October 2026 Patch Scorecard: PHP, Drupal, Node.js, Next.js and Microsoft on One Page (A Checklist for Businesses)
October 2026 was a busy month for software security: critical patches came out for PHP, Drupal, Node.js, Next.js and Microsoft. We collected on one page which versions are safe, what to patch first and a tracking table template.
In brief: In October 2026 critical patches came out one after another across the software world. This article gathers the fixed versions we verified against primary sources in one table and proposes a prioritisation order. First: exploited flaws and internet-facing, unauthenticated code execution (PHP2Shell). Then: CMS and runtime patches (Drupal, Node.js, Next.js). In the regular maintenance window: Microsoft's monthly patches (except the exploited CVE-2026-96951, which comes first). This is a month-end summary; things change fast (for example real PHP2Shell exploitation was reported on 26 October). Each row has a source link; confirm the official announcement before applying. Information is as of 26 October 2026.
Last updated: 26 October 2026
The patch table on one page
| Software | What happened? | Fixed versions | Status / priority | Detail |
|---|---|---|---|---|
| PHP | 21 Oct: two critical remote code execution flaws (CVE-2026-109618, -109619), real exploitation reported (26 Oct); new unpatched CVE-2026-115560 | 8.5.12, 8.4.27, 8.3.36, 8.2.35 | URGENT | First article, exploitation update |
| Drupal | 14 Oct: Field UI critical RCE (CVE-2026-108097) and Entity List (CVE-2026-108099) | Core 10.6.19, 11.3.19, 11.4.10; Entity List 3.0.10 | High (exploitation within hours/days had been called possible) | Drupal guide |
| Node.js | 21 Oct: 10 flaws (4 high), RCE in the Brotli decoder (CVE-2026-111497), two TLS hostname-validation bypasses | 26.12.1, 24.22.1, 22.23.4 | High (rebuild Docker images) | Node.js article |
| Next.js | 14 Oct: two critical RCEs and one high DoS | 16.4.1 (16.4 line), 15.5.28 (15.5 line); sharp ≥ 0.35.5 | High (if you use Cache Components, SVG image optimisation, Server Actions) | Next.js article |
| Microsoft (Windows/Office) | 13 Oct Patch Tuesday: record 1,413 flaws; CVE-2026-96951 (Windows Shell) exploited in the wild | October cumulative updates | Exploited CVE: urgent; others in the maintenance window | Record patch article |
| LiteLLM | 21 Oct: malicious 1.107.0 on PyPI/Docker for ~2 hours | Last safe version: 1.106.2 (per Datadog) | If affected, rotate secrets | LiteLLM article |
| Certificate trust | eMudhra CA key compromise; Node.js updated its CA store | Runtime/OS updates | Set up CAA + CT monitoring | CA compromise article |
Prioritisation: in what order?
- Exploited, internet-facing, unauthenticated RCE: PHP2Shell (every internet-facing system running PHP). Today.
- Client-side flaws exploited in the wild: Windows Shell CVE-2026-96951 (via email/files). This week.
- Critical CMS and runtime flaws: Drupal Field UI, Node.js Brotli, Next.js
use cacheand image optimisation. Within the week, after testing. - Exit plans from end-of-life versions: PHP 8.1 and older, Node.js 20 and older, Drupal's old lines. Plan this month.
- Regular monthly patches: The rest of Windows/Office, other components.
- Secret rotation: In suspected cases (possible PHP2Shell exploitation, LiteLLM).
This order is a suggestion; adjust it to your sector regulations and risk appetite. For the logic of prioritisation see our Microsoft patch article and our patch management plan.
A patch tracking table template
Keep a simple table (a spreadsheet is enough) with these columns:
| System | Owner | Software/version | Affected? | Patch date | Test | Secrets rotated? | Notes |
|---|---|---|---|---|---|---|---|
| E.g. Web server 1 | Name Surname | PHP 8.4.26 | Yes | 27 Oct | Login/form test | Planned | mod_php; consider moving to PHP-FPM |
For each row there should be a written answer to: who is responsible, which version are we on, when was it fixed, how was it tested?
A 10-point month-end checklist
- Are all PHP installations (live, staging, containers) on a patched version?
- Was the interim setting (
session.upload_progress.enabled=0) considered for the new unpatched PHP flaw? - If using Drupal, 10.6.19 / 11.3.19 / 11.4.10 and Entity List 3.0.10?
- Are Node.js servers and Docker images on the fixed versions?
- Next.js 16.4.1 / 15.5.28 and
sharp≥ 0.35.5? - Were Windows/Office October updates and the CVE-2026-96951 patch applied?
- Was LiteLLM 1.107.0 used in Python/AI components? If so, were secrets rotated?
- Are end-of-life versions listed with a migration date written down?
- Is there a CAA record and certificate transparency monitoring?
- Is there a written patch owner and time target for every system?
This month's lesson
October 2026 showed that patch speed is a matter of competitiveness and trust: some of the flaws were found through AI-assisted discovery, some were seen in real attacks days after the announcement, and some arrived through the supply chain. The answer is not panic but a simple routine of inventory, priority, time target and testing.
Maintenance and security with Aktaş Digital
Version inventory, urgent patch tracking, testing and secret management are part of our maintenance services. To have your systems' patch status assessed, use our quote form. Related services: web applications.
Frequently Asked Questions
Should I patch everything on the same day?
No. Prioritise: exploited and internet-facing critical flaws first, the others shortly afterwards following testing.
Does this table apply to every system?
Only if you use the relevant software. Match it against your own inventory; no action is needed for software you don't use.
Can patches conflict?
Every upgrade carries regression risk. Try in a test environment first and verify critical flows afterwards.
Will this list be updated next month?
Similar summaries may be prepared as new events come in; this summary is as of 26 October 2026.
Conclusion
October's patches are gathered in one table: first the exploited and internet-facing ones, then CMS and runtimes, then regular maintenance. First step: compare this table with your own inventory and put in writing the answer to “which rows concern us and which version are we on?”
