This week brought multiple security issues at once. If your team is working through them, you are not alone, and we are all in this together. Here is what happened and what we would do first.
What happened
- PHP. On October 21, the PHP project released fixes for two critical flaws (CVE-2026-109618 and CVE-2026-109619) that can let an attacker run code on a web server without logging in. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Exploit code is public, so assume attackers are looking.
- Node.js. The same day, the Node.js project fixed ten vulnerabilities, four rated High, in versions 26.12.1, 24.22.1 and 22.23.4. Versions that have reached end of life will not receive fixes.
- eMudhra. Private keys for several eMudhra intermediate certificate authorities were reported compromised. Software that trusts those certificates could accept one issued by an attacker and let them impersonate a legitimate site or service.
What to do first
- Find every copy. PHP and Node.js are easy to miss. Copies can sit on web servers, on developer machines, inside user profiles, bundled in applications and in container images. A version check only reports the first copy it finds, so search the whole system. Check Apache servers that use mod_php first.
- Update. Move to the fixed versions above. For PHP 8.1 and older, the PHP project is not issuing fixes, so use a vendor backport or upgrade. Rebuild container images that embed either runtime. Test before you roll out, because upgrades can break applications.
- If you can’t update right away. PHP says there is no complete mitigation, and updating is the only safe choice. Steps such as limiting request sizes at your web server or proxy and turning off session upload progress reduce exposure to specific attack paths but do not make a system safe. A web application firewall in front of exposed servers can help in the meantime, but it is not a substitute for patching.
- Look for signs of trouble. Because exploit code became public as the fixes shipped, review logs and look for unusual processes or files on internet-facing PHP servers.
- Ask your vendors. Many products embed PHP or Node.js. Ask your software and hosting providers whether they are affected and when they will ship fixes.
- Check your certificate trust. For eMudhra, remove trust in the affected intermediate certificates from systems and applications that keep their own certificate stores, and apply vendor updates as they arrive. Java-based applications are a good place to start. The Node.js October release also updates its certificate bundle to address the compromise.
How Absolute can help
If you have Absolute Secure Endpoint or Syxsense, here is how those tools can help.
PHP flaws can sit in systems your IT team does not track
Two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were disclosed on October 21, and fixed releases are available. PHP runs inside web servers, content platforms such as WordPress, and internal tools.
- Find the risk: Secure Endpoint can run the ’Detect PHP2Shell vulnerabilities on a Windows or Mac device’ REACH script across your Absolute managed devices to detect PHP installs and versions. Custom Data Fields may then be used to collect and generate device-level reporting across your fleet.
- Fix it: Resilience for Automation (RfA), Resilience for Security (RfS), and Syxsense customers may use our published detection and patching content for the CVEs to detect impacted endpoints and services and apply patches to fully remediate.
Four High-severity Node.js fixes need a check before you upgrade
Node.js published its regular October security release with four High-severity fixes. They affect specific features, so not every Node.js install is vulnerable. Check the release notes against how each application uses Node.js.
- Find the risk: Our team is also planning to deploy a REACH script to detect vulnerable Node.js versions. Like the ’Detect PHP2Shell vulnerabilities on a Windows or Mac device’ script, it may be run across your Absolute managed devices to detect impacted Node.js installs and versions. Custom Data Fields may then be used to collect and generate device-level reporting across your fleet. We will update customers when it is published.
- Fix it: As with the PHP vulnerabilities, RfA, RfS, and Syxsense customers may use our published detection and patching content for the CVEs to detect impacted endpoints and servers and apply patches to fully remediate. As with any patch, we recommend you test first, because Node.js upgrades can break applications.
Status of your Absolute products
We have published security advisories for all three issues at Product & Security Advisory web page, with the status of each Absolute product and any action customers need to take. If you are an Absolute customer, your account team can help you find affected systems and apply fixes with the tools you already have.
None of this is exotic, but it is easy to get wrong at scale. Start by finding what you have, update what you can, and ask for help where you need it. We will keep our advisories current as things change.
