October 2026 brought PHP2Shell, GitLab, Node.js, Plex, LiteLLM and several platform breaches within about three weeks. They are separate incidents with separate fixes, so the useful question is which of them touch what you run. This page sets out what needs action as of 24 October 2026 and points you to the article that fits your situation.
What matters right now
- PHP2Shell (CVE-2026-109618 and CVE-2026-109619, disclosed 21 October) applies to any site served by PHP. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or a vendor backport, and the workers need a restart afterwards. Source: the php.net notice.
- GitLab CVE-2026-110264 is rated CVSS 10.0 for self-managed installs. GitLab lists fixes in 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1 in its patch notice.
- Plex Media Server before 1.43.3.10861 is reported as actively exploited, and CISA added four Plex CVEs to its catalog on 20 October. See the CISA bulletin.
- Node.js shipped security releases on 21 October, 22.23.4, 24.22.1 and 26.12.1, including a fix for a Brotli decoder bug that can lead to remote code execution. Source: the Node.js notice.
- LiteLLM 1.107.0 was published with malicious artifacts on 21 October. The maintainer says to rebuild and rotate every secret the host could reach, in its incident report. Railway, Zeabur and TiDB Cloud customers follow each vendor's own rotation list.
Where to start
- If you want every incident in one table with its fixed version and status, open the October 2026 incident tracker.
- If you want a to-do list by role, with the question to send your host, use the checklist for this week.
- If you run WordPress, WooCommerce or any other PHP site, read the PHP2Shell guide first.
- If you ran LiteLLM or keep secrets on a hosting platform, follow the LiteLLM 1.107.0 write-up for what to rebuild and rotate.
A version your site shows from outside is a lead, and your host or server holds the evidence of a patch. The free scan reads the stack your site serves and matches each version to known vulnerabilities, one per domain, no card.