October 21 security roundup: PHP2Shell, Java, HTTP/3, Node.js, Railway and OVH

On October 21, 2026, PHP patched two critical RCEs (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2), Oracle issued an out-of-band Java fix (CVE-2026-91403, CVSS 9.1) and Node.js closed ten vulnerabilities. Railway disclosed access to customer secrets, and OVHcloud's CLI versions 0.11.0–0.15.0 shipped with malware.

• PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two RCEs rated CVSS 9.2
• Java JSSE got an out-of-band patch for CVE-2026-91403 rated 9.1
• Node.js closed 10 flaws, worst is a Brotli RCE (CVE-2026-111497)
• OVHcloud CLI 0.11.0–0.15.0 shipped with malware; use 0.16.0