On October 21, 2026, the global software development community had to deal with two major security alerts at the same time: the PHP2Shell vulnerabilities in PHP and an urgent security release for Node.js. This article summarizes the situation, what Haposoft has done for the systems we operate, and what businesses should check right away.

1. What happened?

PHP2Shell (CVE-2026-109618, CVE-2026-109619) consists of two vulnerabilities that allow an attacker to execute arbitrary code on a server with a single request, without any authentication. Both are rated 9.2/10 on the CVSS v4.0 scale.

• The vulnerabilities affect almost all PHP versions from 5.4 onward.
• The researchers demonstrated successful attacks against many popular platforms, including WordPress, Laravel, Magento, Drupal and phpMyAdmin.
• Real-world attacks were observed shortly after the patches were released.
• PHP has released fixes for versions 8.2 to 8.5. PHP 8.1 and older are end-of-life: the PHP team has released only source-level backport patches for 7.4, 8.0 and 8.1 (which must be rebuilt); older versions receive no fix from PHP, although some vendors such as Ubuntu Pro provide backported patches.

At the same time, Node.js released patches for several vulnerabilities, most notably a flaw in its Brotli decompressor (CVE-2026-111497) and two TLS hostname verification bypasses, all rated High. Node.js 20 is end-of-life and was not patched.

For Python, there is currently no comparable emergency. However, systems running older versions (3.10 and below) should be scheduled for an upgrade.

2. How did Haposoft respond?

As soon as the PHP project (PHP Foundation) issued its advance notice of the security release on October 20, Haposoft activated its response process for all projects in operation:

• Full system review: we inventoried the PHP version, operating system and hosting environment of every project, covering both production and staging environments.
• Proactive client notification on October 21, with a risk assessment and a tailored recommendation for each system.
• Patching as soon as fixes were released (21:00 on October 21, Vietnam time): systems running PHP 8.2 to 8.5 were upgraded to the latest patched versions overnight on October 21 and on October 22.
• Flexible handling of older versions: applying backported fixes for PHP 7.4 / 8.0 / 8.1 where possible; rebuilding PHP from source when needed; coordinating with hosting providers for websites on shared hosting.
• Temporary protection where immediate patching was not possible: restricting access (authentication or IP allowlisting) so requests are blocked before they reach PHP.
• Suspending services at our clients' decision for systems running versions too old to be patched. This is the safest way to protect client data while an upgrade is planned.
• Reviewing Node.js and Python projects in parallel to plan the next round of updates.

Response by PHP version

PHP version	Response
8.2 – 8.5	Upgrade to the official patched release (8.2.35 / 8.3.36 / 8.4.27 / 8.5.12)
7.4 / 8.0 / 8.1	Apply the official source-level backport patch from PHP (requires a rebuild) or a vendor-provided fix, and plan an upgrade
7.3 and older	No fix from PHP: apply a vendor fix where available (e.g. Ubuntu Pro); otherwise temporary protection or suspension, followed by an upgrade
Shared hosting	Work with the hosting provider to confirm and apply the update

As of October 22, every system in operation under Haposoft's management has been patched, placed under temporary risk-mitigation measures, or suspended in agreement with the client. For suspended projects, Haposoft continues to work alongside our clients to plan the upgrade and safely restore services as soon as possible.

3. What should businesses do now?

If your business runs a website or system built with PHP or Node.js, check the following right away:

1. Current version: the patched releases are PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 (per branch) and Node.js 22.23.4 / 24.22.1 / 26.12.1. If your system is running a version below these, it has not been patched: update immediately or contact Haposoft for prompt support.
2. End-of-life software: Are you running PHP 8.1 or older, Node.js 20, or Ubuntu 20.04? If so, plan an upgrade immediately.
3. Shared hosting: Contact your hosting provider to confirm they have applied the updates.
4. Signs of compromise: Look for unknown files in website directories, new admin accounts, or unfamiliar scheduled tasks (cron jobs).

4. Need help? Contact Haposoft

If you are not sure whether your systems are affected, or you need help checking, patching or upgrading PHP, Node.js or your operating system, Haposoft's engineering team is ready to help. For systems not built by Haposoft, our engineers will assess them and propose a suitable upgrade plan.

Contact: contact@haposoft.com

Facebook: https://www.facebook.com/haposoft