On October 21, the PHP and Node.js projects each released urgent security fixes.
PHP. The PHP project released emergency updates (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35) for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. These could allow an attacker to run commands on a vulnerable server. Security vendors have reported early exploitation.
Node.js. The same day, the Node.js project released security updates (22.23.4, 24.22.1 and 26.12.1) covering several vulnerabilities, including CVE-2026-111497, a flaw in Node’s bundled Brotli decompression library that could allow memory corruption and potentially code execution. Node.js versions that are no longer supported will not receive a fix.
What we did on our web hosting servers. We updated PHP across our web hosting servers the morning the release came out, and we have also updated Node.js on those servers to the fixed release.
FileMaker Server and Node.js. FileMaker Server includes its own copy of Node.js, used by the FileMaker Data API. As of today, Claris has not released an updated version of it. We reviewed the Windows and Linux FileMaker Server versions we host and, in the configurations we reviewed, found no way for the Brotli flaw to be triggered through that component. We are watching for the Claris update and will apply it as soon as it is available. If you run your own Node.js application on one of our servers, please update it to 22.23.4, 24.22.1, 26.12.1 or later.
FileMaker Server and PHP. FileMaker Server for Windows before version 19.2.1 includes its own copy of PHP, supplied by Claris and not updated by our PHP patching. That PHP is no longer supported, so we recommend upgrading to a current FileMaker Server version. FileMaker Server for Linux has never included PHP. If you have installed your own PHP on a Windows server, please update it immediately.
Our commitment to your security. Protecting your data isn’t something we do in reaction to the news. It is how we have run our servers since 1998. Our systems are built and maintained to documented hardening standards, with layers of protection that include firewalls at the network and server level, locked-down remote access, web filtering that turns away automated scanners and attack traffic, and automatic blocking of repeated login attempts. Our servers are monitored continuously. When a serious vulnerability is published, we assess how it affects the systems we run, including the software bundled inside the products we host, and we tell you plainly what we find, even when the answer is that something needs to change. You have trusted us with your data, and we treat earning that trust as our job every day.
If you have questions or would like help, open a support ticket in your ODITech client area at https://my.oditech.com
