--- title: "October 2026 – PHP and Node.js Security Updates" id: "90046" type: "ht_kb" slug: "october-2026-php-and-node-js-security-updates" published_at: "2026-10-23T03:44:40+00:00" modified_at: "2026-10-23T23:02:49+00:00" url: "https://www.greengeeks.com/support/article/october-2026-php-and-node-js-security-updates/" markdown_url: "https://www.greengeeks.com/support/article/october-2026-php-and-node-js-security-updates.md" excerpt: "This article explains the October 2026 security updates applied to PHP and Node.js on GreenGeeks servers. It also explains why the version your site reports may look older than the latest release on php.net or nodejs.org. Table of Contents What..." taxonomy_ht_kb_category: - "Server Questions" --- This article explains the October 2026 security updates applied to PHP and Node.js on GreenGeeks servers. It also explains why the version your site reports may look older than the latest release on php.net or nodejs.org. ## Table of Contents - [What Was Updated](#what-was-updated) - [Why Your Version Number Looks the Same](#why-your-version-number-looks-the-same) - [Patched Versions](#patched-versions) - [PHP](#php) - [Node](#node-js) [.js](#nodejs) - [PHP Behavior Changes](#php-behavior-changes) - [Restarting Your Node.js Application](#restarting-your-nodejs-application) - [Node.js Versions Without a Fix](#node-js-versions-without-a-fix) - [Security Scanner Still Reports a Vulnerability](#security-scanner-still-reports-a-vulnerability) - [Raw Changelog Output](#raw-changelog-output) - [PHP Changelog Output](#php-changelog-output) - [Node.js Changelog Output](#node-js-changelog-output) - [Questions](#questions) ## What Was Updated GreenGeeks has patched PHP and Node.js against the vulnerabilities below. PHP 8.2 through 8.5 now run upstream releases (8.2.35, 8.3.36, 8.4.27, and 8.5.12) that include the fix. PHP 5.2 through 8.1 use backported fixes. | Software | CVE | What it fixes | | --- | --- | --- | | PHP (all versions) | CVE-2026-109618 | Memory allocator hardening. A memory allocation failure no longer unwinds through half-updated engine state. | | PHP (all versions) | CVE-2026-109619 | Request parser and shutdown hardening. Stale error handler data can no longer carry over into the next request. | | Node.js | CVE-2026-105482 | DNS lookups now reject hostnames containing NUL bytes instead of passing a truncated name to the resolver. | | Node.js | CVE-2026-106069, CVE-2026-106072 | TLS connections now reject non-canonical IPv4 hosts. | | Node.js | CVE-2026-105481 | Closes a keep-alive HTTP response-queue desynchronisation left open by an earlier fix. | | Node.js 22 and 24 | Upstream release | Updated to the latest upstream versions, 22.23.4 and 24.22.1. | ## Why Your Version Number Looks the Same GreenGeeks servers run CloudLinux, which applies security fixes directly to the PHP and Node.js versions already installed instead of moving them to a new version number. This practice is called *backporting*. Red Hat, AlmaLinux, and other enterprise Linux vendors use the same approach. When a fix is backported, the version your site reports stays the same. Only the **package release number** (the number after the dash) changes. PHP 5.2 through 8.1 and Node.js 10 through 20 use this approach. PHP 8.2 through 8.5 first followed the same pattern. On October 21, 2026, PHP 8.2 was patched as package `8.2.34-7` and still reported **PHP 8.2.34**. CloudLinux has since replaced that backport with upstream PHP 8.2.35 (package `8.2.35-1`), and PHP 8.3, 8.4, and 8.5 moved to upstream releases the same way. Comparing your version number to php.net or nodejs.org can make a patched build look out of date. The package release number and the changelog are the reliable indicators. The [Raw Changelog Output](#raw-changelog-output) section lists both for every package. ## Patched Versions If your site reports one of the versions below, it is running the patched build. #### PHP | PHP version | Your site reports | Patched package | Fix type | | --- | --- | --- | --- | | PHP 5.2 | 5.2.17 | alt-php52 5.2.17-242 | Backported | | PHP 5.3 | 5.3.29 | alt-php53 5.3.29-220 | Backported | | PHP 5.4 | 5.4.45 | alt-php54 5.4.45-203 | Backported | | PHP 5.5 | 5.5.38 | alt-php55 5.5.38-183 | Backported | | PHP 5.6 | 5.6.40 | alt-php56 5.6.40-147 | Backported | | PHP 7.0 | 7.0.33 | alt-php70 7.0.33-148 | Backported | | PHP 7.1 | 7.1.33 | alt-php71 7.1.33-114 | Backported | | PHP 7.2 | 7.2.34 | alt-php72 7.2.34-97 | Backported | | PHP 7.3 | 7.3.33 | alt-php73 7.3.33-82 | Backported | | PHP 7.4 | 7.4.33 | alt-php74 7.4.33-81 | Backported | | PHP 8.0 | 8.0.30 | alt-php80 8.0.30-69 | Backported | | PHP 8.1 | 8.1.34 | alt-php81 8.1.34-39 | Backported | | PHP 8.2 | 8.2.35 | alt-php82 8.2.35-1 | New upstream version | | PHP 8.3 | 8.3.36 | alt-php83 8.3.36-1 | New upstream version | | PHP 8.4 | 8.4.27 | alt-php84 8.4.27-1 | New upstream version | | PHP 8.5 | 8.5.12 | alt-php85 8.5.12-1 | New upstream version | PHP 8.2 through 8.5 received new upstream version numbers, so `php -v` shows the fixed version directly. PHP 5.2 through 8.1 are backported fixes, so `php -v` shows the same version as before. --- #### Node.js | Node.js version | Your app reports | Patched package | Fix type | | --- | --- | --- | --- | | Node.js 10 | v10.24.1 | alt-nodejs10 10.24.1-7 | Backported | | Node.js 12 | v12.22.12 | alt-nodejs12 12.22.12-35 | Backported | | Node.js 14 | v14.21.3 | alt-nodejs14 14.21.3-37 | Backported | | Node.js 16 | v16.20.2 | alt-nodejs16 16.20.2-33 | Backported | | Node.js 18 | v18.20.8 | alt-nodejs18 18.20.8-26 | Backported | | Node.js 19 | v19.9.0 | alt-nodejs19 19.9.0-10 | Backported | | Node.js 20 | v20.20.2 | alt-nodejs20 20.20.2-15 | Backported | | Node.js 22 | v22.23.4 | alt-nodejs22 22.23.4-1 | New upstream version | | Node.js 24 | v24.22.1 | alt-nodejs24 24.22.1-1 | New upstream version | Node.js 22 and 24 received new upstream version numbers, so `node -v` shows the fixed version directly. Node.js 10 through 20 are backported fixes, so `node -v` shows the same version as before. ## Node.js Versions Without a Fix The following Node.js versions have **not** been updated: **6, 8, 9, and 11**. These versions are end-of-life and are not expected to receive a fix. If your application uses one of these versions, switch to a patched version in cPanel. Node.js 22 or later is recommended. --- ## Security Scanner Still Reports a Vulnerability Many security scanners, including PCI compliance scans, check only the version number and do not detect backported fixes. Scans of PHP 8.2 through 8.5 now see the fixed upstream version numbers. If a scan flags PHP or Node.js for these CVEs, open a support ticket. Support can provide written confirmation for your scan vendor. Moving to a currently supported version (PHP 8.3 or later, Node.js 22 or later) is the permanent fix. End-of-life versions continue to be flagged by scanners even when patched. --- ## Raw Changelog Output Each package records its changes in a changelog. Because system package tools are not available from your hosting account, the output below shows the changelog for each package as read directly from the server. The PHP 8.2 through 8.5 entries were refreshed after CloudLinux released upstream-based builds, and show the `common` package. Use it to verify the date, release number, and CVE identifiers for your version. The output shows only the most recent entries, and long entries are cut off after a fixed number of lines. Each package’s full changelog lists additional fixes from earlier releases. #### PHP Changelog Output ``` == alt-php52-cli-5.2.17-242.el8.x86_64 * Wed Oct 21 2026 Juan Carlos Garcia - 5.2.17-242 - CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator and the multipart request parser - report allocation failures without re-entering the engine, and take substring_conf()'s length as size_t. Adapted from upstream 712e60f9 (PHP 7.4 branch; upstream published no PHP 5 patch) * Wed Sep 30 2026 Juan Carlos Garcia - 5.2.17-241 - CVE-2026-93682: out-of-bounds read in the http:// wrapper when a redirect response carries an empty Location header. The relative-redirect test