribution packages may carry backported fixes: check the vendor bulletin and full package revision.

PHP security-release minimums
Release branchPatch minimum
8.2.x8.2.35
8.3.x8.3.36
8.4.x8.4.27
8.5.x8.5.12
Official PHP guidance
Node.js security-release minimums
Release branchPatch minimum
22.x22.23.4
24.x24.22.1
26.x26.12.1
Official Node.js guidance

PHP 8.1 and older no longer receive upstream security releases; vendor-backported packages need separate verification. End-of-life Node.js lines are not cleared by this checker. A CDN, WAF, framework name or hidden version is not patch evidence.

Straight answers

Start with
a free check.

Not sure what your site runs on? Enter its address above to see what the public clues reveal.

Check my website for free
Can this free check prove my website is vulnerable?

No. It checks public technology clues and advertised runtime versions against the 21 October 2026 advisories. An affected version banner is a reason to investigate, not proof of exploitability or compromise. Hidden versions, vendor backports and private services require a hosting-level audit.

Does updating WordPress fix the PHP vulnerabilities?

No. These are PHP runtime issues, not WordPress-specific bugs. Your hosting environment needs the relevant PHP patch or a verified vendor backport. Keep WordPress, themes and plugins maintained too, but a WordPress update does not replace a PHP update.

What does a fixed-price audit cover?

An audit of one website, backup and rollback checks, review of its PHP or Node.js runtime and relevant dependencies, patching systems to the latest compatible, supported versions available, key website checks and a written outcome with running-version evidence. We agree the scope and fixed price before starting. If no patch is needed, you still receive the audit and report.

What if the free checker cannot see my runtime version?

That is common and is not an all-clear. With authorised hosting or deployment access, we can inspect the actual running runtime, vendor package revisions and relevant application paths. You do not need to know your stack before enquiring.

Will a firewall or CDN make my website safe?

A firewall can reduce exposure to some attack paths but is not proof that a runtime is patched. We check the origin and running services, not just the public CDN or a successful build.

What if my hosting provider has not rolled out the patch?

We document the gap, coordinate the required hosting update and verify the running version when it becomes available. A patched build-time version is not enough. We do not claim a fix that we cannot verify.

How is the fixed price agreed?

Contact us with your website address to book an audit. We confirm access, scope and a fixed price before work begins. Hosting or licence charges, major application rewrites or platform migrations, and recovery from an existing compromise would be agreed separately before any extra work.

Less guesswork. More certainty.

Could your website
be affected?

Start with a free check of your website’s public runtime clues.

Check my website for free Explore the full Stack Detector

Technical sources: PHP security announcement · PHP Foundation · Node.js advisory · WordPress guidance. Reviewed 22 October 2026. This page addresses these advisories, not every vulnerability in a website.