PHP
Application runtime
Two critical runtime flaws
The 21 October release fixes two critical request-memory flaws that can permit remote code execution. Apply the PHP security update.
Security brief / 13–21 October 2026
Security disclosures.
Across the stack.
Recent disclosures reach from application runtimes to hosting credentials and software releases. Review the layers your organization relies on.
PHP release
Node.js
Application runtime
Security fixes across supported releases
Node.js issued security updates for its 22.x, 24.x and 26.x lines, including a high-severity Brotli decoder out-of-bounds write that permits remote code execution.
Next.js / React
Application framework
Critical flaws in server-side features
Next.js released fixes for two critical remote-code-execution vulnerabilities and a high-severity denial-of-service issue affecting particular server-side features and dependencies.
Railway
Hosting platform / credentials
Possible exposure of stored secrets
Railway says an unauthorized party may have accessed encrypted environment variables and obtained some decrypted contents. It urges all users to rotate stored secrets and review service logs.
LiteLLM
AI software supply chain
Compromised release artifacts
LiteLLM reports its release pipeline published malicious 1.107.0 PyPI wheels and container images. Affected releases were withdrawn or repointed to verified clean artifacts.
eMudhra
Certificate trust / WebPKI
Eight intermediate certificate keys compromised
Cloudflare reports that private keys for eight eMudhra intermediate certificates were compromised. Its response includes trust-store updates and software fixes across affected services.
More disclosures across the stackGitLab, NGINX, Oracle, .NET Framework, Traefik and MCP
GitLab
Development infrastructure
Critical server code execution / CVSS 10.0
GitLab patched CVE-2026-110264, rated CVSS 10.0: under certain conditions, unauthenticated attackers could execute code on the server through a crafted regular expression. Upgrade affected self-managed installations immediately. GitLab.com is already patched.
NGINX
Web server and proxy
Five configuration-dependent security fixes
NGINX patched buffer overflows, HTTP/3 request-body injection, TLS session forgery and an AIO use-after-free. Exposure depends on the features and configuration in use.
Oracle / Java / MySQL
Enterprise software and data
A broad enterprise patch release
Oracle's quarterly update covers vulnerabilities across product families, including Java and MySQL. Its risk matrices identify affected versions and which issues can be reached remotely without authentication.
.NET Framework
Application runtime
Runtime security updates
Microsoft's October cumulative update fixes multiple remote-code-execution, denial-of-service, privilege-escalation and spoofing vulnerabilities in .NET Framework.
Traefik
Proxy authentication
Identity could cross client connections
Traefik's ForwardAuth middleware could reuse an authenticated connection for another client when the authentication server uses NTLM or Negotiate, allowing access under another user's identity.
MCP TypeScript SDK
Agent server isolation
Shared HTTP instances could leak messages
Affected MCP HTTP servers could deliver one client's responses or notifications to another when clients shared a server or stateless transport instance. The fix requires isolation as well as an upgrade.
The PHP migration skill remains the current offer. This wider brief provides security context. Sources and scope notes ↗
Check each advisory for affected versions and configurations. Rebuilding in Motoko can remove a replaced runtime; secrets, release pipelines, HTTPS and retained services need their own remediation.
See what changes on ICPPatch first. Migrate with a plan.
Still running PHP?
Patch it today.
Keep the existing site patched throughout the migration. A CMS update alone does not replace the PHP runtime fix.
PHP2SHELL / 21 OCT 2026
Update the engine
under your website.
The flaws are in PHP itself. Updating WordPress, Drupal, Joomla or Magento alone does not install the runtime fix. Follow your hosting provider’s instructions and keep the old site patched throughout the migration.
FIXED PHP RELEASES
Select your PHP branch.
21 OCT SECURITY RELEASE8.5.12
Your distribution may provide a backported fix with a different version number. Confirm the advisory with your provider.
Official PHP release advisory ↗Why some organizations took sites offlinePrecautionary shutdowns reported on 21 October 2026.
NOS reported government, education, and company websites going offline as a precaution while operators prepared PHP updates. The reported public websites included:
These were precautionary outages. DigiD authentication remained available for other services.
Read the NOS reporting ↗
The Dutch NCSC published its own statement. It said it temporarily took NCSC.NL offline as a precaution. Read the government statement ↗
Start with the inventory
Start with your
PHP project.
Open your codebase, copy the brief and review the migration plan.