Security news, explained simply: what happened in October 2026
New security releases for PHP and Node.js, and what this year taught about plugins: this month's security news in plain language, with the terms explained.
Request an AI summary
Security news is full of acronyms and severity scores, and it’s hard to tell what any of it means for a normal website. This post sorts October’s headlines into plain language: what happened, what the terms mean, and how the process behind it works.
The short answer up front: most of this news is a sign that the system works. Problems get found, fixed and published, and that’s routine for any software that’s actively looked after.
It describes public reports. It is not advice for any particular setup.
1. Terms: the short glossary
- Vulnerability: a mistake in software that could let it be used in ways it was never meant for.
- Patch or security release: a new version of the software that removes the mistake.
- CVE: a public ID number for a vulnerability, so everyone talks about the same thing.
- CVSS: a score from 0 to 10 for how serious a vulnerability is. 9 and above counts as critical.
- Remote code execution (RCE): a vulnerability that could let someone run their own code on a server over the internet. That’s why such fixes are rated critical.
- End of life (EOL): a version that no longer gets fixes, so it’s time to move to a newer one.
- Supply chain: everything a website relies on from others, such as plugins, update servers and the companies behind them.
2. PHP: security releases for all supported versions
PHP is the programming language behind a large part of the web, including WordPress and many other content management systems and shops.
On 21 October, the PHP project published security releases for all supported versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two vulnerabilities rated critical. Releases like this are part of how PHP is maintained: the project fixes issues and publishes new versions for every supported line at the same time.
The release notes also mention that PHP 8.2 reaches its end of life on 31 December 2026, a date that has been planned for a long time. Newer versions continue to be supported.
3. Node.js: ten fixes in one release
Node.js runs JavaScript on servers. It powers web apps, APIs and the build tools many modern websites are made with.
Its security release, also on 21 October, fixed ten vulnerabilities across the supported lines 22, 24 and 26: four rated high, three medium and three low. Node.js publishes security releases like this a few times a year.
One of the fixes concerns the decoder for Brotli, a compression format that makes web pages and files smaller on their way to the browser. Because many programs use the same compression library, the fix reaches other software as well.
4. Plugins: trust is part of the setup
Content management systems like WordPress get many of their features from plugins, small add-ons from different makers. That’s one of their strengths, and it also means a website relies on each of those makers.
This year, several reports were about exactly that: cases in which the infrastructure of a plugin maker, such as its build system or customer accounts, was compromised, and the problem reached sites through the regular update channel. The makers and the WordPress community responded with fixes and guidance.
The takeaway isn’t to avoid plugins. It’s that the choice of plugins and the companies behind them is part of a website’s setup, just like the choice of hosting.
5. Updates: a normal part of running a site
Every piece of software receives fixes over its lifetime. That isn’t a sign of bad software; it’s a sign of software that’s maintained. Large projects like PHP and Node.js have dedicated security teams, clear processes for reporting issues, and planned release schedules.
For a website, this means updates are a normal, recurring part of running it, like servicing a car.
6. Overview: who keeps track
Following all of this is a task of its own: release notes, advisories from the projects and news about the plugins and services a site depends on. For most businesses, the website isn’t their main focus, so the useful question isn’t “what does this CVE mean?” but “who keeps an eye on this for us?”
The short version
- PHP: security releases for all supported versions on 21 October; PHP 8.2 reaches its planned end of life on 31 December 2026.
- Node.js: ten fixes on 21 October, including one in the Brotli decoder.
- Plugins: the choice of plugins and their makers is part of a site’s setup.
- Updates are routine: they show that software is being looked after.
This post summarises public reports as of late October 2026 and is not technical advice for a specific system. If you’d like someone to keep an eye on your website’s updates, get in touch.