This article explains the October 2026 security updates applied to PHP and Node.js on GreenGeeks servers.
It also explains why the version your site reports may look older than the latest release on php.net or nodejs.org.
Table of Contents
- What Was Updated
- Why Your Version Number Looks the Same
- Patched Versions
- PHP Behavior Changes
- Restarting Your Node.js Application
- Node.js Versions Without a Fix
- Security Scanner Still Reports a Vulnerability
- Raw Changelog Output
- Questions
What Was Updated
GreenGeeks has patched PHP and Node.js against the vulnerabilities below.
PHP 8.2 through 8.5 now run upstream releases (8.2.35, 8.3.36, 8.4.27, and 8.5.12) that include the fix. PHP 5.2 through 8.1 use backported fixes.
| Software | CVE | What it fixes |
|---|---|---|
| PHP (all versions) | CVE-2026-109618 | Memory allocator hardening. A memory allocation failure no longer unwinds through half-updated engine state. |
| PHP (all versions) | CVE-2026-109619 | Request parser and shutdown hardening. Stale error handler data can no longer carry over into the next request. |
| Node.js | CVE-2026-105482 | DNS lookups now reject hostnames containing NUL bytes instead of passing a truncated name to the resolver. |
| Node.js | CVE-2026-106069, CVE-2026-106072 | TLS connections now reject non-canonical IPv4 hosts. |
| Node.js | CVE-2026-105481 | Closes a keep-alive HTTP response-queue desynchronisation left open by an earlier fix. |
| Node.js 22 and 24 | Upstream release | Updated to the latest upstream versions, 22.23.4 and 24.22.1. |
Why Your Version Number Looks the Same
GreenGeeks servers run CloudLinux, which applies security fixes directly to the PHP and Node.js versions already installed instead of moving them to a new version number. This practice is called backporting. Red Hat, AlmaLinux, and other enterprise Linux vendors use the same approach.
When a fix is backported, the version your site reports stays the same. Only the package release number (the number after the dash) changes. PHP 5.2 through 8.1 and Node.js 10 through 20 use this approach.
PHP 8.2 through 8.5 first followed the same pattern. On October 21, 2026, PHP 8.2 was patched as package 8.2.34-7 and still reported PHP 8.2.34. CloudLinux has since replaced that backport with upstream PHP 8.2.35 (package 8.2.35-1), and PHP 8.3, 8.4, and 8.5 moved to upstream releases the same way.
Comparing your version number to php.net or nodejs.org can make a patched build look out of date. The package release number and the changelog are the reliable indicators. The Raw Changelog Output section lists both for every package.
Patched Versions
If your site reports one of the versions below, it is running the patched build.
PHP
| PHP version | Your site reports | Patched package | Fix type |
|---|---|---|---|
| PHP 5.2 | 5.2.17 | alt-php52 5.2.17-242 | Backported |
| PHP 5.3 | 5.3.29 | alt-php53 5.3.29-220 | Backported |
| PHP 5.4 | 5.4.45 | alt-php54 5.4.45-203 | Backported |
| PHP 5.5 | 5.5.38 | alt-php55 5.5.38-183 | Backported |
| PHP 5.6 | 5.6.40 | alt-php56 5.6.40-147 | Backported |
| PHP 7.0 | 7.0.33 | alt-php70 7.0.33-148 | Backported |
| PHP 7.1 | 7.1.33 | alt-php71 7.1.33-114 | Backported |
| PHP 7.2 | 7.2.34 | alt-php72 7.2.34-97 | Backported |
| PHP 7.3 | 7.3.33 | alt-php73 7.3.33-82 | Backported |
| PHP 7.4 | 7.4.33 | alt-php74 7.4.33-81 | Backported |
| PHP 8.0 | 8.0.30 | alt-php80 8.0.30-69 | Backported |
| PHP 8.1 | 8.1.34 | alt-php81 8.1.34-39 | Backported |
| PHP 8.2 | 8.2.35 | alt-php82 8.2.35-1 | New upstream version |
| PHP 8.3 | 8.3.36 | alt-php83 8.3.36-1 | New upstream version |
| PHP 8.4 | 8.4.27 | alt-php84 8.4.27-1 | New upstream version |
| PHP 8.5 | 8.5.12 | alt-php85 8.5.12-1 | New upstream version |
PHP 8.2 through 8.5 received new upstream version numbers, so php -v shows the fixed version directly. PHP 5.2 through 8.1 are backported fixes, so php -v shows the same version as before.
