Security update: Patch PHP, Java and Node.js to protect your API keys

Updated

A wave of security vulnerabilities has been disclosed across several popular languages and frameworks. This is not specific to Reap or our products, it affects engineering teams everywhere. We're sharing this so everyone in our builder community can stay protected.

Why it matters for your Reap account

If a server in your stack is compromised, an attacker could gain access to the API keys and make requests to Reap on your behalf and systems that connect to your Reap account. Patching quickly is the best way to prevent that.

Who should act

Anyone running PHP, Java, or Node.js on systems that store or use Reap API keys.

Patched versions

  • PHP (PHP2Shell, CVE-2026-109618 and CVE-2026-109619): emergency fixes are available in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP warns about installations serving web requests; exploitability depends on configuration. Announcement | Patch notes
  • Java (CVE-2026-91403): the October 20 quarterly update alone is not enough for Oracle JDK. The October 21 emergency fix is in 8u511 b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2 and 27.0.1.0.2. Other JDK vendors use different build numbers, so check your vendor's advisory rather than applying Oracle's numbering. Security alert | Patch notes
  • Node.js: security fixes were released on October 21 in 22.23.4 LTS, 24.22.1 LTS and 26.12.1 Current. We recommend running a supported LTS branch in production. Announcement | Patch notes

What we recommend

  1. Upgrade your PHP, Java, or Node.js runtime to one of the patched versions above, along with your key frameworks.
  2. Update your dependencies and run a vulnerability scan (for example npm audit, Composer audit, or your Java dependency checker).
  3. Rotate your Reap API keys if you have any doubt about their exposure. You can revoke and create new keys from the Settings > API in your dashboard. Please make sure to update first (Step 1 and 2) before rotating your API keys.
  4. Review your recent API activity for anything unexpected.

Need help?

If you have questions or need assistance, contact our support team via the Live Chat in the Reap Dashboard (bottom right corner) or email us at hello@reap.global

For more information, visit Know who to talk to at Reap.