PHP2Shell and Node2Shell: dormant web bugs forced a week of emergency patching

Last week the web's foundations needed emergency repairs. On Wednesday, October 21, the PHP Foundation shipped fixes for two critical vulnerabilities dubbed PHP2Shell, while Node.js disclosed a separate critical flaw in Google's Brotli compression library, nicknamed Node2Shell. Both sets of bugs had sat dormant for a long time, and both allow remote, unauthenticated code execution on affected systems.

The PHP vulnerabilities

According to TechCrunch, the PHP bugs carry the identifiers CVE-2026-109618 and CVE-2026-109619. They let an attacker break into an internet-facing PHP system without credentials and without any action from the victim, effectively handing over full control of an unpatched server.

The flaws were first found in 2024 by researchers at Calif during a security audit conducted as part of the Hack the Planet initiative run by OpenAI and Wiz, which also verified the proof-of-concept exploits. At the time, the bugs were judged unexploitable and left unpatched; researchers recently worked out how to weaponize them. Calif said AI assisted with the exploitation work but that the effort relied mostly on the team's own knowledge of PHP's codebase, adding that no current model can simply unearth every bug from a prompt.

The blast radius is large because PHP remains everywhere. TechCrunch puts roughly 70% of the web-facing internet on PHP, including WordPress, Drupal, Joomla and MediaWiki. After Wednesday's coordinated release, which followed an embargo giving major hosts a head start, banks, retailers, hospitals, gaming sites and some government agencies took services offline to patch.

Exploitation, however, predates the disclosure. Amazon reported detecting PHP2Shell activity about a week before the patches shipped, advising defenders to hunt for signs of compromise from October 17 onward. The PHP Foundation blamed one company for publishing the patches hours before the embargo lifted, though that would not account for the earlier activity. By late Friday, TechCrunch reported confirmed compromises and post-exploit activity, citing Palo Alto Networks among other security firms.

The Brotli flaw

The same Wednesday, Node.js disclosed CVE-2026-111497, an out-of-bounds write in the Brotli decoder scored 9.2 under CVSS v4.0, according to a detailed first-person account on dev.to. It can give a remote, unauthenticated attacker code execution in any process that decompresses attacker-controlled Brotli data. Security firm Aikido has taken to calling the broader problem HTTP2Shell, because the same decoder ships inside runtimes, HTTP clients and gateways across the ecosystem.

The dev.to author audited a single Linux machine and found three separate Brotli builds — Python's distro package, Node's bundled copy, and the system library linked into curl — none of them explicitly installed. Each copy is patched on its own vendor's schedule. Fixes landed in PyPI's brotli 1.2.1 and brotlicffi 1.2.1.0, alongside branch releases 1.0.10, 1.1.1 and 1.2.1 of the C library.

The root cause, per the author's own source diff, is a decoder function whose boolean return value conflated a malformed stream with a request for more input, while fast-path callers ignored the return entirely. A crafted stream forcing a failed block switch left the decoder operating on stale state, writing into memory it should not touch. Strikingly, OpenAI reportedly found the bug in February and the root cause was fixed in the source then, but nobody recognized it as a security issue, so no release carried the fix until this week.

Detection broke in both directions

Two messy detection problems emerged. First, there was a roughly 48-hour window after disclosure in which advisory databases had not mapped the CVE to its PyPI packages, meaning tools like pip-audit, Dependabot and Safety reported vulnerable installs as clean. OSV added the entries on October 23, and the dev.to author verified that current pip-audit now flags affected versions. The databases still disagree on the affected set — OSV lists ten versions, GitHub's advisory seven — though both agree 1.2.1 is fixed.

Second, the patched Node.js release v24.22.1 still reports its bundled Brotli as 1.2.0, because the fix was cherry-picked without bumping the library's version string. Version-based scanners will therefore flag the patched runtime as vulnerable indefinitely. Version strings are an imperfect stand-in for the underlying code, and this CVE broke that proxy in both directions: scanners missed a real vulnerability for two days, and will hallucinate one forever.

Why it matters

Both incidents show how much of the web rests on aging, widely bundled open-source components, often maintained by volunteers without funding for security review. The Brotli case is the sharpest lesson: the fix existed in source for roughly eight months, but until someone shipped a release, every runtime embedding the decoder was exposed. The PHP case shows coordinated disclosure broadly working — mass exploitation was avoided — but also that embargoes leak and many systems remain unpatched. TechCrunch also points to what may come next: researchers expect AI to accelerate the discovery of dormant vulnerabilities of exactly this kind, so the industry should expect more weeks like this one.