Node.js
| Node.js version | Your app reports | Patched package | Fix type |
|---|---|---|---|
| Node.js 10 | v10.24.1 | alt-nodejs10 10.24.1-7 | Backported |
| Node.js 12 | v12.22.12 | alt-nodejs12 12.22.12-35 | Backported |
| Node.js 14 | v14.21.3 | alt-nodejs14 14.21.3-37 | Backported |
| Node.js 16 | v16.20.2 | alt-nodejs16 16.20.2-33 | Backported |
| Node.js 18 | v18.20.8 | alt-nodejs18 18.20.8-26 | Backported |
| Node.js 19 | v19.9.0 | alt-nodejs19 19.9.0-10 | Backported |
| Node.js 20 | v20.20.2 | alt-nodejs20 20.20.2-15 | Backported |
| Node.js 22 | v22.23.4 | alt-nodejs22 22.23.4-1 | New upstream version |
| Node.js 24 | v24.22.1 | alt-nodejs24 24.22.1-1 | New upstream version |
Node.js 22 and 24 received new upstream version numbers, so node -v shows the fixed version directly. Node.js 10 through 20 are backported fixes, so node -v shows the same version as before.
Node.js Versions Without a Fix
The following Node.js versions have not been updated: 6, 8, 9, and 11. These versions are end-of-life and are not expected to receive a fix.
If your application uses one of these versions, switch to a patched version in cPanel. Node.js 22 or later is recommended.
Security Scanner Still Reports a Vulnerability
Many security scanners, including PCI compliance scans, check only the version number and do not detect backported fixes. Scans of PHP 8.2 through 8.5 now see the fixed upstream version numbers. If a scan flags PHP or Node.js for these CVEs, open a support ticket. Support can provide written confirmation for your scan vendor.
Moving to a currently supported version (PHP 8.3 or later, Node.js 22 or later) is the permanent fix. End-of-life versions continue to be flagged by scanners even when patched.
Raw Changelog Output
Each package records its changes in a changelog. Because system package tools are not available from your hosting account, the output below shows the changelog for each package as read directly from the server. The PHP 8.2 through 8.5 entries were refreshed after CloudLinux released upstream-based builds, and show the common package. Use it to verify the date, release number, and CVE identifiers for your version.
The output shows only the most recent entries, and long entries are cut off after a fixed number of lines. Each package’s full changelog lists additional fixes from earlier releases.
PHP Changelog Output
== alt-php52-cli-5.2.17-242.el8.x86_64
* Wed Oct 21 2026 Juan Carlos Garcia - 5.2.17-242
- CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator
and the multipart request parser - report allocation failures without
re-entering the engine, and take substring_conf()'s length as size_t.
Adapted from upstream 712e60f9 (PHP 7.4 branch; upstream published no PHP 5
patch)
* Wed Sep 30 2026 Juan Carlos Garcia - 5.2.17-241
- CVE-2026-93682: out-of-bounds read in the http:// wrapper when a redirect
response carries an empty Location header. The relative-redirect test in
== alt-php53-cli-5.3.29-220.el8.x86_64
* Wed Oct 21 2026 Juan Carlos Garcia - 5.3.29-220
- CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator
and the multipart request parser - report allocation failures without
re-entering the engine, and take substring_conf()'s length as size_t.
Adapted from upstream 712e60f9 (PHP 7.4 branch; upstream published no PHP 5
patch)
* Mon Oct 05 2026 Tamar Zerekidze - 5.3.29-219
- CVE-2025-1218: out-of-bounds reads in the mysqlnd wire-protocol parser. A
malicious or compromised MySQL server could send a truncated packet and make
== alt-php54-cli-5.4.45-203.el8.x86_64
* Wed Oct 21 2026 Juan Carlos Garcia - 5.4.45-203
- CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator
and the multipart request parser - report allocation failures without
re-entering the engine, and take substring_conf()'s length as size_t.