in == alt-php53-cli-5.3.29-220.el8.x86_64 * Wed Oct 21 2026 Juan Carlos Garcia - 5.3.29-220 - CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator and the multipart request parser - report allocation failures without re-entering the engine, and take substring_conf()'s length as size_t. Adapted from upstream 712e60f9 (PHP 7.4 branch; upstream published no PHP 5 patch) * Mon Oct 05 2026 Tamar Zerekidze - 5.3.29-219 - CVE-2025-1218: out-of-bounds reads in the mysqlnd wire-protocol parser. A malicious or compromised MySQL server could send a truncated packet and make == alt-php54-cli-5.4.45-203.el8.x86_64 * Wed Oct 21 2026 Juan Carlos Garcia - 5.4.45-203 - CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator and the multipart request parser - report allocation failures without re-entering the engine, and take substring_conf()'s length as size_t. Also disables the session upload-progress callback, as upstream does on the EOL branches - session.upload_progress.enabled no longer has any effect. Adapted from upstream 712e60f9 (PHP 7.4 branch; upstream published no PHP 5 patch) * Mon Oct 05 2026 Tamar Zerekidze - 5.4.45-202 == alt-php55-cli-5.5.38-183.el8.x86_64 * Wed Oct 21 2026 Juan Carlos Garcia - 5.5.38-183 - CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator and the multipart request parser - report allocation failures without re-entering the engine, and take substring_conf()'s length as size_t. Also disables the session upload-progress callback, as upstream does on the EOL branches - session.upload_progress.enabled no longer has any effect. Adapted from upstream 712e60f9 (PHP 7.4 branch; upstream published no PHP 5 patch) * Mon Oct 05 2026 Tamar Zerekidze - 5.5.38-182 == alt-php56-cli-5.6.40-147.el8.x86_64 * Wed Oct 21 2026 Juan Carlos Garcia - 5.6.40-147 - CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator and the multipart request parser - report allocation failures without re-entering the engine, and take substring_conf()'s length as size_t. Also disables the session upload-progress callback, as upstream does on the EOL branches - session.upload_progress.enabled no longer has any effect. Adapted from upstream 712e60f9 (PHP 7.4 branch; upstream published no PHP 5 patch) * Mon Oct 05 2026 Tamar Zerekidze - 5.6.40-146 == alt-php70-cli-7.0.33-148.el8.x86_64 * Wed Oct 21 2026 Tamar Zerekidze - 7.0.33-148 - CVE-2026-109618: do not bail out from inside the memory manager; an allocation failure now reports to stderr and terminates the worker instead of unwinding through half-updated engine state - CVE-2026-109619: clear the error and exception handler globals at request shutdown so a bailout cannot carry them into the next request - Behaviour change: exhausting memory_limit now terminates the worker process; the fatal error goes to stderr and shutdown functions do not run - Behaviour change: session.upload_progress is disabled - Wire php-7.0.33-bug78620.patch into debian/rules; the deb build was missing == alt-php71-cli-7.1.33-114.el8.x86_64 * Wed Oct 21 2026 Tamar Zerekidze - 7.1.33-114 - CVE-2026-109618: do not bail out from inside the memory manager; an allocation failure now reports to stderr and terminates the worker instead of unwinding through half-updated engine state - CVE-2026-109619: clear the error and exception handler globals at request shutdown so a bailout cannot carry them into the next request - Behaviour change: exhausting memory_limit now terminates the worker process; the fatal error goes to stderr and shutdown functions do not run - Behaviour change: session.upload_progress is disabled == alt-php72-cli-7.2.34-97.el8.x86_64 * Wed Oct 21 2026 Tamar Zerekidze - 7.2.34-97 - CVE-2026-109618: do not bail out from inside the memory manager; an allocation failure now reports to stderr and terminates the worker instead of unwinding through half-updated engine state - CVE-2026-109619: clear the error and exception handler globals at request shutdown so a bailout cannot carry them into the next request - Behaviour change: exhausting memory_limit now terminates the worker process; the