Two critical flaws in PHP, the software behind most websites, were fixed on October 21, 2026. Here is what happened, who is at risk, and how to get it handled, with your IT provider or with us.
On October 21, 2026, the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, now known as PHP2Shell. Both are rated 9.2 out of 10.
PHP is the software that runs on the web server behind most websites, including every WordPress, Drupal and Joomla site. These flaws let an attacker run their own code on that server with a single web request and no login. The problem is in PHP itself, before your website's code ever runs, so a well-built site is just as exposed as a basic one.
Details leaked before the fix was ready, and attack attempts were reported before the patch shipped. Government security agencies, including CISA, told organizations to patch immediately.
The same week, Node.js fixed a related flaw nicknamed Node2Shell (CVE-2026-111497) in the Brotli decoder it bundles. It can allow remote code execution in web apps built on Node.js.
Any business with a website, portal or web app should check. Where your site runs matters more than how it was built.
Patching a server is routine. Finding old versions hiding in custom apps, containers and build pipelines, and upgrading the ones with no fix, is developer work. That's where GoodJava comes in.
Reach out to them first. We work alongside IT teams on the developer side, and your provider stays your point of contact. They can bring us in, or you can.
Contact us directly. We'll look at your sites and tell you plainly whether you need to do anything, and quote any fix before work starts.
We partner with MSPs to check client lists and handle the app work behind you. You keep the client.
