October 2026 security patches: PHP, Fortinet, Node.js and Windows

At a glance

Versions are the first fixed release on each supported branch. Anything newer is fine too.

PHP: "php2shell" fixes for websites

On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10. Both can lead to remote code execution, meaning an attacker could run their own code on the web server.

The US Cybersecurity and Infrastructure Security Agency (CISA), which calls the pair "php2shell", urged organisations to patch immediately. When CISA published its alert, it had not yet seen the flaws exploited.

PHP runs WordPress, WooCommerce and many other website platforms, so this affects a large share of small business websites.

Synology NAS drives. Synology rates the flaws critical for its optional PHP packages, Synology Calendar and Mail Station. Update them in Package Center: PHP 7.4, 8.0, 8.1, 8.2, 8.3 and 8.4 all have fixed versions, Calendar needs 3.0.4-21435 and Mail Station needs 30000002.3.19-20333. The PHP 7.3 package won't be fixed, so remove it. Synology says the PHP built into DSM itself isn't exposed to attacks from outside.

• Ask your host which PHP version your site runs, and whether it has been updated. On shared hosting the host normally does this. On your own server or VPS, it's your job.
• Only an update fully fixes it. PHP lists interim settings that reduce the risk, such as setting session.upload_progress.enabled = 0 in php.ini and restarting PHP, but says they don't make a site safe.
• Keep that setting off for now. On 23 October PHP recommended leaving upload progress switched off until its next regular release, because of a further issue (CVE-2026-115560) that it will publish details of then.
• PHP 8.1 and older no longer get fixes from the PHP project. Move to a supported version.
• PHP 8.2 reaches end of life on 31 December 2026. After that it gets no security fixes, so plan the move to a newer version now.

Changing the PHP version can break old plugins or themes, so test on a copy of the site first. Our guide to WordPress hosting and maintenance explains who should be looking after updates like this.

Fortinet: firewall and FortiManager updates

On 21 and 22 October 2026 Fortinet released security hardening updates for FortiOS (the software on FortiGate firewalls), FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. Fortinet's announcement says the releases include critical and high-severity fixes, and asks customers to treat them as a priority change rather than routine maintenance, starting with internet-facing devices.

The detailed advisories won't be published until 10 November 2026. Fortinet points out that the time between a fix and attacks is getting shorter, so don't wait for the details.

If you can't upgrade straight away, Fortinet's interim advice is:

• allow firewall admin access (HTTPS and SSH) only from trusted IP addresses, or turn it off on internet-facing interfaces;
• keep FortiManager's admin interface off the internet;
• use strong, unique passwords and two-step login (MFA) for admin accounts;
• back up configurations before upgrading;
• check logs for unusual admin logins or configuration changes.

These reduce the risk but don't replace the upgrade.

FortiSandbox (added 27 October). On 13 October Fortinet also fixed a critical flaw in FortiSandbox (CVE-2026-107656, rated 9.6) that lets an attacker who isn't signed in get past the login on the web management interface. Upgrade FortiSandbox and FortiSandbox PaaS 5.0 to 5.0.7 or later and FortiSandbox 4.4 to 4.4.10 or later; PaaS 4.4 needs moving to a fixed release. Version 5.2 isn't affected, and Fortinet doesn't list it as exploited.

The Brotli flaw: Node.js, .NET and Palo Alto

Node.js released versions 22.23.4 and 24.22.1 (both long-term support) and 26.12.1 on 21 October 2026, fixing ten vulnerabilities. Four are rated high.

• CVE-2026-111497: a flaw in the Brotli decompression code built into Node.js. If an app decompresses Brotli data that an attacker supplies, it can crash, leak memory contents or allow remote code execution.
• TLS hostname checks: two high-rated fixes stop specially crafted addresses getting past the checks that confirm a secure connection is going to the right server.

Node.js is behind many custom web apps, online booking systems, APIs and website build tools. If a developer built software for you, ask whether it runs on Node.js and when it will be updated. Apps that run in Docker need their images rebuilt with the new version. Node.js warns that versions past their end of life are always affected and don't get fixes.

Microsoft .NET (added 26 October). The same Brotli flaw, CVE-2026-111497, also affects Microsoft .NET. Microsoft released emergency updates on 25 October: .NET 8.0.33, 9.0.22 and 10.0.14, and .NET 11 Release Candidate 3. It affects apps that decompress Brotli data, through ASP.NET Core request decompression, HttpClient automatic decompression or the Brotli APIs. Microsoft says the decompression features aren't switched on by default, and the older .NET Framework isn't affected. Microsoft hasn't reported any attacks, but recommends updating as soon as possible. If a developer built a .NET app or website for you, ask them to update and redeploy it.

PHP on Windows. On 26 October the PHP project also re-released its Windows builds with a fixed Brotli library. On those builds the flaw can only be reached through cURL with automatic decompression, which is off by default.

Palo Alto Networks firewalls (added 27 October). Palo Alto has confirmed that the same Brotli flaw affects PAN-OS 11.2, 12.1 and 12.2 on PA-Series and VM-Series firewalls, rated critical (9.2). A firewall is only exposed if it both inspects Brotli-compressed traffic and decrypts TLS traffic. Brotli inspection is switched off by default from PAN-OS 11.2.4. The management interface, Panorama, and PAN-OS 11.1 and 10.2 aren't affected, and Palo Alto isn't aware of any attacks.

