October 2026 will be remembered as one of the worst months for server-side security in years. In the span of about ten days, three of the most widely deployed technologies on the internet — GitLab, PHP and Node.js — each shipped emergency fixes for critical, unauthenticated remote code execution (RCE) flaws. Two of the disclosures even leaked ahead of their embargo, and at least one was already being probed in the wild before the patch landed.
If you run any of these on a server — and almost everyone does, somewhere — this is a drop-everything-and-patch situation. Here is the full picture of the October 2026 RCE wave, who is affected, and exactly what to upgrade to.
TL;DR — patch these now
| Stack | CVE(s) | CVSS | Type | Patched in |
|---|---|---|---|---|
| GitLab CE/EE | CVE-2026-97229 | 10.0 | CI/CD regex integer overflow → RCE | 19.4.2, 19.3.4 (see 19.3.5), 19.2.8 |
| PHP (PHP2Shell) | CVE-2026-109618, CVE-2026-109619 | 9.2 | Unauthenticated RCE | 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
| Node.js (Node2Shell) | CVE-2026-111497 | High | Brotli decoder out-of-bounds write → RCE | 22.23.4, 24.22.1, 26.12.1 |
1. GitLab — CVE-2026-97229 (CVSS 10.0), the one that opened the wave
The wave began on 11–12 October 2026, when GitLab shipped a critical patch release for CVE-2026-97229, an integer overflow in the CI/CD regular-expression compiler engine carrying the maximum possible score of CVSS 10.0. An unauthenticated attacker can achieve code execution on the server simply by supplying a crafted regular expression in a CI/CD configuration file.
- Affected: self-managed GitLab Community Edition and Enterprise Edition.
- Fixed versions: 19.4.2, 19.3.4 and 19.2.8. Note GitLab flagged a regression in 19.3.4 to be resolved in 19.3.5 — check the official release notes before choosing a 19.3 build.
- Already safe: GitLab.com and GitLab Dedicated are patched; no customer action needed there.
- The same release also fixed CVE-2026-92883, a stored XSS in syntax highlighting.
2. PHP — “PHP2Shell”, CVE-2026-109618 & CVE-2026-109619 (CVSS 9.2)
The headline event was PHP2Shell: two unauthenticated remote code execution vulnerabilities in PHP core, each rated CVSS 9.2. Together they let an attacker run arbitrary code on a vulnerable server with no credentials — the worst class of web vulnerability there is.
- CVE-2026-109618 — an out-of-memory condition leading to memory corruption.
- CVE-2026-109619 — a stale global-state flaw that can be chained for code execution.
The timeline matters. Wiz Research reported the flaws to the PHP security team on 24 August 2026, and a coordinated fix was in development from 21 September. But on 20 October around 15:00 UTC the two CVE IDs leaked onto forums and social media ahead of the embargo, forcing PHP to publish the advisories early, on 21 October at 13:34 UTC. Amazon Threat Intelligence later identified exploitation attempts dating back to 17 October — before the patch existed — and watchTowr reported honeypot activity by the 21st. (CISA said it had not confirmed exploitation as of that date; it was not yet in the KEV catalog.)
- Affected: PHP before the October patch across all supported branches. Researchers have claimed versions as far back as PHP 5 may be affected, though PHP has not officially confirmed that range.
- Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Anything older than 8.2 is end-of-life — migrate, don’t wait.
- Note: the leaked chatter cited a CVSS of 10.0; the official score is 9.2.
3. Node.js — “Node2Shell”, CVE-2026-111497 (Brotli decoder RCE)
On the same day as the PHP release, 21 October, Node.js shipped an emergency security update across three release lines fixing ten vulnerabilities. The standout — nicknamed Node2Shell — is CVE-2026-111497, an out-of-bounds write in the bundled Brotli decoder that can lead to remote code execution.
Any application that decompresses attacker-controlled Brotli data is exposed — that includes HTTP request bodies, fetch() responses and many proxy/CDN paths. There is no configuration workaround; patching is the only fix. (Exploitability is debated: a public PoC reached full code execution only in a deliberately weakened build, while stock Node.js produced a crash and limited memory disclosure — but with no mitigation available, treat it as critical.)
- Fixed versions: 22.23.4, 24.22.1, 26.12.1. Node.js 20.x and older are end-of-life and will not receive a fix — upgrade the runtime.
- Also in the release: TLS hostname-verification bypasses (CVE-2026-105483, CVE-2026-106069), a DNS NUL-truncation bug (CVE-2026-105482) and a randomness-cache issue (CVE-2026-106074).
Also worth patching this cycle
- Redis — multiple RCE/DoS advisories circulated in early October (including code execution via a crafted
RESTOREpayload). If you run Redis, apply your distribution’s latest security update. - Chromium — the same window saw Chromium security fixes land across Linux distributions; keep browsers and any embedded Chromium current.
What to do right now
- Inventory your versions.
php -v,node -v, and your GitLab instance version. Don’t forget containers, CI runners, serverless runtimes and managed platforms. - Patch to the fixed releases above. On most Linux servers this is a package update and a service restart (PHP-FPM, your Node process manager, GitLab’s bundled upgrade).
- Restart services after upgrading — a patched binary on disk does nothing until the running process is replaced.
- Check for prior compromise. Because PHP2Shell was probed before patches shipped, review logs for anomalous requests, unexpected outbound connections and new/modified files since mid-October.
- Retire end-of-life versions. PHP < 8.2 and Node.js ≤ 20.x get no fix — plan the migration now.
How REIKA responded
Across the infrastructure we manage, every server was patched within hours of the releases: all PHP sites consolidated onto PHP 8.5.12 with older interpreters disabled, Node.js runtimes moved to the patched lines, and CI/CD platforms updated. If you run production workloads on PHP, Node.js or self-managed GitLab and want a fast, verified patch-and-harden pass, talk to us.
Official sources
- PHP release announcement & advisories — php.net (GitHub Security Advisories for CVE-2026-109618 / CVE-2026-109619).
- Node.js October 2026 security releases — nodejs.org/en/blog.
- GitLab critical patch release 19.4.2 / 19.3.x / 19.2.8 — about.gitlab.com/releases.
- ENISA joint statement on the critical PHP vulnerabilities; CISA advisories — cisa.gov.
Last updated 23 October 2026. CVE scoring and exploitation details evolve — always confirm against the official vendor advisory for your exact version.
