---
title: "Six days from patch to exploited: PHP, Node.js, Oracle and the order to fix them"
summary: "Every critical fix shipped between 20 and 29 October 2026 across PHP, Node.js, Oracle, Java, Fortinet and EDK II firmware, counted from the advisories and put in patch order."
url: https://www.thetechbag.com/blog/one-week-php-node-java-oracle-critical-patches
format: Analysis
desk: "Security operations"
published: 2026-10-30
facts_checked: 2026-10-30
author: TechBag (The TechBag Journal)
tags: ["PHP2Shell","Node2Shell","Brotli","Node.js","Oracle CPU","E-Business Suite","Java","Fortinet","EDK II","jackson-databind","CISA KEV","CERT-In","patch management"]
cover: https://www.thetechbag.com/blog/covers/one-week-php-node-java-oracle-critical-patches.png
---

# Six days from patch to exploited: PHP, Node.js, Oracle and the order to fix them

*Every critical fix shipped between 20 and 29 October 2026 across PHP, Node.js, Oracle, Java, Fortinet and EDK II firmware, counted from the advisories and put in patch order.*

Analysis · Security operations · By TechBag · Published 2026-10-30 · Facts checked 2026-10-30 · Canonical: https://www.thetechbag.com/blog/one-week-php-node-java-oracle-critical-patches

The short version

- Patch the internet-facing PHP first, then Node.js and everything else that bundles Google’s Brotli decoder. Those two went from fix to CISA’s exploited list in five and six days, and CISA gave US federal agencies three days to fix PHP.[1]
- Oracle’s October update carries 1,295 patches. The one being probed is an unauthenticated 9.8 in E-Business Suite. The Java fix that matters came a day later and out of cycle: a 9.1 trust-store alert tied to eMudhra.[10][12][13]
- Fortinet shipped fixes on 22 October and is holding the CVE details until 10 November. Its stated reason is that AI now turns a patch into a working exploit “in hours or days, rather than weeks”. Plan your patch cycle around that sentence.[14]

Between 20 and 29 October 2026 the three runtimes under most enterprise web estates, PHP, Node.js and Java, all shipped critical security fixes within two days of each other. Oracle shipped its quarterly update in the same window, a firewall vendor shipped fixes before announcing what they were, and a firmware bug turned PXE booting into a risk. A team with one change window this month has to choose an order. This piece sets out what each fix is, how much of it is exposed, and the order we would patch in.

## Ten days, three runtimes, and the vendors said why it was fast

The calendar is unusual on its own. PHP and Node.js released fixes on 21 October; Oracle’s Critical Patch Update came the day before, and its out-of-cycle Java alert the day after.[6][10][13] Speed is the second unusual thing. Amazon’s MadPot honeypot logged a PHP2Shell attempt on 17 October, four days before the vulnerabilities were public.[3] CISA added both PHP CVEs to its Known Exploited Vulnerabilities catalogue on 26 October and the Brotli bug behind Node2Shell on 27 October. It set a federal due date of 29 October for PHP and 10 November for Brotli.[1][2]

**Figure: Fix to ‘known exploited’ took five days for PHP and six for Brotli**

*Disclosures, fixes and exploitation signals across the late-October patch cluster, 17 to 29 October 2026 (UTC dates)*

| Date | Event | Detail |
| --- | --- | --- |
| 17 Oct 2026 | First PHP2Shell probe | Amazon MadPot honeypot, from a commercial anonymiser, four days before disclosure |
| 20 Oct 2026 | Oracle CPU; PHP leak | 1,295 Oracle patches; PHP2Shell details leak ahead of the planned 22 October release |
| 21 Oct 2026 | PHP, Node.js, Java fixes | PHP 8.2.35 to 8.5.12; Node.js 22, 24 and 26 releases; Oracle Java alert CVE-2026-91403 |
| 22 Oct 2026 | Fortinet, EDK II | Fortinet hardening release, CVEs held to 10 November; EDK II PXE advisory, CVSS v4 9.5 |
| 26 Oct 2026 | PHP2Shell in KEV | Both CVEs added; federal due date 29 October |
| 27 Oct 2026 | Brotli in KEV | CVE-2026-111497 added; Defused decoys see Oracle EBS exploit probes the same morning |
| 28 Oct 2026 | Hetzner: do not reboot | PXE-booting hosts told to avoid reboots and block inbound ICMP |
| 29 Oct 2026 | GitLab, Cisco ASA in KEV | Two more exploited bugs, each with a three-day federal deadline |

