# PHP and Node.js release critical security patches on Oct 21 2026

> Both runtimes fixed remote‑code‑execution flaws; a new Devin plugin can automate the patch process for affected repos.

Oossa · 2026-10-22 · https://oossa.com/en/php-and-node-js-release-critical-security-patches-on-oct-21-2026

On October 21 2026 the PHP and Node.js projects published updates that close critical remote‑code‑execution bugs. PHP’s PHP2Shell flaws (CVE‑2026‑109618, CVE‑2026‑109619) affect all web‑serving setups and are fixed in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Node.js fixed ten CVEs, including a Brotli decoder exploit (CVE‑2026‑111497), in versions 22.23.4, 24.22.1 and 26.12.1. To help teams apply these patches, the blog announces an open‑source “Vulnerability Fixes” plugin for the Devin coding agent that inventories repositories, asks for approval, updates to verified versions, runs tests, and opens a pull request per repo.

## The facts

- PHP fixed versions: 8.2.35, 8.3.36, 8.4.27, 8.5.12
- Node.js fixed versions: 22.23.4, 24.22.1, 26.12.1

## Why it matters

Ops teams can quickly secure PHP and Node services that are being actively exploited, reducing downtime and breach risk.

## Sources & references

1. [Fixing Critical Node & PHP Flaws](https://windsurf.com/blog/vulnerability-fixes-plugin) – Windsurf, 2026-10-21

Last updated: 2026-10-22