PHP, Laravel, Node, and a Compromised CA: What to Patch This Week

It's been a wild 48 hours. Four separate security issues landed within two days of each other. If you run Laravel, there's a good chance all four touch your stack.

I've been answering questions about these in our GitHub discussions and Discord all day. Here's everything in one place: what happened and what I would do about each one.

PHP: CVE-2026-109618 and CVE-2026-109619

PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21. They fix two critical vulnerabilities (CVSS 9.2) that allow unauthenticated remote code execution. Every version before those releases is affected.

Both bugs are in PHP's request handling, so they hit every way of serving PHP: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. PHP rates mod_php as the highest risk. They have a working exploit where a single unauthenticated request triggers the attack before any of your application code runs.

• CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): When PHP runs out of memory partway through setting up a request, cleanup can treat half-initialized data as valid. Crafted multipart form requests can trigger it.
• CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): State from one request can survive after its memory is freed. The next request on the same worker can then use it.

Check which version you're running:

php -v

If you install PHP from your Linux distribution, the distributions got the patches ahead of time. Run your package manager's update and restart PHP.

If you use serversideup/php

Patched images are live in v5.0.2. It covers PHP 8.2, 8.3, 8.4, and 8.5 on Debian Bookworm, Debian Trixie, Alpine 3.23, and Alpine 3.24.

How you update depends on which tag you use:

If you use a floating tag, pull and restart:

docker compose pull
docker compose up -d

If you build your own image FROM serversideup/php, add --pull so Docker doesn't use the old base image from its cache:

docker compose build --pull
docker compose up -d

Then confirm you're on the patched version:

docker compose exec php php -v

PHP 8.1 and older will not. The PHP team did publish minimal source backports for 7.4, 8.0, and 8.1 for people who build from source. Those aren't official releases, and there won't be official Docker images for them. We also stopped building Debian Bullseye and Alpine 3.16 on September 3. If you're on any of those, this is the push to upgrade. Our upgrade guide walks through it.

Also keep in mind PHP 8.2 reaches end of life on December 31, 2026.

One thing that makes days like this a little less stressful: our images run as www-data instead of root. If someone does get code execution, they don't own the whole container.

Laravel: TokenGuard auth bypass

Laravel published GHSA-f9x3-7vq9-cph6 on October 19. It's rated critical (CVSS 9.2).

If you use Laravel's built-in TokenGuard and run MySQL or MariaDB, an attacker can send a crafted, non-string token value that matches the wrong user in the database. Under certain database configurations, that lets someone log in as any existing user without their token. Every route behind that guard is exposed.

You're using TokenGuard if your config/auth.php has a guard with the token driver:

'guards' => [
    'api' => [
        'driver' => 'token',
        'provider' => 'users',
    ],
],

The fix is in 13.29.0 and 12.68.0. There are no workarounds listed, so upgrade:

composer update laravel/framework

Then confirm the version you're running:

composer show laravel/framework | grep versions

Even if you don't use the token driver, I'd still upgrade. It's a patch release and it's one less thing to wonder about.

The advisory only lists fixes for 12.x and 13.x. If you're still on Laravel 11 or older, you won't get a patch for this one.

Node.js security releases

Node.js shipped security releases for every supported line on October 21. There are 10 CVEs in total. The four rated high are the ones I'd pay attention to:

• An out-of-bounds write in the Brotli decoder that allows remote code execution
• Two separate TLS certificate hostname bypasses
• dns.resolve truncating names that contain a NUL character

Upgrade to the patched version for your line:

A lot of Laravel developers only use Node to run npm run build with Vite. It's easy to think this doesn't matter. If that's all you use it for, the risk is lower. You should still update. If you run Inertia SSR or any Node process in production, update today.

Places to check:

• Your local machine (nvm install 24, Homebrew, etc.)
• FROM node:... lines in your Dockerfiles
• node-version in your GitHub Actions or GitLab CI config
• Any .nvmrc or .node-version files pinned to an older patch version

These releases also include the updated CA store for the next issue.

eMudhra intermediate CA compromise

This one is the strangest of the bunch. The private keys for eight eMudhra intermediate certificates were generated so badly that anyone could recover them from the public certificates. The keys were effectively tiny numbers. 🤯

Those intermediates chain up to roots trusted by Mozilla, Microsoft, Apple, and Chrome. Six are TLS certificates and two are for code signing. If you have the keys, you can issue a certificate for any domain that clients would trust.

Mozilla is tracking it in Bug 2083449. Dennis Jackson also put together a full write-up with patched versions for every platform.

Your browser is fine. Your server might not be.

Browsers already handled this. Firefox and Chrome blocked the certificates on October 17. Apple followed on October 19 and Microsoft on October 20.

The problem is everything that isn't a browser. When your Laravel app calls an API with the Http facade, Guzzle uses the CA bundle on your server or in your container. Same with curl, wget, and anything else making outbound HTTPS requests. If that CA bundle is old, your app still trusts these certificates.

Update ca-certificates

On a Debian or Ubuntu server:

sudo apt update && sudo apt install --only-upgrade ca-certificates

On Alpine:

apk upgrade ca-certificates

Here are the patched ca-certificates versions for the platforms most of us run:

If you use composer/ca-bundle directly, update to 1.4.16 or 1.6.0.

For containers, don't patch a running container. Pull a fresh image and redeploy so the update is baked in. You can check which version an image ships with:

docker run --rm serversideup/php:8.4-fpm-nginx dpkg -s ca-certificates | grep Version

docker run --rm serversideup/php:8.4-fpm-nginx-alpine apk list -I ca-certificates

Test it

The write-up includes test hosts that serve certificates from the compromised chain. Run this from your server or inside your container:

curl https://dv-g3b-emudhra.we-have-a-problem.com/

You want a certificate error here. If the request succeeds, that machine still trusts the compromised intermediates.

Wrapping up

Every one of these has a fix available today. Update PHP, Laravel, Node, and your CA certificates, then redeploy.

Have questions or stuck on an upgrade? Jump into our Discord and let us know.

If you'd rather not spend your next security week doing this yourself, we can handle it for you. Security updates and infrastructure are part of what we do for our clients every month.