Drupal, PHP, and Node security advisories in October 2026: what is advisable to address now
Summary of critical notices for Drupal core (Oct 14), PHP (Oct 21), and Node.js (Oct 21), with patched versions and official links. No alarmism.
October 2026 has left several security windows affecting almost any serious web stack. In Drupal sites, the core and PHP runtime are the first priorities. If you also have Node on the front, CI, or APIs, that same week there was also a patch. There’s no need to dramatize. It is necessary to update judiciously and check dependencies.
Drupal core on October 14
On October 14, the Drupal security team published SA-CORE-2026-014 (CVE-2026-108097). It is a critical remote code execution advisory related to the Field UI module. It is not exploited solely with the core in all cases, but there are serious paths with contributed modules and, at least in one, without authentication. While updating, a temporary mitigation is to uninstall field_ui.
In the same window, two moderate XSS vulnerabilities from the core were released: SA-CORE-2026-015 (Link module, CVE-2026-108515) and SA-CORE-2026-016 (Navigation, CVE-2026-108514).
Versions to upgrade to, according to the supported branch:
- Drupal 10.6.x → 10.6.19
- Drupal 11.3.x → 11.3.19
- Drupal 11.4.x → 11.4.10
Branches below these no longer receive security coverage. If you are still on Drupal 10.5 or lower, or on 11.2 or lower, the issue is not just this patch. It is the end of support. We have broken it down in Drupal 10 reaches end of life in December 2026.
PHP on October 21
On October 21, PHP released critical patches for CVE-2026-109618 and CVE-2026-109619. Together, they refer to remote code execution without authentication in installations serving web requests (PHP-FPM, mod_php, php-cgi, and others). The risk is considered especially high in Apache with mod_php. The official notice is on php.net. Drupal reinforced it with PSA-2026-10-20.
Minimum secure versions in active branches:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Updating is the only complete mitigation. The temporary measures from the advisory (memory and POST limits, disabling session.upload_progress, etc.) reduce some paths but do not leave the system secure. PHP 8.1 and earlier no longer receive patches from the project. You need to go to an LTS vendor or upgrade.
On October 23, PHP added an informational note about session.upload_progress and an unusual vector (CVE-2026-115560 expected for the next cycle). If you have not yet set session.upload_progress.enabled=0 where applicable, it is advisable to do so until the next bugfix.
Node.js on October 21
On the same October 21, the Node.js project released security updates for the 26.x, 24.x, and 22.x lines. The advisory is on nodejs.org. Among the vulnerabilities, there are several of high severity, including CVE-2026-111497 in the Brotli decoder (memory corruption with a risk of remote execution if decompressing attacker-controlled input).
Patched versions:
- Node.js 26.12.1
- Node.js 24.22.1
- Node.js 22.23.4
Node.js 20.x is already out of support and does not receive this patch. After updating, you need to restart any processes still in memory (servers, workers, CI).
What we would do on a production site
- Check the exact version of Drupal core, PHP, and, if applicable, Node in each environment.
- Apply the core security release (or jump to a supported branch if you are out of coverage).
- Update PHP to one of the versions listed above, preferably via vendor packages.
- Update Node on the front, APIs, and pipelines that are not yet on those versions.
- Review installed contributed modules against drupal.org/security.
- Test login, field editing, menus, and admin navigation after the deploy.
- Document the date of the patch and the resulting version.
If you manage the hosting yourself, schedule a short window and do it. If the hosting is managed by a third party, ask in writing what version of PHP and Node is running and when they will apply the package.