Important vulnerabilities and patches for the software behind websites and business systems — PHP, Node.js, GitLab and more — explained clearly. Not sure if you’re affected? MetAI can check, fix and protect you going forward.
Newest first.
Remote code execution is possible only with an unusual combination of configuration and application code. PHP rates the risk as low and no attacks have been seen. Separate from php2shell.
Unauthenticated remote code execution (CVSS 9.2) affecting almost every PHP version from 5 to 8. Millions of attack attempts have been observed worldwide.
A Brotli decoder bug could allow remote code execution, plus flaws in TLS hostname checks and DNS.
A flaw in CI/CD regex handling allows code execution on the server (CVSS 10.0). Exploit code is public. gitlab.com users need not act.
List the versions of PHP, Node.js, WordPress, plugins and everything else your sites and systems run.
End-of-life versions get no fixes, even for critical flaws.
Attacks on critical flaws can start within hours of disclosure.
Unpublish or remove admin panels, features and files you don’t use.
Filters that block suspicious traffic and server-less setups make you a much harder target.
Back up your site and data regularly — and check you can actually restore them.
We identify the software and versions behind your sites and apps and whether you are affected.
Safe updates for PHP, Node.js, WordPress and libraries, including migration from end-of-life versions.
Attack filters, migration to server-less static sites and monitoring for suspicious traffic.
They are served as static sites with no PHP or database, and our own attack filter blocks suspicious requests automatically. None of the recent PHP or Node.js vulnerabilities affected the MetAI website.
A maximum-severity (CVSS 10.0) flaw was found in GitLab CE/EE, and exploit code is public. Who is affected and what to do if you run GitLab on your own servers.
On October 21, 2026 two critical PHP vulnerabilities, "php2shell", were disclosed. What is affected, what to do now, and how MetAI can help.
On the same day as PHP, Node.js shipped fixes for 10 vulnerabilities, four rated High. What is affected and what to do.
In a free 30-minute call we’ll look at your sites and systems.