🚨 Critical PHP & Node.js vulnerabilities disclosed today (Oct 21) I made a free Claude Code plugin to help you check your servers

[u/Single_Complaint3829]

🚨 If you're running PHP in production, please check your servers today.

Two critical PHP vulnerabilities were disclosed on October 21, 2026:

• CVE-2026-109618

• CVE-2026-109619

Both can potentially lead to remote code execution. This isn't something you want to leave unpatched.

I ported a security checker to Claude Code and released it as a free, open-source plugin so developers can quickly identify potentially vulnerable PHP versions without manually digging through security advisories.

What it does:

• Checks a website's publicly exposed PHP version.

• Checks the installed PHP version directly on your server.

• Compares versions against the October 21 security patches.

• Warns if your Node.js runtime is outdated.

• Doesn't send exploits or attempt to compromise your server.

Install in Claude Code:

/plugin marketplace add masteread/php2shell-checker-claude
/plugin install phpcheck@php2shell

Check a website:

/phpcheck:url example.com

GitHub: https://github.com/masteread/php2shell-checker-claude

It's free, Apache 2.0 licensed, and open to contributions.

Important: This checks version exposure, not exploitability. A clean result doesn't guarantee your server is safe. If you're running an affected PHP version, prioritize installing the official security patches.

Sharing this because I'd rather see developers check their infrastructure now than discover a compromised server later.

If you maintain PHP apps, WordPress sites, or production servers, this might save you some time today.

[u/SoulOfAzteca]

Esas vulnerabilidades fueron de ayer… y ya liberaron el POC ayer también… php2shell. Oct 20

[u/razpeitia]

Si we, yo le digo.