fatal error goes to stderr and shutdown functions do not run - Behaviour change: session.upload_progress is disabled == alt-php73-cli-7.3.33-82.el8.x86_64 * Wed Oct 21 2026 Tamar Zerekidze - 7.3.33-82 - CVE-2026-109618: do not bail out from inside the memory manager; an allocation failure now reports to stderr and terminates the worker instead of unwinding through half-updated engine state - CVE-2026-109619: clear the error and exception handler globals at request shutdown so a bailout cannot carry them into the next request - Behaviour change: exhausting memory_limit now terminates the worker process; the fatal error goes to stderr and shutdown functions do not run - Behaviour change: session.upload_progress is disabled == alt-php74-cli-7.4.33-81.el8.x86_64 * Wed Oct 21 2026 Juan Carlos Garcia - 7.4.33-81 - CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator and the multipart request parser - report allocation failures without re-entering the engine, and take substring_conf()'s length as size_t. Upstream 712e60f9 (PHP 7.4 branch) Also disables the session upload-progress callback, as upstream does on the EOL branches - session.upload_progress.enabled no longer has any effect. * Mon Oct 05 2026 Tamar Zerekidze - 7.4.33-80 - CVE-2025-1218: the mysqlnd wire-protocol packet readers decoded fields out of == alt-php80-cli-8.0.30-69.el8.x86_64 * Wed Oct 21 2026 Juan Carlos Garcia - 8.0.30-69 - CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator and the multipart request parser - report allocation failures without re-entering the engine, and take substring_conf()'s length as size_t. Upstream 82f8f31b (PHP 8.0 branch) Also disables the session upload-progress callback, as upstream does on the EOL branches - session.upload_progress.enabled no longer has any effect. * Mon Oct 05 2026 Tamar Zerekidze - 8.0.30-68 - CVE-2025-1218: fix a set of out-of-bounds reads in the mysqlnd wire protocol == alt-php81-cli-8.1.34-39.el8.x86_64 * Wed Oct 21 2026 Juan Carlos Garcia - 8.1.34-39 - CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator and the multipart request parser - report allocation failures without re-entering the engine, and take substring_conf()'s length as size_t. Upstream 1d7dec17 (PHP 8.1 branch) Also disables the session upload-progress callback, as upstream does on the EOL branches - session.upload_progress.enabled no longer has any effect. * Mon Oct 05 2026 Tamar Zerekidze - 8.1.34-38 - CVE-2025-1218: fix out-of-bounds reads in the mysqlnd wire-protocol packet == alt-php82-common-8.2.35-1.el8.x86_64 * Wed Oct 21 2026 CloudLinux Packaging Team - 8.2.35-1 - Update to 8.2.35 - Drop the CVE-2026-109618, CVE-2026-109619 backport, fixed upstream in 8.2.35 * Wed Oct 21 2026 Juan Carlos Garcia - 8.2.34-7 - CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator, the multipart request parser and the session upload-progress path - report allocation failures without re-entering the engine, take substring_conf()'s length as size_t, and stop the upload-progress handler running user code while it decodes and re-encodes the session mid-request. == alt-php83-common-8.3.36-1.el8.x86_64 * Wed Oct 21 2026 CloudLinux Packaging Team - 8.3.36-1 - Update to 8.3.36 - Drop the CVE-2026-109618, CVE-2026-109619 backport, fixed upstream in 8.3.36 * Wed Oct 21 2026 Juan Carlos Garcia - 8.3.35-6 - CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator, the multipart request parser and the session upload-progress path - report allocation failures without re-entering the engine, take substring_conf()'s length as size_t, and stop the upload-progress handler running user code while it decodes and re-encodes the session mid-request. == alt-php84-common-8.4.27-1.el8.x86_64 * Wed Oct 21 2026 CloudLinux Packaging Team - 8.4.27-1 - Update to 8.4.27 - Drop the CVE-2026-109618, CVE-2026-109619 backport, fixed upstream in 8.4.27 * Wed Oct 21 2026 Tamar Zerekidze - 8.4.26-5 - CVE-2026-109618: do not bail out from inside the memory manager; allocation failures are reported through a deferred error instead of unwinding through half-updated