In late October 2026, software teams around the world had a busy week. Within two days, October 20 and 21, three platforms that a huge number of websites and apps run on, PHP, Node.js and Java, all shipped fixes for a batch of security vulnerabilities. Some of them let an attacker run code on a server without logging in.

A grandmother and her granddaughter draw a flower together on a tablet at a low table; in the corner, the green dinosaur mascot in a hard hat and tool belt stands on a stool, fixing a machine cabinet with a wrench

If you saw the news and wondered whether the app your child uses is safe, here is the short answer: the Dino Kids server was running the patched version of PHP on the evening of October 21, 2026, the same day the fix came out. The app on your child's iPad, iPhone or Android phone does not use any of these three platforms. The rest of this post explains each point, with numbers we checked on the system that is actually running.

What happened

  • PHP. On October 21, the PHP team released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which security researchers call "php2shell". Both are rated 9.2 out of 10 (critical) on the CVSS 4.0 scale: an attacker without an account can make the server run their code. Details leaked on social media before the planned disclosure date, so PHP shipped the fix early. Real attacks were seen the same day, and on October 26 the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its list of vulnerabilities known to be exploited. PHP says plainly that no configuration change fully blocks it. Updating is the only fix.
  • Node.js. Also on October 21, Node.js fixed 10 vulnerabilities (4 rated high) across its 22, 24 and 26 release lines. The most serious, CVE-2026-111497, lets corrupted Brotli-compressed data lead to remote code execution. Node.js 20 and older are past end of life and get no fix.
  • Java. On October 20, Oracle released its quarterly patch update with 55 fixes for Java SE. A day later came an emergency fix, CVE-2026-91403 (9.1 out of 10): Java could keep trusting certificates from an Indian certificate authority, eMudhra, even though its private key had leaked.

Three platforms patching at once was a coincidence, but the effect is the same: any system that is slow to update gets probed almost immediately.

What Dino Kids is made of

Whether you are affected depends on what you are built from. Dino Kids has three parts:

  • The app on iPad, iPhone and Android is built with Flutter (the Dart language). It contains no PHP, Node.js or Java SE, so it is not affected by this round of fixes.
  • The server handles account sync, the coloring page library and the voice audio. It runs PHP 8.5 with Laravel. This part is in scope for php2shell.
  • The website dino-kids.digidinos.com is made of pre-built static pages. It does not run Node.js or Java to serve readers, so it is not affected either.

So the only part that needed urgent action was the server.

When the server was patched

We would rather not just say "it's updated". This is what we checked on the server that serves the app, on October 29, 2026:

  • PHP 8.5.12 was installed at 23:04 on October 21, 2026 (Vietnam time, 16:04 UTC), and the PHP process that serves the app was restarted right after, at 23:05. The patched version is the one actually running, not just sitting on disk. That was the same day PHP published the fix.
  • No Node.js or Java process serves the app. The Dino Kids server runs only PHP. The admin screens use hand-written files and need no Node.js build step.
  • The Dino Kids HTTPS certificate is issued by Google Trust Services, so the eMudhra problem does not touch it.
  • On October 29, we also reviewed the path in front of the server and updated the HTTPS encryption library on the relay server to the latest version.
  • Every code change has to pass an automated test suite before it reaches the server. That is also why an upgrade like PHP 8.5.12 could go in within hours without breaking anything: the tests were already running on the same PHP 8.5 line.

Why we could move that fast

There is no magic here, just three habits:

  1. Stay on current versions. The Dino Kids server runs PHP 8.5 and Laravel 13, the newest supported lines. The older the version, the more likely it is to be left behind when a flaw appears: this time, PHP 8.1 and older and Node.js 20 and older got no official fix.
  2. Install fixes from a source that ships them early. The PHP packages on the server come from a repository that closely follows PHP's own releases, so the fix arrived the same day instead of after the few days many operating systems' default repositories take.
  3. Keep the software small. The app carries no server or interpreter inside it. The website is static. The fewer moving parts, the fewer places need patching.

Do parents need to do anything?

Almost nothing. If you want extra peace of mind, there are two small steps:

  • Keep your device's operating system up to date (iPadOS, iOS, Android). Most security fixes, including changes to which certificates are trusted, reach your device through Apple and Google updates.
  • Update Dino Kids when the App Store or Google Play says a new version is available.

You do not need to change any passwords because of these vulnerabilities. And as a reminder: Dino Kids works fully without an account, and the app has no ads and no third-party tracking. What gets sent to our server, and why, is spelled out in our privacy policy.

Being straight with you

No system is perfectly secure, and we will not promise that. What we can promise is this: we follow the security announcements for the software Dino Kids depends on, we apply fixes as soon as they are out, and we will tell you honestly if something goes wrong. If you notice anything unusual, or you are a security researcher who wants to report a vulnerability, write to us at dinokids@digidinos.com.

References