Source: Amazon via The Hacker News; Oracle CPU advisory; PHP, Node.js and Fortinet releases; TianoCore advisory; CISA KEV feed; BleepingComputer; Hetzner status page · as of 30 October 2026

Read the discovery credits and AI turns up on both sides. Researchers from Calif, OpenAI and Wiz found PHP2Shell.[3] OpenAI’s Codex Security reported the Brotli bug to Node.js.[6] An Anthropic and a Google researcher found the EDK II flaw.[15] Fortinet attributes its fixes to its “frontier AI-assisted security testing program”.[14] On the attacking side, Cyfirma reports a suspected North Korean operator group using a local AI model to rank public PHP2Shell exploits before testing them by hand.[5]

ReportedFortinet’s CISO, 21 October 2026

“AI tools can now help adversaries reverse-engineer patches and build working exploits in hours or days, rather than weeks.” And: “The window between disclosure and exploitation continues to shrink, and we expect it to keep shrinking.” Carl Windsor asked customers to treat the release “as a priority change rather than a routine maintenance cycle”.[14]

## PHP2Shell, in brief: the interpreter itself, on almost every visible host

CVE-2026-109618 and CVE-2026-109619 sit in PHP’s memory management and error handling, code that nearly every request touches. Both allow unauthenticated remote code execution and both are scored 9.2.[3] The fixed builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no new release.[4] A reload that keeps old workers alive leaves the stale state in place, so restart every PHP worker after updating.[5] Firewalls are not a safe assumption either. Palo Alto confirmed that PAN-OS and Panorama are affected, through PHP in the management web interface and XML API.[21]

99.998%

of 2,608,039 internet-facing PHP hosts that VulnCheck judged vulnerable or likely vulnerable on 21 October

VulnCheck counts each host once and calls every figure a floor. Hosts with no visible version are counted as likely vulnerable.[4]

**Figure: More than eight in ten exposed PHP hosts run an end-of-life branch or hide their version**

*Internet-facing PHP hosts by branch, share of 2,608,039, VulnCheck scan of 21 October 2026*

- No version shown43.4% 43%
- PHP 3.x to 7.3: no fix at all27% 27%
- PHP 7.4 to 8.1: source backports only15% 15%
- PHP 8.2 to 8.5: fix released14.6% 15%

|  | Value (%) | Share |
| --- | --- | --- |
| No version shown | 43.4 | 43% |
| PHP 3.x to 7.3: no fix at all | 27 | 27% |
| PHP 7.4 to 8.1: source backports only | 15 | 15% |
| PHP 8.2 to 8.5: fix released | 14.6 | 15% |

Source: VulnCheck, PHP2Shell vulnerabilities (27%, 15%, 43.4%); supported-branch share computed by TechBag as the remainder · as of 26 October 2026 · VulnCheck gives 700,000+ hosts (27%) on 3.x to 7.3 and just under 400,000 (15%) on 7.4 to 8.1; its rounded counts overlap slightly, so the shares are used

The exploitation and disclosure story, including the embargo Chainguard broke and what the mod_php worst case means, is in our separate piece, [the PHP2Shell deep dive](https://www.thetechbag.com/blog/php2shell-every-php-web-server-one-request). For ordering purposes, one fact is enough: PHP2Shell is the only item this month with a three-day federal deadline and a 2.6-million-host footprint.[1][4]

