Critical Security vulnerabilities - What's Next?

$ anything2shell

php, node, http, react. The software changes, the name stays the same, yet another criticial software vulnerability in core web runtimes, compression libraries, and edge proxies can turn any internet-facing service into direct remote code execution, even when your own application code is completely secure.

This site breaks down what each *2Shell vulnerability is, why it puts your organization at risk, how to recognize vulnerable versions and indicators of compromise (IoCs) in your logs, and how to mitigate it. Everything here including the URL checker below is based strictly on public advisories and passive checks to help you defend your infrastructure without exposing exploit details.

Check if your URL is vulnerable

Enter your domain to run a safe, non-intrusive exposure check

PHP2Shell

CVE-2026-109618 CVE-2026-109619 CVE-2026-115560 CVSS 9.2 Critical

PHP2Shell is a set of critical memory-safety vulnerabilities in the core PHP engine affecting roughly 70% of websites—including WordPress, Drupal, Joomla, and Magento.

Because the flaw sits in the PHP runtime itself, websites are at risk even when their own application code is completely secure. An additional flaw disclosed on October 23 (CVE-2026-115560) also allows remote code execution when session upload progress is enabled.

Why it’s a risk

Unauthenticated attackers can send crafted HTTP requests that force PHP workers out of memory during session initialization (CVE-2026-109618). This leaks live server memory—such as database passwords, API keys, and session tokens—directly into outbound Set-Cookie: PHPSESSID response headers, and allows remote code execution by corrupting shared OPcache memory (CVE-2026-109619).

How to recognize it (Versions, Logs & IoCs)

  • Vulnerable versions: PHP 8.5 < 8.5.12, 8.4 < 8.4.27, 8.3 < 8.3.36, 8.2 < 8.2.35, and all end-of-life PHP 5.4–8.1 releases.
  • In your logs: Unusually long or binary URL-encoded Set-Cookie: PHPSESSID=... headers in outbound responses, bursts of multipart/form-data or PHP_SESSION_UPLOAD_PROGRESS POST requests followed by HTTP 500 errors, and repeated php-fpm worker restarts.
  • Threat Intelligence IoCs: Traffic from Google Threat Intelligence campaign GLOBAL.26.015 and threat actor UNC5638 (see full IoC table below).

How to mitigate it

  • Patch & restart workers: Upgrade PHP to a fixed release below and restart php-fpm or Apache so running worker processes load the patched binary.
  • Disable session upload progress: Set session.upload_progress.enabled = 0 in php.ini and block PHP_SESSION_UPLOAD_PROGRESS at your WAF.
Important: Disabling session.upload_progress.enabled blocks CVE-2026-115560, but does not stop the memory leak and RCE in CVE-2026-109618/19. Patching PHP is mandatory.
PHP Branch Vulnerable Releases First Fixed Release Operational Note
PHP 8.5 < 8.5.12 8.5.12 Restart PHP-FPM / web workers after upgrading
PHP 8.4 < 8.4.27 8.4.27 Restart PHP-FPM / web workers after upgrading
PHP 8.3 < 8.3.36 8.3.36 Verify Linux distribution backports if using OS packages
PHP 8.2 < 8.2.35 8.2.35 Oldest upstream-supported branch receiving fixes
PHP 5.4 – 8.1 All EOL releases Distro backport only Place behind Cloudflare Access, Cloud IAP, or VPN

Node2Shell

CVE-2026-111497 PYSEC-2026-4322 / 4323 CVSS 9.2 Critical

Crafted Brotli-compressed data triggers a critical memory corruption flaw in Google’s C Brotli decoder (1.0.3–1.2.0), enabling remote code execution in Node.js, Bun, and Python HTTP clients.

Because the vulnerability sits in the underlying compression library bundled with the runtime, it affects both incoming API requests and outbound HTTP fetches made by your server.

