# Yesterday, in short

> Yesterday brought a pile of security news. Here's what matters, fast.

URL: https://iamcanturk.dev/en/shorts/dunden-bugune/
Pixel Shorts #5 · October 22, 2026 · for everyone

---

**In short:** A security roundup for 21 October. For PHP2Shell (CVE-2026-109618, CVE-2026-109619) move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35; check the PHP-FPM version your site actually runs, look for the CVE in the Debian/Ubuntu changelog, then restart PHP-FPM and Apache. Update your JDK for Java's CVE-2026-91403 and Node to 22.23.4 / 24.22.1 / 26.12.1; if you used Railway, or OVHcloud CLI 0.11–0.15 on 19 October, rotate your keys and secrets.

PHP2Shell's history and how to patch it (8.5.12, 8.4.27, 8.3.36, 8.2.35), Java CVE-2026-91403, the HTTP/3 QPACK flaw, Node's 21 October security releases, the Railway environment variable incident and the OVHcloud CLI supply-chain attack.


## What's in the video?
Yesterday brought a pile of security news. Here's what matters, fast. Part of the PHP flaw was actually found in 2024. No attack path was found, so the fix was postponed. This summer Calif and Wiz found a working attack path with AI. Calif used OpenAI's GPT-5.6 Sol. Then things got messy. The CVE IDs leaked before the patch, and Calif accidentally shared its attack video. Amazon saw the first attempt 4 days before the announcement. Patched releases: 8.5.12 and 8.4.27. On older branches, 8.3.36 and 8.2.35. PHP shipped no patch for 8.1 and older. Ondřej Surý's repository has a minimal patch, but upgrade anyway. Careful: php -v may not show your site's version. Check PHP-FPM's version separately. On Debian and Ubuntu the version number may not change. Look for the CVE ID in the changelog. After updating, restart PHP-FPM and Apache. I updated my own server last night. In Java, 8 intermediate certificates were compromised. Update your JDK. HTTP/3 has a memory flaw. 7 of the 10 servers tested are affected. Node closed 10 vulnerabilities, one allows remote code execution. Update 22, 24 and 26. According to Railway, an attacker may have read some environment variables. Rotate every key stored there. OVH's command-line tool was served with malware for 1.5 hours on 19 October. If you installed it that day, rotate your secrets. Today there are three jobs: update, restart, rotate keys. Send this to someone who runs a server.