## Node2Shell: a bug you can reach without ever calling it

The Node.js release of 21 October fixed ten CVEs across the 22, 24 and 26 lines: four High, three Medium and three Low. Four of the ten are incomplete fixes of, or a regression after, earlier CVEs.[6] The one that matters is CVE-2026-111497, an out-of-bounds write in the Brotli decoder. Node.js says it can lead to “a crash, disclosure of process memory, or remote code execution” and rates it High. Google, which assigned the CVE, scores it 9.2 under CVSS v4.[6][7]

Reachability is what makes it a priority. Most Node.js code never imports a Brotli library, and it does not have to. According to Akamai, the built-in `fetch()` decompresses Brotli responses automatically, and Express 5 with body-parser 2 decompresses request bodies sent as `Content-Encoding: br` by default. Akamai says its telemetry shows affected Node.js versions on 61% of networks, without saying how it measured that.[8]

**Figure: One malformed compressed body reaches the decoder through defaults, and the same decoder ships in other runtimes**

*How CVE-2026-111497 is reached and where else it lives, as published 21 to 27 October 2026*

1. 01A compressed body arrivesAny client sends `Content-Encoding: br` to an Express 5 app, or a server answers a `fetch()` call with Brotli.
2. 02Decompression runs by defaultbody-parser’s `inflate` option is on unless you turn it off; `fetch()` has no switch at all.
3. 03The decoder writes past its bufferAn invalid block switch is treated as needing more input, so the decoder keeps appending to an eight-byte buffer.
4. 04Same bug, other runtimesBun, .NET, Python’s brotli and brotlicffi, Envoy and Istio, brotli4j and Red Hat packages are all named.

Source: Node.js security release; Akamai; Rapid7; Microsoft .NET advisory; Bun v1.4.4 release · as of 27 October 2026

So the inventory question is wider than “which Node.js versions do we run”. Microsoft published .NET 8.0.33, 9.0.22 and 10.0.14 for the same CVE on 25 October.[9] Bun shipped 1.4.4 on 22 October.[22] Rapid7 lists the upstream Brotli ranges as 1.0.3 before 1.0.10, 1.1.0 before 1.1.1 and 1.2.0 before 1.2.1, which is the string to search a software bill of materials for.[7] Node.js offers no workaround. If you cannot upgrade an Express service today, setting `inflate: false` makes it reject compressed bodies with HTTP 415.[8] The same release updated Node’s bundled root certificates for the eMudhra intermediate CA compromise, which we cover in [eMudhra’s private key was the number 4](https://www.thetechbag.com/blog/emudhra-root-distrusted-in-100-minutes).[6]

## Oracle: 1,295 patches, one EBS bug being probed, and the Java fix that came a day late

Oracle’s October Critical Patch Update, published 20 October, contains 1,295 new security patches.[10] Volume is not the useful measure. Severity is, and severity is concentrated in a few product families.

**Figure: Fusion Middleware and Communications hold 70 of the 112 critical-rated patches; Java SE holds none**

*Oracle Critical Patch Update, October 2026: new security patches by product family, split at CVSS 3.1 base score 9.0*

Fusion Middleware

40

166

206 patches

E-Business Suite

190

194 patches

Database products

112

126 patches

Siebel CRM

119

122 patches

Communications

30

80

110 patches

PeopleSoft

107

109 patches

JD Edwards

97

102 patches

MySQL

94

98 patches

Java SE

55

55 patches

All other families

163

173 patches

|  | CVSS 9.0 or higher | Below 9.0 |
| --- | --- | --- |
| Fusion Middleware | 40 | 166 |
| E-Business Suite | 4 | 190 |
| Database products | 14 | 112 |
| Siebel CRM | 3 | 119 |
| Communications | 30 | 80 |
| PeopleSoft | 2 | 107 |
| JD Edwards | 5 | 97 |
| MySQL | 4 | 94 |
| Java SE | 0 | 55 |
| All other families | 10 | 163 |

