PHP, Node and Python incidents: October 2026 week

One week, four ecosystems: PHP, Node and Python incidents, October 2026

Security · 4 min read · October 22, 2026

Between 14 and 22 October 2026, PHP and Node.js both shipped security releases for remote code execution bugs on the same day, a certificate authority's intermediate keys were revoked, a hosting platform disclosed access to customer environment variables, and two packages, one on npm and one on PyPI, were reported to carry credential stealers. Each story has its own post on this blog. This one puts them on one line, because read together they point at a short list of habits that cover most of it.

The week, in order

A week before, on 8 October, the pwn.watch tracker reports that tensorlake 0.5.144 was published to npm from its real repository, with provenance, carrying a credential-stealing worm (provenance is not safety). On 14 October, according to the same tracker, Vercel shipped Next.js 16.4.1 and 15.5.28 out of band for two critical unauthenticated RCEs; the GitHub advisory for the SVG one rates it CVSS 9.5 (the Next.js post). On 18 and 19 October, the tracker reports, eMudhra intermediate CA keys were found to be weak and were revoked; eMudhra says it revoked the affected CAs within 14 hours of discovery (trust stores).

On 20 October php.net posted an entry titled "Upcoming Critical PHP Security Release"; the tracker says details had leaked early. On 21 October PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fixed two critical unauthenticated RCEs (update PHP now), and Node.js 26.12.1, 24.22.1 and 22.23.4 fixed ten vulnerabilities including a Brotli decoder RCE (the Node release, and two smaller Node fixes). The same day Railway disclosed that a third party may have obtained decrypted customer environment variables (rotating secrets), and the tracker reports a compromised LiteLLM 1.107.0 on PyPI and Docker (one package, all your keys). On 22 October eMudhra announced it is leaving the TLS certificate business, and W3Techs' survey showed 34.7% of the PHP sites it can detect still on PHP 7 or older (PHP end of life).

Dates as given in each source. 21 October alone brought two runtime releases and two credential incidents.

Four patterns

These are patterns I read across the sources, not causes anyone has confirmed.

The fix is a version number. PHP and Node.js both answered with patched releases, and both say end-of-life lines are left out: php.net says 8.1 and older no longer get updates from the project, and Node.js says end-of-life versions are always affected when a security release occurs. If you do not know which version runs in production, you cannot tell whether you are fixed.

Trust is layered, and it ships. A CA list bundled in the runtime (Node.js updated its ca-cert for eMudhra), a package built with provenance, a platform's secret store, a release pipeline. Each layer is something you trust without looking, which is also why a compromise in one can travel quietly into the next.

Trust passes along the chain. The end of it is usually your credentials.

Credentials are the prize. Three of the incidents, the npm worm, the LiteLLM release and the Railway disclosure, are about collecting secrets rather than breaking the app's own code. Railway says it believes its incident is part of a series aimed at reaching AI inference providers.

Boring habits answer most of it. That is the good news, and it is the last section.

Know your versions, update on a schedule, keep a secrets inventory you can rotate in an hour, and install packages without scripts or after a delay.

The checklist for this week

Start with the versions, in every place they hide: the web server, the CLI, the Docker base image and CI. On the command line:

php -v
node -v
composer audit
npm ls next sharp

Remember that php -v shows the CLI, which can differ from what serves web requests. Then: patch PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and Node.js to 26.12.1, 24.22.1 or 22.23.4; plan off any line that no longer receives fixes; write the list of secrets your app holds and how to rotate each one; and keep production secrets off developer machines, where install-time malware looks for them. If you only do one thing today, find out which PHP and Node.js versions your production actually runs.

Earlier posts that go deeper on the habits: the first ten minutes after a leaked key, install-time malware, workflow lockfiles and sandboxing a coding agent.

Source: php.net news archive, 2026; each linked post names its own primary source.

Notes from readers

No notes yet. The first one is the bravest.