Three Critical Disclosures in One Week: PHP, Node.js, and GitLab

Overview

This week brought critical security releases for three of the most widely deployed pieces of web infrastructure. On October 21, 2026, PHP released emergency security updates for two critical vulnerabilities in the PHP core interpreter, CVE-2026-109618 and CVE-2026-109619. On the same day, the Node.js Project released coordinated security updates for every active release line (26.x, 24.x, and 22.x) to address 10 CVEs. GitLab also released urgent fixes for CVE-2026-110264, which carries the maximum CVSS score of 10.0 and affects both Community and Enterprise Edition.

Averlon is offering free scanning for these CVEs across your cloud infrastructure. Sign in here →

To help the community detect and remediate these issues, we are offering our product for free for a limited time. This is our way of helping defenders at a time when attackers have an unfair advantage.

About the Disclosed CVEs

PHP: CVE-2026-109618 and CVE-2026-109619 (“PHP2Shell”)

Both are rated CVSS v4.0 9.2 and can allow unauthenticated remote code execution on PHP installations serving web requests. The first is triggered when out-of-memory handling interrupts PHP mid-request. The second is caused by stale request state that a later request on the same worker can reuse. Researchers from Wiz, OpenAI, and Calif disclosed the flaws jointly. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

References: Wiz Research, Calif

Node.js: CVE-2026-111497

This is a high-severity flaw in Node’s bundled Brotli decoder: a Node.js process that decodes attacker-supplied Brotli data can be made to leak memory or run arbitrary code. It is easy to trigger because fetch() and Express 5 auto-decompress Brotli responses. It was reported by mcollina and is fixed in v22.23.4, v24.22.1 and v26.12.1.

Reference: Vercel

GitLab: CVE-2026-110264

An integer overflow while compiling a specially crafted regular expression could let an unauthenticated attacker execute code on a self-managed GitLab server. It affects every version back to 7.0, released in 2014. It was reported by the researcher joaxcar. If you patched for the October 12 critical release, you are still in range for this flaw.

Reference: GitLab

How to Assess Impact

PHP

OpenAI published an open-source checker, php2shell-checker, that tells you whether a website or local PHP binary is running a vulnerable version.

Node.js and GitLab

Onboard your cloud accounts, and Averlon identifies every instance running an affected version. From there:

1. Averlon maps your network architecture so you can see how each vulnerable instance is exposed.
2. Averlon scopes the blast radius of each vulnerable instance, so you can see what an attacker could reach and prioritize remediation accordingly.