Updated October 22, 2026. Security fixes were released on October 21.

Three code-execution risks deserve prompt attention: PHP2Shell, GitLab CVE-2026-110264, and Node.js CVE-2026-111497. Check your deployed versions, identify exposed services, and apply the relevant updates.

Fixed versions at a glance

Issue Vendor severity Fixed upstream releases

PHP2Shell Critical 8.5.12, 8.4.27, 8.3.36, 8.2.35

GitLab RCE Critical — CVSS 3.1 10.0 19.5.1, 19.4.3, 19.3.6 ; additional backports below

Node.js Brotli RCE High 26.12.1, 24.22.1, 22.23.4

Use the fixed release for your branch, or a later release containing the fix.…