PHP patches two critical RCEs as Java, Node and HTTP/3 fixes land the same day

A single day of patches across the stack

21 October 2026 packed an unusual number of security events into 24 hours. PHP shipped fixes for two critical remote code execution flaws, Oracle pushed an out-of-band Java alert, Node.js closed ten vulnerabilities, HTTP/3 libraries patched a memory amplification bug, cloud platform Railway disclosed that customer secrets had been accessed, and OVHcloud's command-line tool was revealed to have shipped with malware two days earlier. A dev.to security roundup collects the details and the actions each item requires.

PHP2Shell: a two-year-old flaw, finally patched

The two PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, carry a CVSS v4.0 score of 9.2. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — but installing the package is only half the job. PHP-FPM workers and Apache processes keep the code they loaded in memory, so the fix is not live until those services are restarted.

According to the PHP Foundation, the first signs appeared in 2024, when a core developer contracted by the Foundation noticed an out-of-memory problem while working on an issue left over from Quarkslab's 2024 audit. No attack vector was identified at the time. The security team drafted several fixes over the following months but could not settle on one: as The Next Web reports, one broke backward compatibility, one introduced a new denial-of-service risk, and one would have required changes across thousands of extensions. The Foundation has called the deadlock a "structural failure" and says security decisions will now be made by majority rather than consensus.

Two teams, one rediscovery and a leaky release

In August 2026 two teams independently turned the old bug into a working attack. According to the Wall Street Journal, a Calif researcher found the flaw using GPT-5.6 Sol as part of OpenAI's "Patch the Planet" program. Wiz says its first finding came on 19 August, that unauthenticated RCE against Drupal and WordPress was confirmed on 20–21 August, and that reports reached PHP on 24 August. PHP acknowledged the reports on 21 September and began a coordinated fix.

That coordination frayed. Amazon Threat Intelligence observed a PHP2Shell exploitation attempt in its MadPot honeypots on 17 October, four days before disclosure, and it is still unknown how the actor learned the details. On 20 October the CVE IDs circulated on forums and social media with a wrong release time and a wrong score of 10.0, and Calif mistakenly published a video of its working proof of concept. On release day, Chainguard published patched images at 07:41 UTC, more than six hours early — a move the Foundation said disregarded coordinated disclosure. The fixes landed at 14:00 UTC. watchTowr and Cloudflare both saw attack traffic afterwards, and Cloudflare shipped WAF rules, but no successful compromise has been confirmed.

Java, Node.js and HTTP/3 in the same 24 hours

Oracle's problem sits in the Java Secure Socket Extension. According to OpenJDK's 21 October advisory, CVE-2026-91403 (CVSS 9.1) follows the compromise of eight intermediate CA certificates and affects JDK 8, 11, 17, 21, 25 and 27. The fix is a JDK update or, where that is not possible, replacing the blocked.certs file and enabling certificate revocation checking.

Node.js closed ten CVEs, the worst being CVE-2026-111497, a Brotli-related remote code execution issue; the fixed releases are 22.23.4, 24.22.1 and 26.12.1.

FoxIO, meanwhile, published a class of memory amplification flaws in QPACK, HTTP/3's header compression, summarized by The Hacker News. Seven of the ten HTTP/3 stacks tested were affected. Fixes include quic-go 0.57.0, quiche 0.29.3 and lsquic 4.9.0, and the roundup advises Bun users to disable HTTP/3 for now.

Secrets exposure at Railway and OVHcloud

According to the dev.to roundup, Railway disclosed unauthorized access to customer secrets under incident QH8L8B3E and advised customers to rotate every environment variable and API token stored on the platform. Separately, OVHcloud CLI versions 0.11.0 through 0.15.0, shipped on 19 October, contained malware; anyone who installed the tool that day should rotate every secret on disk and upgrade to 0.16.0.

Why it matters

PHP powers a large share of the web, and an unauthenticated RCE in the language core — with a leaked proof of concept and probing traffic within hours — makes patch-and-restart genuinely urgent rather than routine. The most common mistake will be subtle: upgrading the package but never restarting PHP-FPM or Apache, leaving servers exposed on the old in-memory code. Beyond PHP, the day illustrates two broader shifts: AI-assisted research is compressing the time between a bug's rediscovery and its weaponization, and the norms of coordinated disclosure are under visible strain when vendors publish early and details leak onto forums. The Railway and OVHcloud incidents close the loop with a reminder that secret rotation, once a rare emergency drill, is becoming a routine part of operating software.