Why it’s a risk (Inbound & Outbound)

Inbound Server Risk: Triggered when Express 5 or body-parser automatically decompresses an incoming request with Content-Encoding: br. Outbound Client Risk: Triggered when Node.js fetch(), Next.js image optimization (/_next/image), or Python HTTP libraries (requests, urllib3, httpx) download a response from an untrusted URL that returns Content-Encoding: br.

How to recognize it (Versions & Logs)

  • Vulnerable versions: Node.js 22.x < 22.23.4, 24.x < 24.22.1, 26.x < 26.12.1; Bun <= 1.4.3; Python Brotli <= 1.2.0.
  • In your logs: Unexpected POST or PUT requests using Content-Encoding: br, or repeated Node.js / Bun worker crashes (SIGSEGV) prior to shell execution.

How to mitigate it

  • Patch runtimes & containers: Upgrade to Node.js 22.23.4, 24.22.1, or 26.12.1, Bun 1.4.4, and Python Brotli 1.2.1.
  • Block Brotli request bodies at the edge: Configure your WAF or API gateway to reject incoming Content-Encoding: br requests while keeping gzip and deflate enabled. In Next.js, set images.unoptimized: true until Node.js is patched.
Software / Runtime Vulnerable Versions First Fixed Release
Node.js 22.x < 22.23.4 · 24.x < 24.22.1 · 26.x < 26.12.1 22.23.4 · 24.22.1 · 26.12.1
Bun <= 1.4.3 1.4.4 (bundles Brotli 1.2.1)
Python Brotli / brotlicffi <= 1.2.0 / <= 1.2.0.x 1.2.1 · 1.2.1.0
Google Brotli (Upstream C) 1.0.3 – 1.2.0 1.2.1 · 1.1.1 · 1.0.10

HTTP2Shell

CVE-2026-111497 (Envoy/Istio) CVE-2026-15176 / 93479 / 97205 CVE-2026-95101 / 97629 CVSS 9.2 Critical

Reverse proxies and Kubernetes ingress gateways face two converging HTTP-layer threats: Brotli decompression RCE in Envoy Proxy and Istio, and five critical NGINX worker memory, HTTP/3, and mTLS bypass flaws.

Because edge proxies inspect traffic first, a compromise or authentication bypass at the proxy layer exposes every internal service behind it.

Why it’s a risk

Envoy & Istio RCE (CVE-2026-111497): Gateways with Brotli decompression enabled can suffer memory corruption and remote code execution. NGINX Worker Overflows & mTLS Bypass: Three buffer overflow flaws (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205, rated 9.2 CVSS) allow worker memory corruption, while CVE-2026-97629 allows attackers to forge TLS resumption tickets and bypass client certificate (mTLS) authentication.

How to recognize it (Versions & Logs)

  • Vulnerable versions: NGINX < 1.31.7 / < 1.30.6; Envoy <= 1.39.2 / 1.38.5 / 1.37.7; Istio <= 1.31.1 / 1.30.5.
  • In your logs: NGINX worker process ... exited on signal 11 crash entries in error.log, or unexpected TLS session resumptions on mTLS-protected routes.

How to mitigate it

  • Upgrade ingress & proxy binaries: Update NGINX to 1.31.7 or 1.30.6, Envoy to 1.40.0 / 1.39.3, and Istio to 1.31.2 / 1.30.6.
  • Hardening settings: Disable the Brotli decompressor filter in Envoy/Istio, set proxy_request_buffering off; for NGINX HTTP/3, and set ssl_session_tickets off; on mTLS endpoints.
Edge Proxy / Mesh Vulnerable Releases First Fixed Release
NGINX 0.1.29 – 1.31.6 · 1.30.0 – 1.30.5 1.31.7 · 1.30.6
Envoy Proxy <= 1.39.2 · <= 1.38.5 · <= 1.37.7 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8
Istio <= 1.31.1 · <= 1.30.5 1.31.2 · 1.30.6

Beyond PHP, Node & HTTP: What Else Is in the News?

