{
  "id": 16329510,
  "title": "PHP2Shell, Node.js, GitLab & LiteLLM Vulnerabilities: October 2026 Patch Guide",
  "url": "https://urgent.news/2026/10/24/php2shell-node-js-gitlab-litellm-vulnerabilities-october-2026-patch",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-24T13:42:33.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/asyncinnovator/php2shell-nodejs-gitlab-litellm-vulnerabilities-october-2026-patch-guide-25le"
  },
  "original_language": "en",
  "account": "Four major software platforms received critical security updates within a one week time frame in October 2026. PHP, Node.js, GitLab, and LiteLLM all released patches or dealt with serious incidents.\n\nFor PHP, two CVE vulnerabilities were patched in versions 8.5.12 and later, 8.4.27 and later, 8.3.36 and later, and 8.2.35 and later. PHP 8.1 and earlier are no longer supported. The issues allowed unauthenticated remote code execution through memory management bugs.\n\nNode.js addressed a Brotli decoder out-of-bounds write vulnerability (CVE-2026-111497) and three additional issues, all fixed in versions 22.23.4, 24.22.1, and 26.12.1. The flaw enabled remote code execution when decompressing Brotli data controlled by an attacker. Node versions 20 and lower are no longer supported.\n\nGitLab suffered two critical remote code execution vulnerabilities. The first, CVE-2026-97229, was patched in version 19.4.2 and later. The second, CVE-2026-110264, required updates to versions 19.5.1 and later to mitigate a regex-engine overflow. GitLab.com and Dedicated servers are already patched. Self-managed instances must upgrade immediately as no workaround is available.\n\nLiteLLM was targeted by a supply chain attack where a malicious version 1.107.0 was published. The malware contained a credential stealer and loader that sought sensitive information like cloud and SSH keys. The attack was limited to Docker images and PyPI, but LiteLLM users should verify their installations and upgrade if necessary.",
  "summary": "Four of the most-used stacks on the internet got hit in the same week . PHP, Node.js, GitLab and LiteLLM all shipped critical fixes or suffered a serious incident between Oct 12 and Oct 22, 2026 . If you run a PHP site, a Node.js backend, a self-hosted GitLab or anything that talks to LLMs through LiteLLM, this guide gives you the short version: what broke, am I affected, and what to run. That's…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}