• Check: on the firewall's command line, run show system setting brotli. If it says Enabled: yes, the firewall is exposed. On PAN-OS 12.1.2 and later, the "Allow Brotli Encoding" box is under Device > Setup > Content-ID.
• Fix: install the hotfix for your version: 12.2.4-h1; 12.1.4-h13, 12.1.7-h11 or 12.1.10-h3; or 11.2.4-h23, 11.2.7-h23, 11.2.10-h17, 11.2.13-h4 or 11.2.16-h1. Some of these were still due between 27 and 30 October, so check Palo Alto's advisory for your exact version.
• Until then: switch Brotli inspection off with set system setting brotli-encoding disable, then commit.

Palo Alto has also published a separate advisory on how the PHP flaws above affect its products, and says the same hotfix covers both. If someone else manages your firewall, ask them to confirm it has been checked.

Windows: October updates and the end of 24H2

Microsoft's monthly updates on 13 October 2026 fix a Windows flaw that was already being exploited, CVE-2026-96951. CISA describes it as a command injection flaw that lets an attacker bypass a security feature over a network. SecurityWeek reports that it gets round the "Mark of the Web" warnings Windows shows for downloaded files, and that this month's release fixed a record 1,413 vulnerabilities.

Check that Windows Update shows the October 2026 updates as installed, and restart PCs that are waiting to finish. Windows 10 PCs only get these fixes if they're enrolled in Extended Security Updates. Our Windows 10 ESU guide explains the options.

Windows 11 version 24H2 Home and Pro (added 27 October). According to Microsoft's lifecycle page, Windows 11 24H2 Home and Pro editions reached the end of updates on 14 October 2026, so PCs still on that version no longer get security fixes. Move them to version 25H2, which is supported until October 2027. In Settings > System > About, the version is shown under "Windows specifications". Enterprise and Education editions of 24H2 are supported until October 2027.

Other flaws attackers are already using

CISA's Known Exploited Vulnerabilities catalogue lists flaws with evidence of active exploitation. These recent additions cover products that small and medium businesses commonly use:

If you use any of these, check with the vendor or your IT provider that the fix is installed. Plex often runs on office NAS drives, so don't forget those.

Arista VeloCloud Orchestrator: Arista says the flaw is actively exploited and lets anyone with even a read-only login take over the orchestrator. On-premises orchestrators need 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later. Hosted orchestrators have already been patched.

Other updates worth installing

None of these is known to be exploited, but they fix serious flaws in software many businesses use:

What to update first

You can't patch everything at once, so start with what attackers can reach directly:

1. Firewalls, VPNs and email gateways. They face the internet by design, and several are on CISA's exploited list this month.
2. Websites and web apps. PHP and Node.js run on servers that anyone can reach.
3. Windows PCs and servers. Install the October updates and restart.
4. Everything else. NAS drives, media servers, backup software and other devices on your network.

For more on building a routine for updates, backups and two-step login, see our cyber security checklist for small businesses and the National Cyber Security Centre's advice on keeping devices updated.

This week's checklist

1. List your firewalls and VPNs and the software version each one runs.
2. Upgrade FortiOS, FortiManager and FortiAnalyzer to the fixed versions, after backing up the configuration. On Palo Alto firewalls, check whether Brotli inspection is on and install the hotfix.
3. Make sure firewall admin pages aren't reachable from the internet, and admin accounts use two-step login.
4. Ask your web host which PHP version your site runs, and confirm it's 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer.
5. Plan to move off PHP 8.2 before 31 December 2026, and off PHP 8.1 or older straight away.
6. Ask your developers to update Node.js apps to 22.23.4, 24.22.1 or 26.12.1, and .NET apps to 8.0.33, 9.0.22 or 10.0.14.
7. Confirm every Windows PC has the October 2026 updates, that Windows 11 PCs are on version 25H2, and that Windows 10 PCs are enrolled in ESU.
8. If you use a Palo Alto firewall for remote access, check it has the GlobalProtect fixes from May.
9. Update iPhones, iPads, Macs, browsers and Zoom, and any Synology PHP packages.
10. Check the CISA table above against your own equipment.
11. Afterwards, check logs for unusual admin logins or configuration changes.

Sources: PHP project announcements and security advisory; CISA, Critical vulnerabilities in PHP require immediate patching; Fortinet, security hardening release for multiple products; FortiGuard PSIRT advisories; Node.js, October 2026 security releases; SecurityWeek, Microsoft's October 2026 updates; CISA Known Exploited Vulnerabilities catalogue. BleepingComputer, PHP2Shell flaws now exploited; Microsoft, .NET October 2026 out-of-band security updates; CISA, Collabora Online added to KEV; CISA, Arista VeloCloud added to KEV. Palo Alto Networks, CVE-2026-111497 (Brotli); Palo Alto Networks, PHP vulnerabilities. Unit 42, GlobalProtect CVE-2026-0257 exploitation; Fortinet, FortiSandbox FG-IR-26-185; Arista, Security Advisory 0199; Microsoft, Windows 11 Home and Pro lifecycle; Synology-SA-26:14; Apple security releases; Mozilla security advisories; Zoom security bulletins; Atlassian, Security Bulletin 20 October 2026. Information first checked on 23 October 2026 and updated on 27 October 2026.