Source: Oracle Critical Patch Update Advisory, October 2026, risk matrices; TechBag count · as of 26 October 2026 · Database products include Essbase, REST Data Services, GoldenGate and APEX, as Oracle groups them. Counts are risk-matrix rows; 112 rows cover 95 unique CVEs

TechBag countTechBag count

We counted the risk-matrix rows on Oracle’s advisory: 1,295 rows, 1,209 unique CVEs, 112 rows scored 9.0 or higher, and 90 of those 112 exploitable over the network without credentials. The highest E-Business Suite score is not the 9.8 most coverage quoted. It is a 10.0, CVE-2026-101809 in the Workflow Notification Mailer. Java SE’s 55 patches top out at 7.5.

The EBS bug drawing attention is CVE-2026-101767, an unauthenticated SQL injection in the Thin Client Framework servlet at` /OA_HTML/AppsTCFServer`. It chains to operating-system commands, affects versions 12.2.3 to 12.2.15, and the default EBS URL firewall allows the endpoint. Horizon3 reported it to Oracle on 24 July.[11] On 27 October Defused’s EBS decoys recorded “exploratory exploits” against it, and Shadowserver tracks more than 670 internet-exposed EBS instances, most of them in the United States.[12] It was not in the KEV catalogue as of 29 October.[1] If you cannot patch this week, Horizon3’s interim step is to remove that servlet from the URL firewall allowlist.[11]

Java is where the calendar misleads. The CPU’s Java SE section has 55 patches, 49 of them exploitable over the network without credentials, but none critical: the top score is 7.5.[10] The serious Java fix arrived on 21 October as Security Alert CVE-2026-91403, a 9.1 in JSSE. That update distrusts the eMudhra intermediate CA certificates. It lists Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, and GraalVM, as affected.[13] Those versions are newer than the ones the CPU lists as affected (8u503, 11.0.32.1 and so on), so a team that patched Java on 20 October still needs the next update.[10]

## The rest of the week, and the order to patch in

**Fortinet** released FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14 on 22 October, with FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator alongside. CVE IDs and scores follow on 10 November, Fortinet’s next Patch Tuesday.[14] For 19 days you have a version table and the vendor’s word that it includes “critical and high-severity fixes”. That is enough to act on.

**EDK II**, the open-source reference UEFI code that much commercial firmware is built on, has CVE-2026-97631 (CVSS v4 9.5). While a machine PXE-boots, an oversized ICMP error message overflows a 504-byte field and can run attacker code “before Secure Boot or measured boot has verified or measured any OS component”.[15] The fix was merged on 15 October, a week before the 22 October advisory, and the pull request named the CVE. On 28 October Hetzner told customers to avoid rebooting PXE-booting hosts and to block inbound ICMP during reboots.[16]

**jackson-databind**, the JSON library inside most enterprise Java, published CVE-2026-110879 on 20 October: a 9.8 bypass of its polymorphic type validator. It is an incomplete fix of an earlier CVE and is fixed in 2.18.12, 2.21.8, 2.22.4, 3.1.8 and 3.2.4. It applies where class-name polymorphism is in use: configured default typing in 2.x or 3.x, or annotation-based class-name type IDs, which a default 3.x mapper accepts. An application that does neither is not on this path.[17] And LiteLLM’s poisoned 1.107.0 release on 21 October belongs on the same list. We covered it in [Two CERT-In advisories in six days](https://www.thetechbag.com/blog/cert-in-ai-agents-no-victim-noticed).

**Figure: Patch by evidence of exploitation and exposure, not by CVSS score or vendor size**

*TechBag's recommended patch order for the 20 to 29 October 2026 cluster*

Step 1 of 6

1. Internet-facing PHP

In KEV, three-day federal deadline. Include appliances with a PHP management UI. Restart every worker after updating.

