Urgent Patch Alert: PHP2Shell, GitLab RCE, and Node.js Brotli RCE

Updated October 22, 2026. Security fixes were released on October 21.

Three code-execution risks deserve prompt attention: PHP2Shell, GitLab CVE-2026-110264, and Node.js CVE-2026-111497. Check your deployed versions, identify exposed services, and apply the relevant updates.

Fixed versions at a glance

Use the fixed release for your branch, or a later release containing the fix. For distribution packages, check the vendor's advisory and package revision: backported fixes may retain older upstream version numbers.

PHP2Shell: two critical PHP vulnerabilities

PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619:

• CVE-2026-109618: memory corruption associated with out-of-memory handling.
• CVE-2026-109619: stale request-related global state leading to use-after-free.

Both can allow unauthenticated remote code execution. PHP's warning covers web-serving installations, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.

PHP identifies mod_php as the highest-risk deployment, with an exploit demonstrated before application code runs. Exploitability differs by deployment: for the OOM flaw, the advisory describes FPM as susceptible based on source analysis, while noting that a complete FPM exploit had not been demonstrated.

Attack activity has been reported. Cloudflare states that it observed attack traffic targeting customers, including payload changes intended to bypass protections. That observation should not be presented as proof of successful compromise of every targeted server.

Update PHP itself and restart affected workers. Updating application code or plugins alone does not fix these runtime flaws. PHP says configuration changes do not provide a complete mitigation; WAF protection is an additional layer while patching.

For PHP 8.1 and older, obtain a confirmed vendor backport or move to a supported release.

For exploitation conditions, observed attack attempts, and SOC investigation guidance, see my detailed PHP2Shell analysis.

Sources: PHP security announcement · OOM advisory · Stale-state advisory

GitLab: CVE-2026-110264

An integer overflow in regular-expression compilation can, under certain conditions, allow an unauthenticated attacker to execute arbitrary code on the GitLab server. GitLab rates it CVSS 3.1 10.0.

Affected GitLab CE/EE ranges extend back to 7.0; the advisory lists the exact boundaries. In addition to 19.5.1, 19.4.3, and 19.3.6, this critical fix is available in 19.2.9, 19.1.9, 19.0.10, and 18.11.13.

Prioritize self-managed instances. GitLab.com is already patched, and GitLab states that its managed infrastructure, including GitLab Dedicated, is patched.

Check upgrade-path and migration requirements before deployment. The older-branch backports listed here address this critical issue; they should not be treated as fixing every other vulnerability in the release announcement.

Official GitLab advisory

Node.js: CVE-2026-111497

An out-of-bounds write in the Brotli decoder can permit remote code execution. Node.js rates this issue High, and identifies 26.x, 24.x, and 22.x as affected release lines.

Update to 26.12.1, 24.22.1, or 22.23.4, as appropriate for your branch.

For exposure assessment, identify where your application or its dependencies decompress untrusted Brotli data. Reachability depends on the application's processing paths; the advisory does not establish that every Node.js service is directly exploitable.

Upgrade the Node.js runtime. An npm dependency update alone does not replace the runtime fix. Include container base images, background workers, and CI environments.

This release also fixes high-severity TLS hostname-verification and DNS issues, so review and apply the relevant security update even if your application does not use Brotli.

Official Node.js advisory and downloads

What to do now

1. Inventory and prioritize. Identify affected services and owners, starting with internet-facing GitLab and PHP and Node.js services that process untrusted compressed data.
2. Patch and restart. Upgrade the server software or runtime, rebuild and redeploy containers, and restart affected processes.
3. Verify every running instance. Check the actual service runtime or vendor package revision, including all replicas. A shell's version may differ from the application's.
4. Review evidence of prior activity. Preserve logs and investigate anomalies. Patching closes the vulnerability but does not establish whether an earlier compromise occurred.

This alert focuses on the three RCE topics above. Follow the linked advisories for full affected-version ranges, upgrade guidance, and subsequent updates.