On 21 October, Node.js and PHP released security updates addressing vulnerabilities that could affect applications running older versions of these runtimes.
These included a remote code execution vulnerability in Node.js and two critical PHP vulnerabilities reportedly being exploited in the wild.
Security vulnerabilities addressed
| Runtime | Security issue | Roar AI status |
|---|---|---|
| Node.js | 10 vulnerabilities, including CVE-2026-111497, a Brotli decompression issue that could allow remote code execution | Patched |
| PHP | CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities that could be exploited without authentication | Patched |
Are applications hosted on Roar AI affected?
No action is required. We've automatically updated affected applications to patched runtime versions.
Applications deployed after the security fixes were released use the updated runtimes.
For applications already running affected versions, we rebuilt and redeployed them using the same application code that was previously deployed. No new customer code was introduced, and application settings and data remain unchanged.
We verified the updated runtime versions and checked application health following deployment.
You may see a deployment labelled Security update by Roar in your application's deployment history.
Running Node.js or PHP elsewhere?
If you manage applications outside Roar AI, ensure they're running patched versions.
| Runtime | Patched versions |
|---|---|
| Node.js | 26.12.1, 24.22.1 or 22.23.4 |
| PHP | 8.5.12, 8.4.27, 8.3.36 or 8.2.35 |
Node.js 20 and 25 are no longer receiving security fixes. Applications running these versions should migrate to a supported release.
For technical details, refer to the official Node.js and PHP security advisories.
Security updates, managed for you
Keeping application runtimes secure is part of operating a managed hosting platform.
We monitor relevant security advisories, update affected runtimes and verify deployments so customers don't have to manage these infrastructure updates themselves.
For more information about our security practices, visit our Security page.
If you've identified a potential vulnerability in Roar AI, contact cloud@roar-ai.com.