Patches released for critical RCE flaws in PHP, GitLab and Node.js

Security fixes released on October 21, 2026 address three remote code execution flaws: PHP2Shell in PHP (CVE-2026-109618 and CVE-2026-109619), an integer overflow in GitLab (CVE-2026-110264, CVSS 10.0) and an out-of-bounds write in Node.js's Brotli decoder (CVE-2026-111497). Fixed versions are PHP 8.5.12/8.4.27/8.3.36/8.2.35, GitLab 19.5.1/19.4.3/19.3.6 and Node.js 26.12.1/24.22.1/22.23.4.

• PHP2Shell: two critical PHP flaws allow unauthenticated RCE
• GitLab CVE-2026-110264 rated CVSS 10.0, affects versions back to 7.0
• Node.js CVE-2026-111497 is an out-of-bounds write in Brotli decoder
• Cloudflare observed attack traffic targeting PHP servers