Source: CISA KEV feed; PHP, Node.js, Fortinet, Oracle, TianoCore and FasterXML advisories; TechBag analysis · as of 30 October 2026

Our view

Our view: the monthly patch window was built for a world where a working exploit took weeks to appear after the fix. This month the PHP exploit attempts came before the fix, and CISA’s deadline was three days. The practical change is a standing “exploited-in-the-wild” lane that bypasses the normal change calendar for anything internet-facing, with a named owner for each runtime. CVSS is a poor sort key: the 10.0 in EBS drew less attention than the 9.8 beside it, and the 9.2s were the ones exploited.

If you are buying this in India

CERT-In moved quickly on this cluster. It issued advisories on Oracle’s CPU (CIAD-2026-0051) and PHP2Shell (CIAD-2026-0052) on 22 October, Fortinet’s release (CIAD-2026-0054) on 24 October and the Brotli decoder (CIAD-2026-0055) on 27 October, alongside its eMudhra and LiteLLM advisories.[19] The PHP advisory is written for MSMEs and says “multiple reports confirm large scale exploitation in the wild”. It tells businesses that do not know their PHP version to ask their hosting provider or software vendor.[18] That is the realistic Indian exposure: small-business sites on shared hosting where the PHP build belongs to someone else. No public source gives an India-specific host count for any of these CVEs, and VulnCheck publishes no country split, so we do not estimate one.

India is on one named target list. Cyfirma’s report on a suspected North Korean campaign that shortlisted 216 unpatched PHP hosts on 24 October names India among twelve target countries and regions, with government agencies and banks first in line.[5] Cyfirma rates the North Korean link at moderate confidence and names no victims. A web shell on a production host is a reportable incident under CERT-In’s Directions of 28 April 2022, which require a report within six hours of noticing it.[20] For a regulated entity, a KEV-listed remote-code-execution bug left open past the vendor fix will also be the first question an RBI or SEBI inspector is likely to ask. To find what you run, TechBag’s [vulnerability management guide](https://www.thetechbag.com/browse/security/vulnerability-management) compares the scanners that inventory runtimes and appliance firmware.

