Elliot: “A lot of FUD around the PHP RCE and Node.js security release…”

Elliot @ejntaylorOct 21

A lot of FUD around the PHP RCE and Node.js security releases happening later today. What we are seeing suggests this could impact versions all the way back to PHP 5 (released 22 years ago!), while official upstream patches are expected only for PHP 8.2–8.5. We're already seeing traces of this in the wild. We'll keep the Patchstack blog updated with more info https://patchstack.com/articles/php-major-vulnerability-alert-10-2026/

PatchstackMajor security alert: PHP vulenrable to critical RCE, attacks ongoing - PatchstackAn attacker with valid UpdraftCentral dashboard keys is installing backdoors on connected WordPress sites. Delete your UpdraftCentral keys!

08:20 · Oct 21, 2026commit bcad633

Commit