The issues behind the October 21, 2026 vulnerabilities were known months or years before

We live in interesting times ¹ and October 21st was more interesting than most. The big news was a security issue in PHP, now dubbed PHP2Shell. It made international news. Big enough that my grandma called me. Apparently, they were hyping it up on TV. PHP2Shell is worrisome enough to be worth hyping up, mind you. I am just unsure that the messaging needed to be so intense that it got my grandma worried.

PHP2Shell is surrounded by a lot of things worth discussing. The PHP Foundation did not release the patch early despite keeping that option explicitly open in their announcement post and Cloudflare reporting that they saw exploitation attempts. Chainguard released fixed versions hours before the coordinated release was meant to take place. And, of course, a lot of discussions around AI, which was both involved in the discovery of the vulnerability ² and became a primary source of worry for people running PHP. Stories about automated agent swarms both finding and deploying the exploit before the patch was made available were making the rounds — made worse by the fact that they had the Chainguard binaries to reverse engineer the issue from. Though there is some debate going on about how realistic the worst fears of people — entirely automated hacking agent swarms — currently are.

The most worrisome thing in my mind was the admission by the PHP Foundation that they became first aware of the underlying issue in 2024. Their security team developed multiple different approaches but were unsatisfied with all of them. Ultimately the team released no fix; there was no demonstrated path to remote code execution and so the issue was unable to overcome organisational hurdles. That’s not great. Though the PHP Foundation deserves credit for being surprisingly open about all of this. I hope their calls for additional funding get answered.

But because we live in interesting times one critical security issue in software running a large portion of our digital infrastructure wasn’t enough. GitLab and Node.js both released security patches on the same day as PHP; both aimed at plugging up issues that could be used for remote code execution. Both of these issues grew quickly in scope: the GitLab issue turned into the discovery that multiple fixes for Ruby vulnerabilities had not been backported and the Node.js vulnerability turned out to be a larger Brotli vulnerability. And again these issues were known ahead of time. Even worse, patches for both had been available for quite a while.

The fix for the GitLab vulnerability was merged into Ruby on April 29, 2026. GitLab had already addressed an issue on September 23, 2026 involving a double free in Ruby’s regex handling. The patch for that vulnerability is dated May 14, 2025. The double free patch made it into Ruby 4.0, but older versions that were still under active maintenance did not receive a backport. I couldn’t find an explanation for why. Ruby declined to request CVEs because they consider it “unsafe to compile and use a regular expression created from untrusted input.” Today I learned compiling user-defined regex is the same as letting a user run arbitrary code on your machine. Sarcasm aside, this policy has been applied unevenly historically: other memory issues around user-controlled regex have received a CVE in the past.

The Brotli issue is even more confusing. The patch fixing this issue was committed on February 27, 2026, but Google did not publish new releases and so, despite there being a patch in the tree, all Brotli versions remained vulnerable. It seems that they had been unaware of the security implications of what they had fixed.

Each of these was a different failure. I won’t attempt to spin a grand narrative here. Security is hard and it can be tricky to tell what is just a crash and what is a security issue. The fact that Brotli and Ruby both had patches available publicly makes me wonder how often vulnerabilities get patches without anyone realizing that’s what has happened. If LLMs are truly as capable as the hype suggests they are, we might hear about many more of these discoveries in the near future.