Two separate bugs from the past week are now officially under attack. On 26 October the US Cybersecurity and Infrastructure Security Agency (CISA) added the two PHP flaws known as PHP2Shell, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog. On 27 October it did the same for CVE-2026-111497, a memory corruption flaw in Google's Brotli decoder that goes by Node2Shell, Broccoli2Shell and HTTP2Shell.
Between them, these bugs reach PHP sites, Node.js and .NET services, Python HTTP clients, proxies and service meshes, and the admin interfaces of network appliances. CISA's deadlines bind only US federal agencies: 29 October for PHP2Shell and 10 November for the Brotli flaw. The agency wants everyone else to treat the fixes as a priority too.
PHP2Shell: from attempts to working shells
The PHP project fixed both flaws on 21 October. The Register says each carries a 9.2 CVSS score and allows unauthenticated code execution, while BleepingComputer calls the attacks high-complexity. Amazon says probing started on 17 October, which put attackers four days ahead of the fixes. According to the PHP security team, none of the proof-of-concept code that leaked before release actually worked.
The first credible report of success came from Perplexity researcher Adel Karimi. On 24 October three of his honeypots, all on PHP 8.4.26 behind Apache mod_php, logged 35 shells being run, in a pattern matching CVE-2026-109618 but not the second bug. He warned that a single-worker setup made the honeypots an easy target, so production servers may prove harder to hit. Delft University's Threat Intelligence Lab has seen upwards of 50,000 attack requests coming from more than 600 addresses, and 171 of those addresses moved on to sending exploit code or droppers.
Not every early claim survived. The Register notes that Sophos revised its first verdict to scanning and failed attempts, and Palo Alto Networks retracted a link between the bugs and a government breach. CISA has not named any victims. Separately, on 23 October PHP shared mitigation for another code execution flaw, CVE-2026-115560, which is still unpatched and which PHP says needs an "unusual" mix of settings and application code to exploit.
The Brotli flaw reaches well beyond Node.js
CVE-2026-111497 is a buffer overflow in Brotli's decoder. Node.js explains that a crafted stream makes the decoder misread an invalid block switch as a need for more data, so it keeps filling an eight-byte buffer past its limit. That can crash a process, leak memory or, as Imperva's research confirms, allow code execution. BleepingComputer says Brotli 1.0.3 to 1.0.9 is affected, plus 1.1.0 and 1.2.0. Microsoft scores the bug 8.1, while other sources call it critical, and sources differ on whether disclosure came on 21 or 22 October.
Both sides of a connection are at risk: a server can receive a hostile compressed request, and a client can receive a hostile compressed response from a URL it fetches. Fixes are out for Node.js, Python, Bun, Envoy, Istio and .NET 8, 9, 10 and 11, with Microsoft's out-of-band release landing on 25 October. On the Python side, httpx, requests, aiohttp with speedups and urllib3 with Brotli are named, and patched PyPI packages appeared on 23 October. JFrog also built an FFmpeg exploit using a JPEG XL image and found a denial of service in Apache Arrow, so HTTP is not the only way in.
Things moved fast. Microsoft's advisory said it knew of no successful attacks, yet two days later CISA listed the flaw as exploited. Wiz puts the share of cloud environments using vulnerable components at 91 percent.
Patching is not the last step
With Brotli, an update alone does not close the hole. Running processes must be restarted, and container images have to be rebuilt and pushed out again. A site tracking the flaw cautions that patching the operating system's copy of Brotli leaves Node.js and any other software with its own embedded copy still vulnerable. OpenAI, whose Codex Security team found the bug, says the underlying fix entered Brotli's code in February without being recognised as security-relevant, and no new Brotli release followed, which is why each project embedding the library must ship its own fix.
For PHP2Shell, appliances are the slow lane. Eclypsium's InfraTrust report notes that VPN gateways, NAS devices, firewalls and load-balancing controllers often build PHP into their firmware, leaving customers dependent on vendor releases. QNAP, Check Point, F5, NetScaler and Palo Alto Networks have each said some products are affected.
What to do
- Move PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 according to the branch you run, and pull unsupported systems offline if you cannot secure them.
- Install the Brotli fixes for Node.js, .NET, Python packages, Bun, Envoy and Istio, then restart running services and rebuild and redeploy containers, including software that ships its own Brotli copy.
- Until you can patch, stop Brotli-compressed traffic from reaching servers at your proxy or firewall and strip Brotli from Python apps, knowing that clients receiving hostile responses are still exposed.
- Keep appliance admin interfaces that run PHP off the public internet until your vendor delivers firmware with the fixed PHP.
Sources
- CISA warns of hackers now exploiting critical Node2Shell flaw BleepingComputer
- CISA confirms PHP2Shell vulnerabilities now exploited in attacks BleepingComputer
- CISA confirms PHP2Shell under attack as researchers clock successful exploits The Register
- Microsoft releases emergency .NET security fixes for Google Brotli bug The Register
- Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches BleepingComputer
- InfraTrust report warns of exploited flaws in critical network infrastructure BleepingComputer