October 2026: fixes for Node.js, Next.js, PHP and Python, and what to check if someone builds your site or app

Short answer

Between October 14 and 21, 2026, serious vulnerabilities were fixed and urgent updates released in software that many websites and apps are built on: Node.js, Next.js, React, PHP and Python. Some could let an attacker run their own code from outside without logging in (remote code execution). What you need to do depends on what your site or app uses. First, ask your developer or IT staff which of these you use and which versions, and whether they are on the fixed versions.

What happened

The main items, from each project's official announcement:

For Next.js the issues are in image optimisation (SVG) and use cache; for React, the Server Components packages; for Node.js, compressed data handling, certificate checks and more. Python updated its bundled pip and certificate list in response to a certificate authority incident.

PHP's official announcement says there is no complete mitigation and updating is the only safe option. It also says PHP 8.1 and earlier no longer receive updates from the PHP project, and that PHP 8.2 reaches end of life on December 31, 2026. Node.js likewise says end-of-life lines receive no fix and remain affected.

Updating the foundation does not update the parts on top

For a vulnerability related to the React issue, the Next.js announcement says there is no workaround and asks everyone to update immediately, even if their app does not use similar functions. Updating Node.js does not fix vulnerabilities in Next.js or React running on top of it. A site is built from several layers of parts, so do not stop at "we updated the server"; check the version of each layer.

Malicious code inside a distributed package

On October 21, version 1.107.0 of LiteLLM, a component for calling multiple AI APIs, was published on PyPI and Docker with code that steals credentials. According to LiteLLM's official report, developer credentials were misused to alter the release process; the official 1.107.0 tag on GitHub did not contain the malicious files. It was removed from PyPI about 1 hour 45 minutes later, and the affected Docker tags were removed the same day.

The official report covers environments that installed it without pinning a version during that window. It says that if such an environment could reach the internet, you should assume data was taken and rotate every key and password it could reach. Attacks like this target distribution rather than the people who write the software. Pinning the versions you use, and checking new versions before installing them, reduces the damage.

What to ask your developer or IT staff

Detailed judgement needs the people who built or run the system. Asking these five questions, for example, tells you whether action is needed.