engine state - CVE-2026-109619: clear stale request globals at shutdown so a bailout cannot carry them into the next request == alt-php85-common-8.5.12-1.el8.x86_64 * Wed Oct 21 2026 CloudLinux Packaging Team - 8.5.12-1 - Update to 8.5.12 - Drop the CVE-2026-109618, CVE-2026-109619 backport, fixed upstream in 8.5.12 * Wed Oct 21 2026 Tamar Zerekidze - 8.5.11-5 - CVE-2026-109618: do not bail out from inside the memory manager; allocation failures are reported through a deferred error instead of unwinding through half-updated engine state - CVE-2026-109619: clear stale request globals at shutdown so a bailout cannot carry them into the next request ``` #### Node.js Changelog Output ``` == alt-nodejs10-nodejs-10.24.1-7.el8.x86_64 * Thu Oct 22 2026 Juan Carlos Garcia - 10.24.1-7 - CVE-2026-105481: http: check an idle keep-alive socket for unread bytes before handing it to a request, so a response written before the request was sent cannot be parsed as that request's response - CVE-2026-105482: dns: reject names containing NUL bytes in the resolve*() and reverse() paths instead of handing a truncated name to c-ares (Resolver#setLocalAddress does not exist on 10.x, so that half of the upstream change is not applicable here) - CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes in lookup() and net.connect(); carried as a prerequisite of CVE-2026-105482, == alt-nodejs12-nodejs-12.22.12-35.el8.x86_64 * Thu Oct 22 2026 Juan Carlos Garcia - 12.22.12-35 - CVE-2026-105482: dns: reject hostnames containing NUL bytes in the resolve*() paths instead of handing a truncated name to c-ares (Resolver#setLocalAddress does not exist on 12.x, so that half of the == alt-nodejs14-nodejs-14.21.3-37.el8.x86_64 * Thu Oct 22 2026 Arseniy Zolotarev - 14.21.3-37 - CVE-2026-105482: dns: reject hostnames with NUL bytes in resolve and setLocalAddress instead of passing a truncated name to c-ares - CVE-2026-106069, CVE-2026-106072: tls: reject non-canonical IPv4 hosts == alt-nodejs16-nodejs-16.20.2-33.el8.x86_64 * Thu Oct 22 2026 Arseniy Zolotarev - 16.20.2-33 - CVE-2026-105482: dns: reject hostnames with NUL bytes in lookup, resolve and setLocalAddress instead of passing a truncated name to c-ares - CVE-2026-106069, CVE-2026-106072: tls: reject non-canonical IPv4 hosts == alt-nodejs18-nodejs-18.20.8-26.el8.x86_64 * Thu Oct 22 2026 Arseniy Zolotarev - 18.20.8-26 - CVE-2026-105482: dns: reject hostnames with NUL bytes in resolve and setLocalAddress instead of passing a truncated name to c-ares - CVE-2026-106069, CVE-2026-106072: tls: reject non-canonical IPv4 hosts == alt-nodejs19-nodejs-19.9.0-10.el8.x86_64 * Thu Oct 22 2026 Tamar Zerekidze - 19.9.0-10 - ALTNJS-304: backport the Node.js October 2026 security fixes - Fix CVE-2026-105481, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106072, CVE-2026-106074, CVE-2026-111497 - Fix CVE-2026-48930, CVE-2026-48618, CVE-2026-48931, carried as prerequisites of the October fixes and live bugs in 19.9.0 in their own right - CVE-2026-106070, CVE-2026-106071 and CVE-2026-106073 do not affect 19.9.0: it has neither the ZIP container reader nor the Permission Model - Behaviour change (upstream's): TLS now rejects a host that is an IP address only after IDNA normalisation, so https://127.1, 0x7f.0.0.1, 0127.0.0.1 and == alt-nodejs20-nodejs-20.20.2-15.el8.x86_64 * Thu Oct 22 2026 Tamar Zerekidze - 20.20.2-15 - CVE-2026-105481: http: close the keep-alive response-queue desynchronisation that the CVE-2026-48931 data guard left open, by checking for bytes already queued in the socket's kernel receive buffer before a free socket is handed to == alt-nodejs22-nodejs-22.23.4-1.el8.x86_64 * Wed Oct 21 2026 CloudLinux Packaging Team - 22.23.4-1 - Update to 22.23.4 * Mon Oct 05 2026 Nikolai Mardanov - 22.23.3-2 == alt-nodejs24-nodejs-24.22.1-1.el8.x86_64 * Wed Oct 21 2026 CloudLinux Packaging Team - 24.22.1-1 - Update to 24.22.1 * Wed Oct 14 2026 CloudLinux Packaging Team - 24.22.0-1 ``` ## Questions [Contact GreenGeeks support](https://www.greengeeks.com/contact) if you have questions about these updates.