PHP has released fixes for two critical flaws that could let an unauthenticated attacker run code on a web server. If you own a website, the useful question is whether its hosting software has actually been patched, not whether your laptop says it's up to date.
That gap between the software you see and the software doing the work connects this Daily Geek Drop. Node.js also has new security releases, while Chrome is adding more nuanced scam warnings. They protect different layers of the web. Knowing who controls each part is how you turn three announcements into a sensible checklist.
Website owners need a hosting answer
The PHP security team's October 21 advisory names the fixed releases as 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It says all PHP installations serving web requests are at risk, including PHP-FPM and Apache's mod_php. The team identifies mod_php as the highest-risk configuration, but that isn't a clean bill of health for the others.
Only an update is a complete solution, according to the advisory. Temporary measures can reduce particular attack paths without making an installation safe. For older PHP branches, ask the operating-system or long-term-support vendor about a backported fix, or plan a move to a supported version.
You don't need to become a server administrator to ask a precise question: which PHP package is running on my site, and has the security fix been applied? Ask for confirmation against your hosting account rather than accepting a general announcement that patches are available. If an agency maintains the site, make that request part of its job.
Node.js needs its own check
Node.js runs JavaScript applications. The project's separate security release lists versions 26.12.1, 24.22.1 and 22.23.4. Its fixes include high-severity problems involving certificate hostname checks, DNS handling and Brotli decompression. Updating PHP doesn't address these Node.js issues.
For a small business, the practical distinction is ownership. A hosted service may manage its runtime for you; a custom application may leave that responsibility with your developer or infrastructure provider. Ask which arrangement applies before assuming someone else has handled it.
Request a check of the deployed application, not just the developer's computer. Put the answer somewhere you can find it later, alongside the person responsible for future updates. A version number is useful evidence only when it describes the system you're relying on.
Chrome adds another decision point
In its October 20 scam-defence announcement, Google describes new suspicious-site warnings for Chrome's Enhanced Protection mode. These indicate lower-confidence risk; known-dangerous sites retain the familiar full-page red warning. A less dramatic warning doesn't mean the page has been cleared.
Google also describes server-side Gemini checks for scam-like page content and warnings when copied suspicious commands are judged dangerous in a ClickFix scam. That's the trick where a page asks you to run a command to repair an invented problem. Don't treat a website's repair instructions as an operating-system update.
There's a privacy choice here too. Chrome's protection-level guide explains that Enhanced Protection shares additional information with Google, including URLs and page samples. On desktop, you'll find the option under Settings > Privacy and security > Security.
If you only browse, review that protection setting and take warnings seriously. If you also run a website, get a separate answer from whoever maintains its PHP or Node.js installation. Browser protection and server patching are complementary jobs; finishing one doesn't finish the other.