Two critical, unauthenticated remote code execution bugs in PHP, nicknamed "php2shell", were fixed on 21 October in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If anything you run serves web requests through PHP, patch it today. The same day brought Node.js security releases with four high-severity fixes, and a self-managed GitLab patch for a CVSS 10.0 code execution bug.
Two dates go in the calendar: 16 November for Copilot model removals and 14 January 2027 for the OpenAI GPT-4 series API shutdown. Each section ends with a verdict. For the wider archive, see Platform and language release notes: what breaks and what to fix.
PHP "php2shell": patch every PHP server now
The PHP project's security advisory says the two vulnerabilities (CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 in the project's 20 October pre-notice) "can allow unauthenticated remote code execution." Everything serving web requests is at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The project rates mod_php highest, with a demonstrated exploit where an unauthenticated request triggers the attack before any application code runs. Its release posts add: "There are no complete mitigations, updating is the only safe choice."
PHP 8.1 and older no longer receive updates. CISA's 21 October alert tells organizations that can't update immediately, or that run 8.1 or earlier, to take PHP-based systems offline until they're patched. CISA says it has not observed exploitation as of publication, and neither bug was in its Known Exploited Vulnerabilities catalog as of 21 October. Cloudflare and watchTowr both say they're seeing attack traffic. Those are third-party reports, so treat them as a reason to hurry, not as established fact.
Rebuild and redeploy container images, too. Google Cloud's guidance says Cloud Run services built without automatic base image updates must be rebuilt.
Verdict: act now, today.
Node.js security releases and the eMudhra certificate distrust
Node.js shipped 26.12.1, 24.22.1 and 22.23.4 on 20 and 21 October. The project's security release post lists a high-severity Brotli decoder out-of-bounds write that permits remote code execution (CVE-2026-111497) on all three lines, plus two TLS hostname-check bypasses (CVE-2026-106069 and CVE-2026-105483) and a dns.resolve NUL-character truncation (CVE-2026-105482). Dependency updates cover c-ares, Undici, OpenSSL and SQLite. Node says end-of-life versions are always affected by a security release, so anything on Node 20 or older gets no fix. Our piece on GitHub Actions dropping Node 20 covers that end of the problem.
eMudhra intermediate CAs
The release also carries a ca-cert update for the eMudhra incident. eMudhra says the keys of eight of its intermediate CAs were cryptographically weak and that it revoked all eight. It says none of them issued a certificate for real use and it knows of no exploitation. Cloudflare's write-up warns that an attacker holding such keys could forge a certificate for any domain, and that updating an SDK alone may not change your trust policy. Its advice: don't clear new certificate errors by disabling verification.
Verdict: act now on Node, plan the image rebuild this week.
GitHub: supply-chain controls and the 16 November Copilot cutoff
Copilot models leave on 16 November
GitHub's 15 October changelog says Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra are deprecated across all Copilot experiences on 16 November. The suggested replacements are Claude Opus 5.5, and GPT-6.1 Sol or GPT-6 Luna. Under default enablement they're switched on automatically for Business and Enterprise unless an admin has turned the default off. Claude Opus 4.8 stays available to individual Copilot subscribers on annual plans. If you have turned it off, enable the new models first. A 19 October changelog makes the model policy REST API generally available, so you can script that. The October Copilot deprecations piece covers the earlier round.
Supply-chain controls
GitHub's changelog describes a package firewall in public preview for Enterprise Cloud, npm only, free during preview and metered at general availability. It offers a cooldown period, advisory checks and attestation-downgrade checks. Workflow lockfiles, also in preview, pin actions and their transitive dependencies. Separately, push protection now blocks Anthropic API keys by default.
AI Scan and agentic autofix consume Code Security AI Credits, so set a budget before enabling either.
Verdict: plan for it. Copilot admins have until 16 November; pilot the firewall on one repository.
Anthropic API version 2026-10-21 and Opus 5.5 fast mode
Anthropic's release notes announce API version 2026-10-21. In it, a request that sends temperature, top_p or top_k returns a 400 error, even at the default value. Requests that rely on a non-default value can either drop the parameter or stay on 2023-06-01, and the versioning page gives no retirement date for that version. New SDK majors send the new version by default (Python 2.0.0, TypeScript 1.0.0, Go 2.0.0 and others) and move from the MIT licence to Apache 2.0. Anthropic says no code changes are needed for the licence change, but your dependency register needs updating.