Also disables the session upload-progress callback, as upstream does on the
EOL branches - session.upload_progress.enabled no longer has any effect.
Adapted from upstream 712e60f9 (PHP 7.4 branch; upstream published no PHP 5
patch)
* Mon Oct 05 2026 Tamar Zerekidze - 5.4.45-202
== alt-php55-cli-5.5.38-183.el8.x86_64
* Wed Oct 21 2026 Juan Carlos Garcia - 5.5.38-183
- CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator
and the multipart request parser - report allocation failures without
re-entering the engine, and take substring_conf()'s length as size_t.
Also disables the session upload-progress callback, as upstream does on the
EOL branches - session.upload_progress.enabled no longer has any effect.
Adapted from upstream 712e60f9 (PHP 7.4 branch; upstream published no PHP 5
patch)
* Mon Oct 05 2026 Tamar Zerekidze - 5.5.38-182
== alt-php56-cli-5.6.40-147.el8.x86_64
* Wed Oct 21 2026 Juan Carlos Garcia - 5.6.40-147
- CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator
and the multipart request parser - report allocation failures without
re-entering the engine, and take substring_conf()'s length as size_t.
Also disables the session upload-progress callback, as upstream does on the
EOL branches - session.upload_progress.enabled no longer has any effect.
Adapted from upstream 712e60f9 (PHP 7.4 branch; upstream published no PHP 5
patch)
* Mon Oct 05 2026 Tamar Zerekidze - 5.6.40-146
== alt-php70-cli-7.0.33-148.el8.x86_64
* Wed Oct 21 2026 Tamar Zerekidze - 7.0.33-148
- CVE-2026-109618: do not bail out from inside the memory manager; an
allocation failure now reports to stderr and terminates the worker instead
of unwinding through half-updated engine state
- CVE-2026-109619: clear the error and exception handler globals at request
shutdown so a bailout cannot carry them into the next request
- Behaviour change: exhausting memory_limit now terminates the worker process;
the fatal error goes to stderr and shutdown functions do not run
- Behaviour change: session.upload_progress is disabled
- Wire php-7.0.33-bug78620.patch into debian/rules; the deb build was missing
== alt-php71-cli-7.1.33-114.el8.x86_64
* Wed Oct 21 2026 Tamar Zerekidze - 7.1.33-114
- CVE-2026-109618: do not bail out from inside the memory manager; an
allocation failure now reports to stderr and terminates the worker instead
of unwinding through half-updated engine state
- CVE-2026-109619: clear the error and exception handler globals at request
shutdown so a bailout cannot carry them into the next request
- Behaviour change: exhausting memory_limit now terminates the worker process;
the fatal error goes to stderr and shutdown functions do not run
- Behaviour change: session.upload_progress is disabled
== alt-php72-cli-7.2.34-97.el8.x86_64
* Wed Oct 21 2026 Tamar Zerekidze - 7.2.34-97
- CVE-2026-109618: do not bail out from inside the memory manager; an
allocation failure now reports to stderr and terminates the worker instead
of unwinding through half-updated engine state
- CVE-2026-109619: clear the error and exception handler globals at request
shutdown so a bailout cannot carry them into the next request
- Behaviour change: exhausting memory_limit now terminates the worker process;
the fatal error goes to stderr and shutdown functions do not run
- Behaviour change: session.upload_progress is disabled
== alt-php73-cli-7.3.33-82.el8.x86_64
* Wed Oct 21 2026 Tamar Zerekidze - 7.3.33-82
- CVE-2026-109618: do not bail out from inside the memory manager; an
allocation failure now reports to stderr and terminates the worker instead
of unwinding through half-updated engine state
- CVE-2026-109619: clear the error and exception handler globals at request
shutdown so a bailout cannot carry them into the next request
- Behaviour change: exhausting memory_limit now terminates the worker process;
the fatal error goes to stderr and shutdown functions do not run
- Behaviour change: session.upload_progress is disabled
== alt-php74-cli-7.4.33-81.el8.x86_64
* Wed Oct 21 2026 Juan Carlos Garcia - 7.4.33-81
- CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator
and the multipart request parser - report allocation failures without
re-entering the engine, and take substring_conf()'s length as size_t.
