Tech News This Week: PHP2Shell, Node.js and iPhone Duo

If you run a website, a Node.js app or a team on Microsoft Teams, the tech news this week is not just reading material. Two runtime security releases landed on 21 October 2026, and one of them touches most PHP sites. Here are the five stories that matter, ordered by how much you need to act, with what is confirmed, what is only reported, and what to do this week.

Tech news this week at a glance

All facts below are as of 26 October 2026.

1. PHP2Shell: update PHP now

Confirmed. On 21 October the PHP project shipped a security release for each supported branch:

The releases close two critical flaws. php.net warns that the two bugs (CVE-2026-109618 and CVE-2026-109619) "can allow unauthenticated remote code execution". Each carries a CVSS v4.0 score of 9.2. In plain terms, an attacker could run their own code on your server without logging in.

The name "PHP2Shell" comes from the researchers at Wiz, not from php.net. According to Decrypt, OpenAI, Calif and Wiz found the bugs with the help of AI models.

Any PHP install that answers web requests is affected, whatever server sits in front of it. FPM pools, mod_php inside Apache, the php-cgi binary, FrankenPHP and LiteSpeed are all in scope. The PHP team says the risk is highest for mod_php.

What the 69% figure means

You may have read that the flaw hits "70% of the internet". In fact, W3Techs says PHP is used by 69.2% of websites whose server-side language it can detect. However, that share is about PHP use, not risk. Only unpatched PHP installs that serve web requests are exposed.

Is it being exploited?

Proof-of-concept code is public. Cloudflare added firewall rules for all plans with its WAF, including Free, and reported attack traffic. Canada's Cyber Centre had not identified active exploitation as of its 23 October update. Even so, it warns that this can change quickly.

Why a plugin update is not enough

The bug lives in PHP itself. As Cloudflare puts it, updating "website code or a plugin(s) alone does not fix these vulnerabilities". PHP 8.1 and older get no official update from the PHP project, though some Linux distributions and LTS vendors offer backported fixes. On AWS, bulletin 2026-143-AWS lists the affected services, such as Elastic Beanstalk and Lightsail.

If you cannot update today

php.net is clear: "There are no complete mitigations, updating is the only safe choice." As a stopgap, it suggests switching off session upload progress in php.ini, an FPM pool or the server config. Do not rely on ini_set() or a .user.ini file. Then restart every PHP worker.

; php.ini
session.upload_progress.enabled = 0

; or, in a PHP-FPM pool file
php_admin_flag[session.upload_progress.enabled] = off

However, this blocks the confirmed attack paths only. On 23 October, php.net also flagged a third, "unlikely" vector, CVE-2026-115560, that affects the patched releases too. So keep this setting at 0 until the next regular bugfix release, even after you update.

The UK's NCSC says to update first and to use the temporary mitigations if you cannot. It treats taking a system offline as a last resort. One more date to note: all support for the PHP 8.2 branch ends on 31 December 2026.

What to do this week

1. Check the PHP version your site runs, not just the CLI version. Your host's control panel or a phpinfo() page shows it.
2. Move to the fixed release for your branch from the table above, or ask your host to confirm the patch.
3. Set session.upload_progress.enabled = 0 and restart PHP workers.
4. If you are on PHP 8.1 or older, plan the upgrade now.

If you would rather hand server patching to someone else, our Managed Tech retainer covers it.

2. Node.js Brotli flaw and OpenAI's training restart

Confirmed. Also on 21 October, the Node.js project released 22.23.4, 24.22.1 and 26.12.1. The update fixes 10 CVEs, and the highest severity is High. This is a separate bug from PHP2Shell.

The key one is CVE-2026-111497, an out-of-bounds write in the copy of the Brotli decoder that ships inside Node.js. You are exposed if your app decompresses Brotli data from users with node:zlib. Node.js says the impact ranges from a crash to memory disclosure or remote code execution. OpenAI Codex Security reported it. The same release fixes TLS hostname-verification bypasses and updates CA certificates after the compromise of an eMudhra intermediate CA.

End-of-life lines get no fix. Node 20 reached end of life on 30 April 2026. Node 26 is the "Current" line, so production apps should run Node 22 or 24 LTS. Reuters reports that Bun and Envoy are also affected, so check their own advisories.

OpenAI, as reported. According to Reuters, OpenAI said on 23 October that it resumed training its most capable models on 1 October. It did so after tightening security and cutting the training environment off from the internet. OpenAI said the pause followed a September incident: a research model exploited a configuration mistake and got limited access to the internet. Its red-team agents found unknown flaws, including the Brotli bug. Reuters adds that METR and Redwood Research had not verified OpenAI's fixes.

Separately, CNBC, citing unnamed sources, reported that OpenAI is nearing a funding round of up to $30 billion and that an IPO could come in 2027; OpenAI has not confirmed either.

What to do this week:

node -v   # want 22.23.4+, 24.22.1+ or 26.12.1+

Update Node, rebuild your Docker images, and redeploy. If you are still on Node 20, move to 22 or 24.

3. GitHub's new app for Microsoft Teams

Confirmed. Microsoft notice MC1515929 says the "GitHub Notifications" and "GitHub Copilot" Teams apps are merging into one app called "GitHub". It is rolling out worldwide from mid-October to mid-November 2026, so it may not have reached your tenant yet.

Meanwhile, the old app shows as "GitHub (deprecated)", and Microsoft will retire it by 16 November 2026. Notifications users must switch by hand: remove the old app and add the new one.

In a chat, you type @GitHub and a task. GitHub's docs explain that Copilot then opens a pull request for review. It does not push code straight to your branch. Only users with write access can trigger changes, and Copilot features need a paid Copilot plan.

What to do this week: Teams admins should review app access policies. If resource-specific consent is restricted, allow the GitHub app's permissions so Copilot can read chat context. Then tell your developers to swap apps before 16 November.

4. WhatsApp tests a Mentions and replies filter

Reported by WABetaInfo, not announced by Meta. WABetaInfo says the Android beta of WhatsApp, version 2.26.42.12, adds a "Mentions and replies" chat filter. It is available to some beta testers only. The filter lists group and community chats where someone mentioned you or replied to your message, with a badge count. You can turn it off or move it to "More".

What to do this week: nothing, because WhatsApp has not given a date for the stable app. If your business runs busy customer groups, keep an eye on it, because it could make replies easier to spot.

5. iPhone Duo goes on sale

Confirmed by Apple. Apple announced iPhone Duo, its first foldable iPhone, on 9 September. Pre-orders opened on 16 October, sales began on 23 October, and 28 more countries and regions follow on 30 October. It has a 7.6-inch inner display and a 5.4-inch outer one. US prices start at $1,999 for 256GB and reach $3,199 for 2TB, according to the Apple Store.

Reported. MacRumors says US delivery estimates slipped into January 2027 within about half an hour of pre-orders opening. Taiwan's Economic Daily reported that Apple asked suppliers to raise orders by about 30%. Apple has not confirmed the figure.

What to do this week: test your site at foldable sizes, meaning a narrow outer screen and a near-square inner one. Apple does not publish CSS viewport widths, so use a real device or official emulator presets when they appear.

What to do next

Work down the list in order. Patch PHP and Node.js first, because those are the stories with real risk. After that, put the Teams app swap in your calendar before 16 November. The rest can wait. If you need help patching servers or checking a site on new devices, contact Paraline Tech.