Security releases · Patch Watch

Know before release day. Be ready when it lands.

The big projects announce security releases days before they ship. We read those notices for PHP, Node.js and the software around them, tell you whether you run an affected version before the fix is out, and patch and prove it when it is.

“the NCSC advises all organisations, irrespective of size, to plan and prepare for the vulnerability patch wave.”
NCSC · Preparing for a “vulnerability patch wave”, 1 May 2026Source
“we expect similar findings to increase sharply in the coming months.”
OpenAI · On vulnerabilities found with AI, 21 October 2026Source

Out now

This week's releases

Three serious releases landed on 21 October 2026. They're unrelated; they just arrived together.
Critical21 October 2026

PHP2Shell

CVSS v4.0 9.2, both CVEs

Two flaws in PHP itself let an attacker run code on a web server without logging in. PHP 8.1 and older get no official fix.

What to do

High21 October 2026

Node.js security release

Node.js's rating; no CVSS published

Ten fixes, seven of them in all of Node.js 26, 24 and 22. The most serious is an out-of-bounds write in the Brotli decoder. Node.js 18, 20 and 25 get no fix.

What to do

Critical21 October 2026

GitLab 19.5.1

GitLab's critical patch release

For self-managed GitLab: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 fix a critical unauthenticated remote code execution flaw (GitLab: CVSS 10.0) and other issues.

GitLab's release notes

What does your website run on?

Enter your address. We load your home page once, as a browser would, and tell you whether it shows PHP or Node.js, and which of this week's releases to read.

Free. One normal page load of your home page, nothing more. How the check works

Coming up

Dates to plan around

  1. 28 Oct 2026

    Node.js 26 becomes the newest long-term-support line: the natural target for Node.js upgrades.

  2. 28 Oct 2026

    GitLab's next scheduled patch release (its rule: the second and fourth Wednesday of each month).

  3. 4 Nov 2026

    Fourteen days after the PHP2Shell release, by our count: the Cyber Essentials window for critical updates.

  4. 11 Nov 2026

    GitLab scheduled patch release.

  5. 25 Nov 2026

    GitLab scheduled patch release.

  6. 31 Dec 2026

    Security support for PHP 8.2 ends.

How we watch

Where releases are announced first

  • Node.js

    About a week ahead: this release was pre-announced on 14 October.

  • OpenSSL

    Pre-notification “usually done one week before the actual release”.

  • Go

    A pre-announcement three to seven days before the release.

  • Django

    Notifications about a week before public disclosure.

  • PHP

    PHP2Shell was announced the day before release; PHP's news feed is the first place it appears.

  • GitLab

    Scheduled patch releases twice a month, with critical releases in between.

  • CISA KEV

    The US list of vulnerabilities known to be exploited: a signal to move faster.

The proactive plan

Patch Watch

A named engineer watches the releases that matter to your stack. When one is announced in advance, you hear from us before it ships: whether you run an affected version, and when we'll patch. Then we patch, verify on the running server, and send the evidence.

Patch Watch: site

£99a month per site

Set up within 5 working days

For a site on managed hosting or a platform. We watch its PHP or Node.js, its platform and its end-of-life dates, and keep it current.

  • Advance warning when PHP, Node.js, OpenSSL or your platform pre-announce a security release
  • Critical security updates applied within 14 days of release, with dated evidence
  • End-of-life tracking, with upgrades planned before support runs out
  • Monthly backup check and report
  • Email support in UK working hours

Patch Watch: server

£249a month per server

Set up within 5 working days

For a server or container host you own. We keep its operating system, PHP or Node.js patched and prove it each month.

  • Advance warning of pre-announced security releases, and whether you run an affected version, before release day
  • Operating system, PHP and Node.js updates, restarts and redeploys verified
  • Critical security updates applied within 14 days of release, with dated evidence
  • Monthly backup restore test and report
  • Email support in UK working hours

All prices are fixed, excluding VAT, and agreed in writing before any work starts.

One-off: PHP

PHP security, fixed and signed off

Host confirmation £195, patch and verify £450, compromise check £850, upgrades to PHP 8.4 from £495.

PHP prices

One-off: Node.js

Node.js, updated and signed off

Platform confirmation £195, patch and verify £450, upgrades from Node.js 18 and 20 from £795.

Node.js prices

OnComp is a web and IT consultancy in Shoreditch, London. We're not an NCSC-assured Cyber Incident Response provider, and none of the organisations quoted on these pages has reviewed or endorsed our services.