How we did this

Figures as of 30 October 2026

KEV dates and federal due dates come from CISA’s KEV JSON feed, catalogue version 2026.10.29. The Oracle totals, family split, CVSS 9.0-or-higher count and Java SE maximum are TechBag’s count of the risk-matrix rows on Oracle’s advisory page, Rev 2 of 26 October. The family grouping follows Oracle’s section headings, and “All other families” is the remainder. The PHP host shares are VulnCheck’s; the supported-branch slice is the remainder. Node.js, Fortinet, EDK II, Java, .NET and jackson-databind facts are from the vendors’ own advisories or repositories. The EBS probing is BleepingComputer’s report; the Cyfirma findings are as reported by Security Affairs. CVSS scores are v3.1 unless marked v4, and the two are not directly comparable. Left out as unverified: an NVD score for PHP2Shell, claims of firewalls rooted with PHP2Shell, and the CVSS scores of the 29 October KEV additions.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [CISA, Known Exploited Vulnerabilities catalogue, JSON feed (date added and due date per CVE)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — catalogue 2026.10.29, fetched 30 October 2026
2. [CISA, CISA Adds Two Known Exploited Vulnerabilities to Catalog (CVE-2026-109618, CVE-2026-109619)](https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog) — 26 October 2026
3. [The Hacker News, Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed (Amazon, ELLIO, discoverers)](https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html) — 22 October 2026
4. [VulnCheck, PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619](https://www.vulncheck.com/blog/php2shell-vulnerabilities) — 21 October 2026, updated 26 October
5. [Security Affairs, PHP2Shell: suspected North Korean campaign targets 216 vulnerable PHP hosts (Cyfirma)](https://securityaffairs.com/201748/hacking/php2shell-suspected-north-korean-campaign-targets-216-vulnerable-php-hosts.html) — 26 October 2026
6. [Node.js, Wednesday, October 21, 2026 Security Releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) — 21 October 2026
7. [Rapid7, CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder](https://www.rapid7.com/blog/post/etr-cve-2026-111497-critical-out-of-bounds-write-in-the-node-js-brotli-decoder/) — 26 October 2026, updated 27 October
8. [Akamai Security Intelligence Group, Inside Node2Shell: a closer look at CVE-2026-111497](https://www.akamai.com/blog/security-research/inside-node2shell-closer-look-cve-2026-111497) — 26 October 2026
9. [Microsoft, Security Advisory CVE-2026-111497: .NET Brotli Decoder Out-of-bounds Write (GHSA-p3jp-9v83-76w9)](https://github.com/dotnet/runtime/security/advisories/GHSA-p3jp-9v83-76w9) — 25 October 2026
10. [Oracle, Critical Patch Update Advisory, October 2026 (risk matrices)](https://www.oracle.com/security-alerts/cpuoct2026.html) — 20 October 2026, Rev 2 26 October
11. [Horizon3.ai, CVE-2026-101767: Oracle EBS SQL Injection RCE](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/) — 20 October 2026
12. [BleepingComputer, Hackers now scanning systems for recently-patched Oracle flaw (Defused, Shadowserver)](https://www.bleepingcomputer.com/news/security/hackers-now-scanning-systems-for-recently-patched-oracle-flaw/) — 28 October 2026
13. [Oracle, Security Alert Advisory CVE-2026-91403](https://www.oracle.com/security-alerts/alert-cve-2026-91403.html) — 21 October 2026
14. [Fortinet CISO Collective, Carl Windsor, Fortinet Releases Security Hardening Release for Multiple Products](https://www.fortinet.com/blog/ciso-collective/fortinet-releases-security-hardening-release-for-multiple-products) — 21 October 2026
15. [TianoCore EDK II, GHSA-99cj-7hg9-mp4m: Pre-boot RCE in EDK II PXE driver; fix in pull request 13302 (merged 15 October)](https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m) — 22 October 2026
16. [Hetzner status, Warning CVE-2026-97631: critical security vulnerability in the EDK II UEFI firmware component](https://status.hetzner.com/incident/54493dac-b3a2-44f0-8d8b-6de8b25d8f17) — 28 October 2026, 17:08 UTC
17. [FasterXML, jackson-databind GHSA-m8xf-2cr7-77ph (CVE-2026-110879)](https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-m8xf-2cr7-77ph) — 20 October 2026
18. [CERT-In, CIAD-2026-0052: Advisory to MSME, Remote code execution vulnerabilities in PHP (PHP2Shell)](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0052) — 22 October 2026
19. [CERT-In, public advisory listing 2026 (CIAD-2026-0050 to 0055)](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBADVLIST02&year=2026) — fetched 30 October 2026
20. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting)](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022
21. [Help Net Security, What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers](https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/) — 22 October 2026
22. [Bun, release v1.4.4](https://github.com/oven-sh/bun/releases/tag/bun-v1.4.4) — 22 October 2026

Related on TechBag: the [vulnerability management guide](https://www.thetechbag.com/browse/security/vulnerability-management) covers the scanners that find these runtimes; the [RMM and patch guide](https://www.thetechbag.com/browse/endpoint-management/rmm-patch) covers the tools that push the fixes; the [Fortinet hub](https://www.thetechbag.com/fortinet) maps the products the hardening release touches.

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

Go deeper on TechBag

- [Vulnerability management guide](https://www.thetechbag.com/browse/security/vulnerability-management) — the scanners that inventory runtimes, libraries and appliance firmware
- [RMM and patch management guide](https://www.thetechbag.com/browse/endpoint-management/rmm-patch) — the tools that push runtime and OS fixes across a fleet
- [Fortinet vendor hub](https://www.thetechbag.com/fortinet) — FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, the products in the 22 October release