Upstream 712e60f9 (PHP 7.4 branch)
Also disables the session upload-progress callback, as upstream does on the
EOL branches - session.upload_progress.enabled no longer has any effect.
* Mon Oct 05 2026 Tamar Zerekidze - 7.4.33-80
- CVE-2025-1218: the mysqlnd wire-protocol packet readers decoded fields out of
== alt-php80-cli-8.0.30-69.el8.x86_64
* Wed Oct 21 2026 Juan Carlos Garcia - 8.0.30-69
- CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator
and the multipart request parser - report allocation failures without
re-entering the engine, and take substring_conf()'s length as size_t.
Upstream 82f8f31b (PHP 8.0 branch)
Also disables the session upload-progress callback, as upstream does on the
EOL branches - session.upload_progress.enabled no longer has any effect.
* Mon Oct 05 2026 Tamar Zerekidze - 8.0.30-68
- CVE-2025-1218: fix a set of out-of-bounds reads in the mysqlnd wire protocol
== alt-php81-cli-8.1.34-39.el8.x86_64
* Wed Oct 21 2026 Juan Carlos Garcia - 8.1.34-39
- CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator
and the multipart request parser - report allocation failures without
re-entering the engine, and take substring_conf()'s length as size_t.
Upstream 1d7dec17 (PHP 8.1 branch)
Also disables the session upload-progress callback, as upstream does on the
EOL branches - session.upload_progress.enabled no longer has any effect.
* Mon Oct 05 2026 Tamar Zerekidze - 8.1.34-38
- CVE-2025-1218: fix out-of-bounds reads in the mysqlnd wire-protocol packet
== alt-php82-common-8.2.35-1.el8.x86_64
* Wed Oct 21 2026 CloudLinux Packaging Team - 8.2.35-1
- Update to 8.2.35
- Drop the CVE-2026-109618, CVE-2026-109619 backport, fixed upstream in 8.2.35
* Wed Oct 21 2026 Juan Carlos Garcia - 8.2.34-7
- CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator,
the multipart request parser and the session upload-progress path - report
allocation failures without re-entering the engine, take substring_conf()'s length as
size_t, and stop the upload-progress handler running user code
while it decodes and re-encodes the session mid-request.
== alt-php83-common-8.3.36-1.el8.x86_64
* Wed Oct 21 2026 CloudLinux Packaging Team - 8.3.36-1
- Update to 8.3.36
- Drop the CVE-2026-109618, CVE-2026-109619 backport, fixed upstream in 8.3.36
* Wed Oct 21 2026 Juan Carlos Garcia - 8.3.35-6
- CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator,
the multipart request parser and the session upload-progress path - report
allocation failures without re-entering the engine, take substring_conf()'s length as
size_t, and stop the upload-progress handler running user code
while it decodes and re-encodes the session mid-request.