From the original React2Shell disclosure to this month’s emergency patches in Next.js, Ruby/GitLab, and Python Pillow, these critical vulnerabilities are actively tracked alongside the *2Shell wave.

CVE-2025-55182 CVE-2026-96889 CVSS 10.0 & 9.5

React2Shell & Next.js Emergency RCE Patches

React2Shell (CVE-2025-55182) exposed ~968K servers to unauthenticated RCE via React Server Components (RSC) serialization. On October 14, 2026, Next.js shipped emergency releases 16.4.1 and 15.5.28 (with React 19.3.1) for two new 9.5 CVSS RCE flaws in RSC caching and SVG image rendering (CVE-2026-96889). Upgrade Next.js and ensure sharp >= 0.35.5.

CVE-2026-110264 / 110265 GitLab CVE-2026-6654 CVSS 9.9 Critical

Ruby Regex RCEs Behind 4x GitLab Flaws (Oct 23)

Ruby released 4.0.9, 3.4.12, and 3.3.13 on October 23 to fix memory corruption flaws in its Onigmo regex engine that caused four critical GitLab RCEs (CVE-2026-6654, CVE-2026-5986, CVE-2026-9651, CVE-2026-10124). Patch GitLab and Ruby runtimes immediately.

CVE-2026-112900 436M Monthly Downloads

Python Pillow Image Library RCE

Python’s Pillow imaging library (< 13.0.0) allows OS command injection when processing EPS images with untrusted filenames. Upgrade to Pillow 13.0.0 and rename uploaded files to random UUIDs before processing.

CVE-2026-5027 CVE-2026-42271 Active Exploitation

AI Gateways: Langflow & LiteLLM RCEs

Attackers are actively exploiting Langflow (CVE-2026-5027) and LiteLLM (CVE-2026-42271) to steal LLM API keys and cloud credentials. Keep AI orchestration gateways off the public internet and behind identity-aware proxies.

Threat Intelligence IoCs

Verified Indicators of Compromise for PHP2Shell mass scanning and exploitation from jorgeliauw.nl.

Use these indicators from Google Threat Intelligence campaign GLOBAL.26.015 and threat actor UNC5638 to block active scanners at your firewall and hunt for probing activity in your SIEM.

Firewall & SIEM Blocklist 
# GTI Campaign GLOBAL.26.015 & UNC5638 (jorgeliauw.nl)
116.98.243.14
176.236.127.109
176.236.127.37
49.87.220.67

# Potassium Mirai Botnet & Exploit Staging
85.11.167.243
217.60.242.76
45.198.224.169
92.118.112.100
134.199.154.64
206.188.197.105
thunder.godofthunder.st

# High-Volume PHP2Shell Scanner Nodes
87.121.84.174
181.215.186.252
185.196.220.132
185.161.210.29
152.233.51.69
Indicator (IPv4 / Domain) Subnet / Role Attribution & Observed Activity
116.98.243.14 116.98.224.0/19 GTI GLOBAL.26.015 — Early PHP2Shell mass scanning & OOM probing (jorgeliauw.nl)
176.236.127.109 176.236.0.0/17 GTI GLOBAL.26.015 — Opportunistic PHP2Shell recon & payload testing (jorgeliauw.nl)
176.236.127.37 176.236.0.0/17 GTI GLOBAL.26.015 — Sibling scanner node in same /17 block (jorgeliauw.nl)
49.87.220.67 49.87.0.0/16 GTI GLOBAL.26.015 & Threat Actor UNC5638 probing PHP endpoints (jorgeliauw.nl)
206.188.197.105:9999 Exploit Staging Exposed server hosting aslr_exploit.py, php2shell_fp.py, deep_probe.py, wp_attack.py
92.118.112.100 · 134.199.154.64:50792 Mirai Loader & C2 Potassium Mirai botnet loader & C2 (thunder.godofthunder.st) targeting PHP2Shell