Six days from patch to exploited: PHP, Node.js, Oracle and the order to fix them

01Ten days, three runtimes, and the vendors said why it was fast

The calendar is unusual on its own. PHP and Node.js released fixes on 21 October; Oracle’s Critical Patch Update came the day before, and its out-of-cycle Java alert the day after.⁶¹⁰¹³ Speed is the second unusual thing. Amazon’s MadPot honeypot logged a PHP2Shell attempt on 17 October, four days before the vulnerabilities were public.³ CISA added both PHP CVEs to its Known Exploited Vulnerabilities catalogue on 26 October and the Brotli bug behind Node2Shell on 27 October. It set a federal due date of 29 October for PHP and 10 November for Brotli.¹²

Read the discovery credits and AI turns up on both sides. Researchers from Calif, OpenAI and Wiz found PHP2Shell.³ OpenAI’s Codex Security reported the Brotli bug to Node.js.⁶ An Anthropic and a Google researcher found the EDK II flaw.¹⁵ Fortinet attributes its fixes to its “frontier AI-assisted security testing program”.¹⁴ On the attacking side, Cyfirma reports a suspected North Korean operator group using a local AI model to rank public PHP2Shell exploits before testing them by hand.⁵

02PHP2Shell, in brief: the interpreter itself, on almost every visible host

CVE-2026-109618 and CVE-2026-109619 sit in PHP’s memory management and error handling, code that nearly every request touches. Both allow unauthenticated remote code execution and both are scored 9.2.³ The fixed builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no new release.⁴ A reload that keeps old workers alive leaves the stale state in place, so restart every PHP worker after updating.⁵ Firewalls are not a safe assumption either. Palo Alto confirmed that PAN-OS and Panorama are affected, through PHP in the management web interface and XML API.²¹

The exploitation and disclosure story, including the embargo Chainguard broke and what the mod_php worst case means, is in our separate piece, the PHP2Shell deep dive. For ordering purposes, one fact is enough: PHP2Shell is the only item this month with a three-day federal deadline and a 2.6-million-host footprint.¹⁴

03Node2Shell: a bug you can reach without ever calling it

The Node.js release of 21 October fixed ten CVEs across the 22, 24 and 26 lines: four High, three Medium and three Low. Four of the ten are incomplete fixes of, or a regression after, earlier CVEs.⁶ The one that matters is CVE-2026-111497, an out-of-bounds write in the Brotli decoder. Node.js says it can lead to “a crash, disclosure of process memory, or remote code execution” and rates it High. Google, which assigned the CVE, scores it 9.2 under CVSS v4.⁶⁷

Reachability is what makes it a priority. Most Node.js code never imports a Brotli library, and it does not have to. According to Akamai, the built-in fetch() decompresses Brotli responses automatically, and Express 5 with body-parser 2 decompresses request bodies sent as Content-Encoding: br by default. Akamai says its telemetry shows affected Node.js versions on 61% of networks, without saying how it measured that.⁸

So the inventory question is wider than “which Node.js versions do we run”. Microsoft published .NET 8.0.33, 9.0.22 and 10.0.14 for the same CVE on 25 October.⁹ Bun shipped 1.4.4 on 22 October.²² Rapid7 lists the upstream Brotli ranges as 1.0.3 before 1.0.10, 1.1.0 before 1.1.1 and 1.2.0 before 1.2.1, which is the string to search a software bill of materials for.⁷ Node.js offers no workaround. If you cannot upgrade an Express service today, setting inflate: false makes it reject compressed bodies with HTTP 415.⁸ The same release updated Node’s bundled root certificates for the eMudhra intermediate CA compromise, which we cover in eMudhra’s private key was the number 4.⁶

04Oracle: 1,295 patches, one EBS bug being probed, and the Java fix that came a day late

Oracle’s October Critical Patch Update, published 20 October, contains 1,295 new security patches.¹⁰ Volume is not the useful measure. Severity is, and severity is concentrated in a few product families.

The EBS bug drawing attention is CVE-2026-101767, an unauthenticated SQL injection in the Thin Client Framework servlet at /OA_HTML/AppsTCFServer. It chains to operating-system commands, affects versions 12.2.3 to 12.2.15, and the default EBS URL firewall allows the endpoint. Horizon3 reported it to Oracle on 24 July.¹¹ On 27 October Defused’s EBS decoys recorded “exploratory exploits” against it, and Shadowserver tracks more than 670 internet-exposed EBS instances, most of them in the United States.¹² It was not in the KEV catalogue as of 29 October.¹ If you cannot patch this week, Horizon3’s interim step is to remove that servlet from the URL firewall allowlist.¹¹

Java is where the calendar misleads. The CPU’s Java SE section has 55 patches, 49 of them exploitable over the network without credentials, but none critical: the top score is 7.5.¹⁰ The serious Java fix arrived on 21 October as Security Alert CVE-2026-91403, a 9.1 in JSSE. That update distrusts the eMudhra intermediate CA certificates. It lists Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, and GraalVM, as affected.¹³ Those versions are newer than the ones the CPU lists as affected (8u503, 11.0.32.1 and so on), so a team that patched Java on 20 October still needs the next update.¹⁰

05The rest of the week, and the order to patch in

Fortinet released FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14 on 22 October, with FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator alongside. CVE IDs and scores follow on 10 November, Fortinet’s next Patch Tuesday.¹⁴ For 19 days you have a version table and the vendor’s word that it includes “critical and high-severity fixes”. That is enough to act on.

EDK II, the open-source reference UEFI code that much commercial firmware is built on, has CVE-2026-97631 (CVSS v4 9.5). While a machine PXE-boots, an oversized ICMP error message overflows a 504-byte field and can run attacker code “before Secure Boot or measured boot has verified or measured any OS component”.¹⁵ The fix was merged on 15 October, a week before the 22 October advisory, and the pull request named the CVE. On 28 October Hetzner told customers to avoid rebooting PXE-booting hosts and to block inbound ICMP during reboots.¹⁶

jackson-databind, the JSON library inside most enterprise Java, published CVE-2026-110879 on 20 October: a 9.8 bypass of its polymorphic type validator. It is an incomplete fix of an earlier CVE and is fixed in 2.18.12, 2.21.8, 2.22.4, 3.1.8 and 3.2.4. It applies where class-name polymorphism is in use: configured default typing in 2.x or 3.x, or annotation-based class-name type IDs, which a default 3.x mapper accepts. An application that does neither is not on this path.¹⁷ And LiteLLM’s poisoned 1.107.0 release on 21 October belongs on the same list. We covered it in Two CERT-In advisories in six days.