Keeping WordPress, plugins and application dependencies current is only part of maintaining a secure website. The software underneath your applications needs attention too. October’s security releases include critical PHP vulnerabilities, a Node.js flaw that can allow remote code execution, Go standard-library fixes and a security-related rustup update.
For business owners, the next step is practical: ask your hosting provider or development team which versions are actually running, what needs updating, and how they will verify the deployment.
1. PHP: two critical vulnerabilities require urgent updates
CVE-2026-109618 and CVE-2026-109619 are rated CVSS v4.0 9.2, Critical. They can permit remote code execution without authentication. The first involves memory corruption during out-of-memory handling; the second involves freed request state surviving into a later request handled by the same worker.
The PHP advisory covers web-serving installations including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. It identifies mod_php as the highest-risk configuration.
| PHP branch | Fixed release |
|---|---|
| 8.2 | 8.2.35 |
| 8.3 | 8.3.36 |
| 8.4 | 8.4.27 |
| 8.5 | 8.5.12 |
Use a fixed release or a newer supported release containing these fixes. PHP 8.1 and earlier are outside upstream support; confirm any vendor backports and plan migration. PHP has also supplied limited emergency source backports for 7.4, 8.0 and 8.1; these do not restore ongoing support.
Proof of concept is not confirmed exploitation. The Canadian Centre for Cyber Security’s October 21 alert reports available proof-of-concept code, but no identified active exploitation at publication. That can change quickly; patching remains urgent.
For WordPress owners, ask the host to verify the PHP version serving the site. Updating WordPress or checking the command-line PHP version alone is insufficient.
2. Node.js: October 21 releases address 10 CVEs
The Node.js security release addresses 10 CVEs across its supported release lines. Its highest severity rating is High.
CVE-2026-111497 concerns an out-of-bounds write in the Brotli decoder that can permit remote code execution. Other High-severity fixes address TLS hostname validation and dns.resolve handling of names containing a NUL character. Exposure depends on the features and inputs each application uses.
| Node.js branch | Fixed release |
|---|---|
| 26.x | 26.12.1 |
| 24.x | 24.22.1 |
| 22.x | 22.23.4 |
The release set also updates bundled components, including c-ares, Undici, certificates, OpenSSL and SQLite; the applicable updates vary by branch. Updating npm packages does not replace updating the Node.js runtime. Deploy the fixed runtime and restart the relevant services.
3. Go: update the toolchain, then rebuild your applications
The Go release history lists security updates on October 8 and October 19:
- Go 1.26.9 and 1.27.2: fixes affecting the go command and packages including
crypto/tls,html/template,net/http,net/textprotoandos. - Go 1.26.10 and 1.27.3: additional security fixes in
crypto/x509.
Use the latest patched release in a supported branch. Go supports a major release until two newer major releases exist, so older branches need a migration plan.
For deployed Go services, rebuild with the patched toolchain and redeploy the resulting binaries or container images. Installing a new compiler does not replace standard-library code already compiled into an existing executable.
4. Rust: check both your tooling and your dependency graph
Rust 1.99.1 addresses compiler, linking and platform regressions. However, rustup 1.29.2 should not be dismissed as routine maintenance: it updates certificate-related dependencies in response to the eMudhra intermediate certificate issue, tracked as CVE-2026-111943.
Keep the compiler and rustup current, and inspect application dependencies separately. RustSec provides tools such as cargo audit and cargo deny to check dependency lockfiles against known advisories. Include checks in CI and schedule recurring audits so newly disclosed issues are detected between releases.
What your team should do next
- Build an inventory. Record the runtime, deployment method, public entry points and responsible owner for each website, API and background service. Include staging systems, containers and managed platforms.
- Confirm the fix with your provider. Distribution vendors may backport fixes without matching the upstream version number. Ask for the package build and advisory confirming remediation.
- Prepare and deploy. Check recovery options, test critical functions and apply the appropriate update. Restart PHP workers, Apache when using mod_php, or the relevant Node.js services. Restarting Nginx alone does not replace PHP-FPM workers.
- Replace running container instances. Rebuild from patched base images and deploy the new images. Updating a registry tag does not change containers already running.
- Verify the result. Check the version used by the live service, deployment records and application health. For Go, verify that the newly built executable is the one in production.
- Review suspicious activity. Investigate unexpected processes, files, accounts or outbound connections. Applying a patch does not remove an existing compromise.
If you cannot patch PHP immediately
Restrict or isolate exposed applications while arranging the update. PHP’s advisory describes partial measures including disabling session.upload_progress.enabled before request parsing and restarting all workers, plus request-size limits. These cover specific paths only. A WAF can add protection but cannot certify that an installation is safe.
Get help checking your website’s exposure
Unsure which runtime powers your website or who manages its updates? WEBSITETOON digital can help assess your website environment, identify maintenance gaps and plan remediation with your hosting or development team.
Connect with WEBSITETOON digital to discuss website management and cybersecurity support.
Information checked against the linked project advisories and Canadian Cyber Centre alert on October 22, 2026. Follow the original advisories for subsequent changes and environment-specific guidance.
