PHP2Shell, Node.js, GitLab & LiteLLM Vulnerabilities: October 2026 Patch Guide
Four of the most-used stacks on the internet got hit in the same week . PHP, Node.js, GitLab and LiteLLM all shipped critical fixes or suffered a serious incident between Oct 12 and Oct 22, 2026 . If you run a PHP site, a Node.js backend, a self-hosted GitLab or anything that talks to LLMs through LiteLLM, this guide gives you the short version: what broke, am I affected, and what to run. That's…
Four major software platforms received critical security updates within a one week time frame in October 2026. PHP, Node.js, GitLab, and LiteLLM all released patches or dealt with serious incidents.
For PHP, two CVE vulnerabilities were patched in versions 8.5.12 and later, 8.4.27 and later, 8.3.36 and later, and 8.2.35 and later. PHP 8.1 and earlier are no longer supported. The issues allowed unauthenticated remote code execution through memory management bugs.
Node.js addressed a Brotli decoder out-of-bounds write vulnerability (CVE-2026-111497) and three additional issues, all fixed in versions 22.23.4, 24.22.1, and 26.12.1. The flaw enabled remote code execution when decompressing Brotli data controlled by an attacker. Node versions 20 and lower are no longer supported.
GitLab suffered two critical remote code execution vulnerabilities. The first, CVE-2026-97229, was patched in version 19.4.2 and later. The second, CVE-2026-110264, required updates to versions 19.5.1 and later to mitigate a regex-engine overflow. GitLab.com and Dedicated servers are already patched. Self-managed instances must upgrade immediately as no workaround is available.
LiteLLM was targeted by a supply chain attack where a malicious version 1.107.0 was published. The malware contained a credential stealer and loader that sought sensitive information like cloud and SSH keys. The attack was limited to Docker images and PyPI, but LiteLLM users should verify their installations and upgrade if necessary.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
