Most days in tech, we worry about the shiny things: new frameworks, AI features, cloud integrations. But every so often, the ground underneath our feet gives way.
Today the PHP project shipped emergency fixes for two critical flaws in PHP itself, now being called PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Node.js pushed its own security releases the same day for a remote-code-execution bug in its bundled Brotli decoder, nicknamed Node2Shell (CVE-2026-111497). If your first thought is, “PHP? Isn’t that legacy tech?”, think again. W3Techs puts PHP behind roughly 69% of websites whose server-side language can be identified. If you run WordPress, Drupal, Joomla, or an internal portal built anytime in the last twelve years, this touches your house.
Here is what makes this one particularly nasty.
It’s an engine problem, not an app bug
This isn’t a coding mistake in a third-party plugin you forgot to update. It’s a pair of memory-handling flaws inside the PHP runtime. An unauthenticated attacker doesn’t need a login or special privileges; a single crafted request can trigger the attack before your application code even runs. From there, they own the web process, your local files, and whatever database credentials live on the box.
It reaches every common way PHP is served, from Apache’s mod_php to PHP-FPM and LiteSpeed.
The bad guys had a four-day head start
The official patches landed today, October 21. But Amazon’s threat intelligence team recorded an exploitation attempt against its MadPot honeypots on October 17, from an IP address tied to a commercial anonymization network. Details then leaked on social media on October 20, a day before the coordinated release. By the time most of us read the advisory, proof-of-concept exploits were already circulating and the honeypots were lighting up again.
| Date (2026) | What happened |
|---|---|
| October 17 | Amazon records a PHP2Shell exploitation attempt in its honeypot network, four days before disclosure |
| October 20 | Vulnerability details leak on social media ahead of the planned disclosure |
| October 21 | PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35; CISA, the NSA and the FBI urge immediate patching; Node.js ships fixes for Node2Shell |
“Take it offline” isn’t a figure of speech
When CISA, the NSA and the FBI each tell organizations to patch immediately or take affected systems offline until they’re fixed, they aren’t engaging in hyperbole. CISA extended the same advice to servers running unsupported PHP. PHP 8.1 and earlier are past end-of-life. The PHP team did publish minimal source backports for 7.4, 8.0 and 8.1, but there’s no official release for those branches, and anything older than 7.4 gets no fix at all. Plenty of production servers will sit unpatched because nobody is watching them.
What to do right now
If you manage infrastructure, don’t treat this like routine maintenance.
- Check your PHP version right now. If you are on 8.2 through 8.5, update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 and restart every PHP worker.
- If you are stuck on PHP 7.x or 8.1, you have an emergency architecture decision to make: a vendor-patched package, a source backport, or an upgrade. Stopgaps exist. Setting
session.upload_progress.enabled=0closes one of the two attack paths, and a WAF rule set in front of the server helps. But PHP itself says no configuration change fully mitigates these flaws. Workarounds buy hours, not immunity. - Running Node.js? Move to 22.23.4, 24.22.1 or 26.12.1. Node 20 and earlier are end-of-life and won’t receive the fix.
- Anchor your log reviews to October 17, not the 21st. If you only search your access logs from the announcement date forward, you’re missing the window when early actors were already knocking.
Where cyber insurance fits
If a box gets popped through PHP2Shell, a cyber policy is built for what comes next: forensic investigation, breach counsel, notification costs if customer data was on that server, restoring systems, and the income you lose while the site is down. If your site is how customers reach you, that downtime is the expensive part.
The fine print matters here more than usual. Some policies scale coverage down for losses that start with a known vulnerability left unpatched past a set number of days, and some exclude end-of-life software outright. Your application may also have asked how quickly you apply critical patches. If the honest answer today is “whenever we get to it,” that’s a coverage problem, not just an IT problem.
When foundational code breaks, waiting until next week’s maintenance cycle isn’t an option.
Sources
- CISA: Critical Vulnerabilities in PHP Require Immediate Patching
- Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot
- watchTowr: PHP2Shell FAQ
- Datadog Security Labs: PHP2Shell detection, analysis and remediation
- Newsweek: FBI issues advice as security issue hits global websites
- The Hacker News: Researchers demonstrate Node2Shell RCE