On October 21 2026 the PHP and Node.js projects published updates that close critical remote‑code‑execution bugs. PHP’s PHP2Shell flaws (CVE‑2026‑109618, CVE‑2026‑109619) affect all web‑serving setups and are fixed in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Node.js fixed ten CVEs, including a Brotli decoder exploit (CVE‑2026‑111497), in versions 22.23.4, 24.22.1 and 26.12.1. To help teams apply these patches, the blog announces an open‑source “Vulnerability Fixes” plugin for the Devin coding agent that inventories repositories, asks for approval, updates to verified versions, runs tests, and opens a pull request per repo.
Why it matters
Ops teams can quickly secure PHP and Node services that are being actively exploited, reducing downtime and breach risk.