Anthropic also launched user profiles on 20 October. If you resell or proxy Claude, they let you tag each request with an end customer, so an enforcement action can hit one customer instead of your whole organization. On 15 October, fast mode for Claude Opus 5.5 left research preview, with no access request needed. The notes state no price.
Pin SDKs until someone has run the migration. Our Claude API tutorial is the baseline to test against.
Verdict: plan for it.
Self-managed GitLab 19.5.1
GitLab released 19.5.1 and six backports (19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13) on 21 October. It "strongly" recommends all self-managed installations upgrade immediately. The Critical fix is CVE-2026-110264, an integer overflow in the regex compiler, CVSS 10.0, which "could have allowed an unauthenticated user to execute arbitrary code on the GitLab server". The release also fixes OmniAuth-to-LDAP improper authentication (High), OAuth/OIDC discovery cache poisoning (High) and credential exposure in internal response headers (Medium). GitLab.com already runs the patched version. The post doesn't report exploitation, and GitLab shipped two threat detections for self-managed instances.
This is the second critical release in nine days, after 19.4.2 on 12 October. We covered the previous round in GitLab 19.4.1 critical patch. A standing patch window is cheaper than another scramble.
Verdict: act now if you self-manage GitLab, ignore it on GitLab.com.
OpenAI GPT-4 series API shutdown on 14 January 2027, plus cost controls
OpenAI's deprecations page says it notified developers on 14 October that GPT-4o, GPT-4o mini, GPT-4.1 and GPT-4.1 mini leave the API on 14 January 2027. The listed replacement for all four is gpt-6-luna. Fine-tuned versions follow their base model's schedule. The same page promises generally available models at least six months' notice, except where safety or compliance concerns require faster. This notice is three months. GET /v1/models returns an optional shutdown_date field you can monitor.
Our read: the hard part is regression-testing prompts on a new model, not the per-token price, and a January date leaves December's freeze in the way.
OpenAI's API changelog also added 12-hour prompt caching on 20 October (cache writes cost 2.5x the input price) and project-level service tier restrictions on 21 October.
Verdict: plan for it. Inventory every call to those four snapshots, including fine-tunes, now.
Apple developer agreement and App Review rules
Apple updated its Developer Program License Agreement on 13 October. Apple asks you to sign in to your developer account and accept the updated terms. Changes include Section 3.2 security requirements and tax reporting to authorities. On 16 October Apple revised the App Review Guidelines, and new 2.5.19 names hidden, dormant or undocumented features. Apple's companion post on content moderation says the rules now explicitly cover nonconsensual intimate imagery, including imagery generated with AI tools.
Verdict: act now on the agreement if you ship iOS apps, plan for the guideline changes before your next submission, ignore otherwise.
What this means for your engineering plan this week
Two items need an owner and a patch window today: PHP and Node. Name one person for each, including whoever owns container base images, because rebuilding is where these patches get forgotten. If you self-manage GitLab, the 19.5.1 upgrade belongs in the same window.
Everything else is a calendar entry. 16 November for Copilot model policies, 14 January 2027 for the OpenAI shutdown, and an Anthropic SDK pin until the migration is scheduled. Judgment: the OpenAI date is the one most likely to slip, because it lands right after the holiday freeze.
If you still have last week's list open, last week's engineering news has the Vercel and Gemini deadlines, which fall on 23 October.
FAQ
Do I need to patch PHP if I only run WordPress or Laravel?
Yes. The advisory covers all PHP installations serving web requests, whatever framework sits on top. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and redeploy any container images. PHP 8.1 and older get no update from the PHP project.
Which Node.js versions fix the October 2026 security issues?
Node.js 26.12.1, 24.22.1 and 22.23.4. Node.js says end-of-life versions are always affected, so Node 20 and older have no fix and need an upgrade.
What happens to Copilot models on 16 November?
Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra are deprecated across all Copilot experiences. If an admin has turned off default enablement, the suggested replacements (Claude Opus 5.5, GPT-6.1 Sol or GPT-6 Luna) aren't switched on automatically, so enable them before that date. Claude Opus 4.8 stays available to individual Copilot subscribers on annual plans.