As of 25 October 2026
"Black October" is the informal name for an unusual cluster of serious security disclosures between roughly 17 and 22 October 2026. Affected were, among others, PHP, Node.js, GitLab, the AI library LiteLLM and the certificate authority eMudhra. Notably, some of the vulnerabilities were found with AI-assisted tools: bugs that had sometimes been in the code for years are now discovered faster - and exploited faster, too.
PHP: critical flaws in the interpreter
On 21 October the PHP project released security updates for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Our status: We have updated PHP on our servers. None of the websites we look after is left unprotected. Details on what we did and on older systems can be found in our report (in German): PHP-Sicherheitslücke: Was passiert ist und wie es weitergeht.
Node.js: security release for all supported versions
Also on 21 October, the Node.js project released updates for the 22, 24 and 26 release lines. The most serious flaw (CVE-2026-111497) is in the built-in Brotli decompressor: crafted data can cause crashes, memory disclosure or even remote code execution. In addition, several flaws in TLS certificate and DNS name checks were fixed.
The fixes are included in:
- Node.js 26.12.1
- Node.js 24.22.1 (LTS)
- Node.js 22.23.4
Our status: We have also updated Node.js on our servers to the patched versions.
What you should do now
Node.js often runs in places we have no access to: on your team's workstations, on development and build machines, in your own Docker images or on servers you run yourself. Please check these systems and update them:
- Check the version: run
node -vin a terminal. Anything below the versions listed above is affected. - Update: use the installer from nodejs.org, your operating system's package manager or your version manager (e.g. nvm, fnm, Volta) to switch to the patched version of your release line.
- Don't forget containers and pipelines: rebuild Docker images based on a
nodebase image so they pull the current version. The same applies to CI/CD pipelines with a pinned Node.js version. - Replace outdated versions: Node.js 20 and older no longer receive security updates and remain vulnerable. The only fix is moving to a supported version.
If you run your own servers with PHP, the same applies: please update to the PHP versions listed above as soon as possible. PHP 8.1 and older no longer receive regular updates.
We are here to help
Not sure which of your systems are affected, or would you rather not do the update yourself? Get in touch at info@web-crossing.com or +43 512 206567 - we'll work out together with you what needs to be done.
Your web-crossing team
