Three Critical Fixes in One Week: Is Your Website Up to Date?

This has been a busy week for anyone who looks after websites. In the space of three days, three of the most widely used pieces of web software shipped critical security fixes: Laravel on 19 October, then PHP and Node.js on 21 October.

If your business depends on a website, takes bookings or payments online, or holds customer data, this is the kind of week that shows whether your site is being looked after. None of these flaws need your developer to have made a mistake. They sit in the software your site is built on, and the only fix is to update it.

What happened this week

PHP2Shell, now under attack

We wrote about PHP2Shell the day the fix came out. It is two flaws in PHP itself, rated 9.2 out of 10, which together can let an attacker with no login read a server's memory and run their own code on it. Every PHP site is exposed until its server is updated: WordPress, Drupal, MODX and Laravel alike.

Since then it has got worse:

• It is being exploited. Attacks have been seen in the wild since 21 October, and there are signs of attempts from a few days before the fix was public.
• Exploit code is public. Several working proof-of-concept exploits are now published, so attacking an unpatched site no longer takes skill.
• The US cyber agency CISA has told organisations to patch immediately, and to take PHP systems offline if they cannot.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are out of support and get no official fix.

Node.js: ten fixes at once

Node.js runs a large share of modern websites and their build tools, including most sites built with Nuxt, Next.js and Express. On 21 October it fixed ten vulnerabilities across every supported version.

• The worst is in Brotli, the compression Node.js uses to unpack data. A malformed response can trigger remote code execution, and because tools like fetch() and Express 5 unpack Brotli automatically, it is easy to reach.
• Three more are rated high, including two ways to slip past the checks that confirm a secure connection is talking to the right server.
• Node.js 20 and 25 will not be fixed. They are past end of life, so anything still running them needs moving to a supported version.

The fixed versions are Node.js 26.12.1, 24.22.1 and 22.23.4.

Laravel: an authentication bypass

On 19 October Laravel fixed a flaw in its built-in token guard, also rated 9.2, which in some setups could let a request authenticate as a user it should not. It only affects applications that use that guard with their users table in MySQL or MariaDB; apps using Sanctum or Passport for API tokens are not affected. Working exploit code is reported to be public.

The fixed versions are Laravel 13.29.0 and 12.68.0.

Why this matters for your business

It is easy to think of a website as finished once it launches. It is not. It is built on layers of software, the language it runs on, the framework, dozens of packages and the server underneath, and each of those layers gets security fixes throughout its life.

For a business, an out-of-date site is not a technical detail. It is a real risk:

• Customer data. A breach can expose names, addresses, payment details and passwords, with obligations under UK GDPR to report it and to the people affected.
• Money and bookings. A compromised or offline site stops taking orders, enquiries and payments, often at the worst time.
• Your reputation. A defaced site, or a warning from Google that it is unsafe, does lasting damage to trust.
• Search rankings. Hacked sites are routinely used to host spam pages, which can take months to clean out of Google.

The uncomfortable part is that none of this week's flaws were caused by bad code on anyone's website. A well-built site on an old version of PHP or Node.js is just as exposed as a badly built one.

How to tell if you are covered

You do not need to be technical to find out where you stand. Ask whoever looks after your site:

1. Which versions of PHP or Node.js does the live site run? They should know straight away. If they need to find out, that is worth noticing.
2. Have this week's fixes been applied, and when? The answer should be a date, not "it should be fine".
3. Were long-running processes restarted? Queue workers and background jobs keep running the old version until they are, so an update can look done when it is not.
4. Is anything out of support? PHP 8.1 or older, Node.js 20 or 25, or an old Laravel release means no fixes are coming, and a plan to move is needed.
5. Do you get told when a fix like this lands? Someone should be watching for these, not hearing about them from the news.

One point catches a lot of people out: automatic updates often do not cover this. Many hosting platforms only update the operating system on their own, not PHP or Node.js. Laravel Forge, for example, does not install this week's PHP fix automatically. If you are relying on your host, check what they actually update.

Small and often beats big and late

The real lesson of a week like this is that keeping up is far cheaper than catching up.

Moving PHP from 8.4.26 to 8.4.27 takes minutes and almost never breaks anything. Moving a neglected site from PHP 7.4 to a supported version, under pressure, with an exploit already in circulation, is a project. The same goes for Node.js and for the framework itself.

A site that is looked after properly has:

• Supported versions of PHP or Node.js, the framework and its packages, updated regularly.
• Security fixes applied within days, and critical ones within hours.
• A planned yearly upgrade of the framework, rather than one put off until it is forced.
• Monitoring, so problems are spotted before customers notice them.
• Backups that have actually been restored, so the worst case is recoverable.

How we can help

At AugmentBLU this week was routine for the sites we look after: the fixes went on, the processes were restarted, and our clients did not need to do anything. That is the point of ongoing support. Our support and maintenance retainers cover security updates, dependency monitoring and a dashboard that shows you exactly what your site is running, and our managed DevOps looks after the servers underneath.

If you are not sure whether your site is up to date, get in touch. We will check what it is running, tell you plainly whether this week's flaws affect you, and what it would take to stay on top of the next ones.

AugmentBLU is based in Edinburgh and works across Scotland and the UK. We reply within 24 hours.