Web Stack Security Patches This Week: UpdraftPlus, NGINX, GitLab and Node.js

If you run a website, a Node app or your own code server, this was a busy week for patches. Four separate fixes landed within a few days of each other: stolen UpdraftCentral keys used to backdoor WordPress sites, three NGINX bugs, a top-severity GitLab flaw, and a Brotli bug in Node.js.

My earlier posts in this series covered PHP2Shell, the record Patch Tuesday and the AI coding agent reports, so this one stays on the everyday web stack. For each item you will find what happened, who is affected and what to do next.

1. UpdraftPlus: stolen keys, not a code bug

TeamUpdraft says its website was compromised on the weekend of October 17 and 18. According to Search Engine Journal, the attackers got to a customer database that held connection keys for services including UpdraftCentral, the remote management feature. With those keys, they sent signed commands that connected sites accepted as genuine.

Patchstack reported that the attackers used this route to install malicious plugins, 99 different names in total, which then created an Editor account and quietly raised it to administrator level. Because the commands looked legitimate, the backdoor skipped normal login, including two-factor authentication. Patchstack also described this as a key-theft problem rather than a flaw in the plugin's code.

Fixed versions are UpdraftPlus 1.26.13 (free) and 2.26.13 (premium), released on October 19. They revoke UpdraftCentral Cloud keys. The updates stop new access through that route, but they do not remove anything that was already planted.

What to do:

1. Update to 1.26.13 or 2.26.13 or newer.
2. Under Settings, UpdraftPlus, Advanced Tools, UpdraftCentral, remove any leftover connection keys.
3. Look through your plugin list for names you do not recognise and check your users for unexpected administrators.
4. Change administrator passwords. If you find signs of compromise, restoring a backup from before October 17 is the safest path.

2. NGINX: three critical fixes, mostly for custom setups

F5 released out-of-band patches on October 19 for CVE-2026-15176, CVE-2026-97205 and CVE-2026-93479, all rated critical. BleepingComputer notes that exploitation needs non-default configurations and that F5 has not flagged any of them as exploited. The likely result of an attack is a crashed or restarted worker process, and code execution is possible if ASLR is off or can be bypassed.

F5 also lists mitigations if you cannot patch yet: avoid the alias directive in a location block for CVE-2026-15176, disable asynchronous file I/O or Server Side Includes for CVE-2026-97205, and use named captures in map blocks for CVE-2026-93479. Check F5's advisories for the exact fixed version for your product.

What to do: read your NGINX config for those directives, then update to the fixed release from F5.

3. GitLab: CVE-2026-110264 rated 10.0

GitLab shipped a critical patch release on October 21 for an integer overflow in its regular expression compiler. Under certain conditions an unauthenticated user could trigger it and run code on the server. Every version from 7.0 up to the fixed releases is affected. GitLab.com and GitLab Dedicated are already patched.

Fixed releases are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab also published two detections for self-managed teams: "Onigmo native worker crash" and "Org mode render error burst."

What to do: if you self-host GitLab, move to the latest release for your branch today and add those two detections to your monitoring.

4. Node.js: a Brotli bug and nine others

Node.js shipped security releases on October 21: 22.23.4, 24.22.1 and 26.12.1. The highest severity is High, and CVE-2026-111497 is the one to read about. The bundled Brotli decoder mishandled an invalid block, so an attacker who can send Brotli data to an app that decompresses it with node:zlib can corrupt memory. The advisory says this could mean a crash, a memory leak or remote code execution.

The release also fixes several host-name and IP address validation issues in DNS and TLS checks, and updates dependencies including OpenSSL, c-ares and Undici. The advisory lists no fix for the 20.x line.

What to do: upgrade to a fixed version, and pay extra attention if your app decompresses data from users or third parties.

What this week shows

• Trusted channels can be the way in. The UpdraftPlus keys worked because the commands looked legitimate.
• Not every critical bug hits every server. Several of these need a specific setup, so a quick config check tells you how urgent it is.
• Patching is only half the job. For UpdraftPlus, updating does not remove a backdoor that is already there.
• Self-hosted tools carry extra duty. GitLab.com was patched for you, self-hosted GitLab was not.

A short checklist for this weekend

1. Update UpdraftPlus and remove old UpdraftCentral keys.
2. Check plugins and administrator users for anything unfamiliar.
3. Review NGINX config for alias, AIO, SSI and map captures, then patch.
4. Upgrade self-hosted GitLab to your branch's fixed release.
5. Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1.
6. Keep a recent backup stored away from the server.

A calm hour of patching now is cheaper than a long clean-up later.

Need a hand with WordPress security or server updates? Visit expertwebdeveloper.in or growsmartwithai.com.

Sources: Search Engine Journal on the UpdraftPlus breach · BleepingComputer on the NGINX patches · GitLab patch release 19.5.1 · Node.js October 2026 security releases

Also published on: Medium · Substack · LinkedIn · expertwebdeveloper.in · growsmartwithai.com