== alt-php84-common-8.4.27-1.el8.x86_64
* Wed Oct 21 2026 CloudLinux Packaging Team - 8.4.27-1
- Update to 8.4.27
- Drop the CVE-2026-109618, CVE-2026-109619 backport, fixed upstream in 8.4.27
* Wed Oct 21 2026 Tamar Zerekidze - 8.4.26-5
- CVE-2026-109618: do not bail out from inside the memory manager; allocation
failures are reported through a deferred error instead of unwinding through
half-updated engine state
- CVE-2026-109619: clear stale request globals at shutdown so a bailout cannot
carry them into the next request
== alt-php85-common-8.5.12-1.el8.x86_64
* Wed Oct 21 2026 CloudLinux Packaging Team - 8.5.12-1
- Update to 8.5.12
- Drop the CVE-2026-109618, CVE-2026-109619 backport, fixed upstream in 8.5.12
* Wed Oct 21 2026 Tamar Zerekidze - 8.5.11-5
- CVE-2026-109618: do not bail out from inside the memory manager; allocation
failures are reported through a deferred error instead of unwinding through
half-updated engine state
- CVE-2026-109619: clear stale request globals at shutdown so a bailout cannot
carry them into the next requestNode.js Changelog Output
== alt-nodejs10-nodejs-10.24.1-7.el8.x86_64
* Thu Oct 22 2026 Juan Carlos Garcia - 10.24.1-7
- CVE-2026-105481: http: check an idle keep-alive socket for unread bytes
before handing it to a request, so a response written before the request
was sent cannot be parsed as that request's response
- CVE-2026-105482: dns: reject names containing NUL bytes in the resolve*()
and reverse() paths instead of handing a truncated name to c-ares
(Resolver#setLocalAddress does not exist on 10.x, so that half of the
upstream change is not applicable here)
- CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes in
lookup() and net.connect(); carried as a prerequisite of CVE-2026-105482,
== alt-nodejs12-nodejs-12.22.12-35.el8.x86_64
* Thu Oct 22 2026 Juan Carlos Garcia - 12.22.12-35
- CVE-2026-105482: dns: reject hostnames containing NUL bytes in the
resolve*() paths instead of handing a truncated name to c-ares
(Resolver#setLocalAddress does not exist on 12.x, so that half of the
== alt-nodejs14-nodejs-14.21.3-37.el8.x86_64
* Thu Oct 22 2026 Arseniy Zolotarev - 14.21.3-37
- CVE-2026-105482: dns: reject hostnames with NUL bytes in resolve and
setLocalAddress instead of passing a truncated name to c-ares
- CVE-2026-106069, CVE-2026-106072: tls: reject non-canonical IPv4 hosts
== alt-nodejs16-nodejs-16.20.2-33.el8.x86_64
* Thu Oct 22 2026 Arseniy Zolotarev - 16.20.2-33
- CVE-2026-105482: dns: reject hostnames with NUL bytes in lookup, resolve
and setLocalAddress instead of passing a truncated name to c-ares
- CVE-2026-106069, CVE-2026-106072: tls: reject non-canonical IPv4 hosts
== alt-nodejs18-nodejs-18.20.8-26.el8.x86_64
* Thu Oct 22 2026 Arseniy Zolotarev - 18.20.8-26
- CVE-2026-105482: dns: reject hostnames with NUL bytes in resolve and
setLocalAddress instead of passing a truncated name to c-ares
- CVE-2026-106069, CVE-2026-106072: tls: reject non-canonical IPv4 hosts
== alt-nodejs19-nodejs-19.9.0-10.el8.x86_64
* Thu Oct 22 2026 Tamar Zerekidze - 19.9.0-10
- ALTNJS-304: backport the Node.js October 2026 security fixes
- Fix CVE-2026-105481, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069,
CVE-2026-106072, CVE-2026-106074, CVE-2026-111497
- Fix CVE-2026-48930, CVE-2026-48618, CVE-2026-48931, carried as prerequisites
of the October fixes and live bugs in 19.9.0 in their own right
- CVE-2026-106070, CVE-2026-106071 and CVE-2026-106073 do not affect 19.9.0:
it has neither the ZIP container reader nor the Permission Model
- Behaviour change (upstream's): TLS now rejects a host that is an IP address
only after IDNA normalisation, so https://127.1, 0x7f.0.0.1, 0127.0.0.1 and
== alt-nodejs20-nodejs-20.20.2-15.el8.x86_64
* Thu Oct 22 2026 Tamar Zerekidze - 20.20.2-15
- CVE-2026-105481: http: close the keep-alive response-queue desynchronisation
that the CVE-2026-48931 data guard left open, by checking for bytes already
queued in the socket's kernel receive buffer before a free socket is handed to
== alt-nodejs22-nodejs-22.23.4-1.el8.x86_64
* Wed Oct 21 2026 CloudLinux Packaging Team - 22.23.4-1
- Update to 22.23.4
* Mon Oct 05 2026 Nikolai Mardanov - 22.23.3-2
== alt-nodejs24-nodejs-24.22.1-1.el8.x86_64
* Wed Oct 21 2026 CloudLinux Packaging Team - 24.22.1-1
- Update to 24.22.1
* Wed Oct 14 2026 CloudLinux Packaging Team - 24.22.0-1Questions
Contact GreenGeeks support if you have questions about these updates.