Frameworks and runtimes sit underneath your pages, and a bug there reaches every site built on them. October 2026 has brought critical fixes for Next.js and Rails, a Laravel component on CISA's exploited list, and routine releases for Django, Symfony and Express. Each fix only counts once the new build is deployed and running.
What matters right now
- Next.js has two critical remote code execution fixes. Versions 16.4.1 and 15.5.28 cover the
use cache bug and the SVG image optimizer bug, per the Next.js security update of 14 October 2026.
- Livewire v3 up to 3.6.3 is on CISA's exploited list. CVE-2025-54068 was added on 20 March 2026, and 3.6.4 is the fixing release, per the CISA catalog entry.
- Rails Active Storage has a critical flaw. CVE-2026-66066 is fixed in 7.2.3.2, 8.0.5.1 and 8.1.3.1, and the Rails team advises rotating secrets after upgrading, per the Rails security announcement.
- Symfony fixed three High denial of service issues on 15 October 2026. They affect HeaderUtils, the YAML component and ExpressionLanguage, per the Symfony security advisories.
- Django shipped 6.1.2, 6.0.9 and 5.2.18 on 6 October 2026. The Django announcement lists four issues.
Where to start
- If you run Next.js, start with the October 14 use cache and SVG fix. Then see whether the Server Actions denial of service applies to your router.
- If you are not sure your Next.js build is past the December 2025 bug, use the React2Shell version check.
- If you run Laravel with Livewire, check your Livewire version. If an
APP_KEY may have leaked, rotate it safely.
- If you run Drupal, Joomla, MediaWiki or Laravel on PHP, the PHP2Shell framework checklist explains why the runtime is what changes.
- If you run Rails with image uploads, read the Active Storage libvips guide.
- If your stack is Symfony or Django, compare your branch with the Symfony fix list or the Django releases for a SaaS.
- If you run Node with Express, check the Multer and body-parser updates. If you start Vite with
--host, read about the exposed dev server .env leak.
- If you want to prove an upgrade took effect, follow how to verify a fix.
The free scan on Red by run.cloud identifies the frameworks your site serves and matches each version to public records. It can say a version is affected, but it cannot see a vendor backport or whether your servers restarted, so your host or build log has to confirm the rest.