The fixes are official. We apply them properly.
In October 2026, PHP, Node.js and several platforms published fixes for critical vulnerabilities. We help you find out what is exposed, update without downtime, check whether you have already been attacked and move older applications onto supported versions.
Versions fixed on 21 October 2026
What happened
Node.js
21.10.2026Node.js published fixes for ten vulnerabilities, one with remote code execution. The 18 and 20 lines are out of support and do not receive the fix.
We do not invent fixes. We apply the official ones.
The steps come from PHP, Node.js, DNSC and CERT-EU. Our part is applying them to your systems, with a backup first, a test on a copy and a rollback plan, exactly as we work on our own servers.
About prices
The prices below are indicative, in Romanian lei (RON), excluding VAT, and start from the simplest case. Every system is different, so we make the final quote once we have seen yours. Urgent work outside working hours carries a 50% surcharge.
First step: where you stand
Before any update, we find out what runs, where and in which version. It is the first step DNSC, the NCSC and the FBI all ask for.
1.Exposure inventory
A complete list of where PHP, Node.js, WordPress, GitLab or NGINX run: websites, forgotten subdomains, test servers, internal applications, devices with a web interface. For each, the version and who is responsible for it.
2.On-server diagnosis
With server access: the PHP version the web server actually uses, the distribution package, the risky settings and the logs since 20 October. It answers the question an outside check cannot.
Urgent: reduce the risk now
When the update cannot happen today. Temporary measures buy time, they do not solve the problem, and we tell you so in writing.
3.Emergency mitigation
We apply the temporary measures published by the PHP team: upload progress tracking switched off, request limits, uploads blocked where they are not needed, PHP processes restarted.
4.Application firewall and a closed origin
We switch on an application firewall (for example Cloudflare, which has PHP2Shell rules even on its free plan) and close direct access to the server. Without the second step the filter can be bypassed, as DNSC warns.
5.Fallback page
A temporary static version of the site (overview, contact, opening hours), served without PHP while we work on the server. It is the alternative to the full shutdown recommended by the NCSC and the FBI.
Updates: we apply the official fix
The fixes are published by PHP and Node.js. We apply them with a backup first, a test on a copy and a rollback plan.
6.PHP update
PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, with the processes restarted and the version in actual use checked. We recommend going straight to 8.4 or 8.5, because 8.2 leaves support on 31 December 2026.
7.Full WordPress update
Core, themes, plugins and PHP, on a test copy first. Includes an up-to-date UpdraftPlus, removal of UpdraftCentral keys and a check that plugins work with PHP 8.4 and 8.5.
8.Online shop update
WooCommerce, PrestaShop, Magento or OpenCart, updated outside peak hours, with the order and payment flow tested before and after.
9.Node.js update
Applications on the 22, 24 or 26 lines move to 22.23.4, 24.22.1 or 26.12.1, with images rebuilt on a pinned version rather than a moving tag. We did the same on our own site on 22 October.
10.Containers and servers
Up-to-date base images, pinned versions instead of “latest”, the certificate authority list refreshed after the eMudhra incident, and every image rebuilt.
Were we attacked? We check and clean up
Attempts started before the patch, so updating alone is not enough. We look for the signs DNSC published.
11.Compromise check
New or modified files, changed PHP settings, new scheduled tasks and SSH keys, processes started by PHP, new administrators, from 20 October onwards. On WordPress we also check for traces of the UpdraftCentral incident. The report says what we found and what cannot be ruled out.
12.Clean-up and rebuild
If the system is compromised: isolation, evidence kept, reinstallation from clean sources, restore from a verified backup, every password and key changed, and help reporting to the authorities. For legal obligations around personal data we point you to a lawyer.
13.Key and secret rotation
An inventory of keys (AI services, payments, databases, registries, email), rotation without downtime and a review of the providers' logs and invoices. It is the answer to the Railway and LiteLLM incidents.
Unsupported versions: porting, migration, rewrite
PHP 8.1 and older, like Node.js 20 and older, do not receive the October fixes. We choose the path after an audit, not from a template.
14.Migration audit
For applications on PHP 5, 7, 8.0 or 8.1, or on Node.js 16, 18 or 20: an analysis of the code and dependencies, an effort estimate and a written recommendation (update, port or rewrite), with its reasons.
15.Temporary bridge
While the migration is prepared: the minimal fixes PHP published for 7.4, 8.0 and 8.1, built from source, or an extended-support vendor's packages, plus isolation of the application (VPN, internal network, firewall). A bridge, not a final answer.
16.Porting to a supported version
The code adapted to PHP 8.4 or 8.5, or to Node.js 22 or 24, with dependencies replaced, automated tests where they are missing and a gradual move with rollback possible. The application and data stay yours; the foundation changes.
17.Modern rewrite
When porting would cost more than a new application: a rewrite on current technology, with data migration and a period of running in parallel. Only after the audit, with the cost comparison in writing.
Prevention: so the next wave is not an emergency
Vulnerability waves come back. What makes the difference is who watches the systems before it is urgent.
18.Dependency and access hygiene
Pinned and verified versions, dependency scanning on every build, removal of unused plugins and remote management connections, two-factor sign-in for administrators, minimal rights for service accounts.
19.Security maintenance
We follow the advisories from DNSC, CERT-EU, PHP, Node.js and your vendors, apply monthly and emergency updates for critical advisories, verify backups with test restores and send you a monthly report written for managers. Three levels: brochure site, online shop, application.
How we work
- 1We find out what runs and in which version.
- 2We reduce the risk right away if the update cannot happen today.
- 3We apply the official fix, with a backup and a test.
- 4We check whether the system has already been attacked.
- 5We leave behind a maintained system, not just a repaired one.
What we do not do
We do not work on network and security appliances (Cisco, Fortinet, Palo Alto), on SAP or on Windows Server, and we do not give legal advice. For these we recommend specialists, and we can handle the technical side of your applications alongside them.
In depth, on the blog
Guides written for managers, based on the official sources.
Official sources and resources
Everything this page states comes from here. We recommend reading them directly.
Not sure where to start?
Tell us which sites or applications you have and what they run on. We will reply with the right first step and a clear quote.
Get in touch