Dev.to Security 🔐 Cybersecurity Sun, 25 Oct 2026 19:19:11 +0000 👁 0 📖 4 min read

PHP2Shell, a Node.js Brotli RCE and npm worms: what six months of security fixes teach us

On October 21, 2026, the PHP project shipped an emergency release for two critical flaws that allow unauthenticated remote code execution. The same day, Node.js patched ten vulnerabilities. I read the official advisories, the write-ups from the people who found the bugs, and the ones from vendors scrambling to mitigate them. Here is what happened, where the sources disagree, and what I would check in your stack today.

PHP2Shell: the urgent one

The flaws are CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0. They live in PHP itself, below WordPress, Laravel or any plugin. Google Cloud and Wiz both list every version from 5.4 through 8.5.11 as vulnerable.

How it works, in short

Per the UK NCSC advisory, the first bug happens when PHP runs out of memory while a request's internal data is only half-initialized, and cleanup code later treats that data as valid. In the second, internal state keeps pointing at memory that has already been freed, and the next request handled by the same worker can pick it up.

In plain terms: a request that forces PHP past memory_limit leaves garbage behind, and the next request trips over it. Calif showed that a multipart upload with deeply nested field names can exhaust memory even while staying under post_max_size.

Timeline

October 20: details leaked ahead of the planned October 22 disclosure, and watchTowr confirmed they were real.
October 21, 14:00 UTC: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 ship.

What to do

Update, then restart your workers. Replacing the package on disk is not enough if the old process is still in memory. PHP says no configuration change fully mitigates these bugs.

PHP 8.1 and older get no official release. watchTowr points to minimal source backports for 7.4, 8.0 and 8.1, plus distro and long-term-support vendor packages. One catch: distros often backport a fix without bumping the version number, so php -v alone can mislead you.

# Debian/Ubuntu: does the installed package include the fix?
apt-get changelog php-fpm | grep -E "CVE-2026-10961[89]"

# restart whatever actually serves requests (adjust the version)
sudo systemctl restart php8.3-fpm

As a partial stopgap until you can patch, PHP points to disabling session upload progress:

session.upload_progress.enabled = 0

The NCSC goes further: if you can neither update nor mitigate, consider taking the system offline and checking it for signs of compromise. Don't forget appliances and hosting panels that bundle PHP.

Node.js and Next.js

On October 21, Node.js 22.23.4, 24.22.1 and 26.12.1 landed with ten CVEs, four of them high severity. The worst is CVE-2026-111497, an out-of-bounds write in the bundled Brotli decoder. If your app decompresses attacker-controlled data with node:zlib, it can lead to a crash, a memory disclosure or RCE.

Two more high-severity bugs break TLS hostname verification for oddly written IP addresses. The advisory's own example: 0127.0.0.1 is read as octal by the verifier, while the operating system may read it as decimal. The fourth high-severity bug truncates DNS names at a NUL byte, which can defeat domain allowlists.

Node 20 got no fix; according to Vendure, it reached end of life on April 30, 2026. Earlier high-severity releases came on June 18 and July 29 (the latter delayed by infrastructure problems).

For Next.js, August 25 brought two critical RCE flaws (fixed in 15.5.24 and 16.3.3). October 14 added more: an RCE in use cache functions that return typed arrays, and another in image optimization (fixed in 16.4.1 and 15.5.28).

npm: worms and hijacked accounts

The biggest campaign was ChainDrop, a Shai-Hulud-family worm. According to Microsoft, it runs from a preinstall hook, steals credentials, and republishes packages with the stolen access. Before it came Mini Shai-Hulud (April 29), the TeamPCP campaign (May 11), and the compromise of 140+ Mastra packages on June 17, which Microsoft attributes to Sapphire Sleet, a North Korean actor.

Practical defenses, drawn from ArmorCode's guide: commit your lockfile, use npm ci, wait a few days before adopting freshly published versions, and flag new dependencies that ship install scripts.

npm ci --ignore-scripts

Composer

On April 14, two command-injection bugs in Composer's Perforce driver were fixed (CVE-2026-40261, CVSS 8.8, and CVE-2026-40176, CVSS 7.8). A third, CVE-2026-59946 from July 14, was fixed in 2.2.29 and 2.10.2. These details come from secondary sources, so confirm them against the project's own advisories.

Where the sources disagree

Who found it, and when: Calif names Calif, OpenAI and Wiz as discoverers, and each publishes its own dates (Calif reported on August 11, Wiz on August 24).
The role of AI: Wiz says frontier models were decisive. Calif says it used publicly available models with no special setup, and that knowing the target's history mattered.
Exploitation: watchTowr says it has seen real attacks since October 21. SOCRadar describes reports from some vendors, still under investigation. As of October 22, neither CVE was in CISA's KEV catalog, per watchTowr.
ChainDrop's size: Microsoft cites 400+ packages (August 4); Singapore's CSA cites 1,300+ versions (August 6). These may be different moments of the spread, but I couldn't confirm it.
Reach: "70% of websites" is Wiz's figure; I did not verify where it comes from.

Conclusion

Inventory where PHP runs, appliances included, then update and restart the workers.
On Node, move to 22.23.4, 24.22.1 or 26.12.1, and get off Node 20.
Treat npm install as running third-party code.
With fresh incidents, expect numbers and attribution to shift; re-read the primary sources.

References

📰 Read the original article on Dev.to Security

Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.

← News 🔐 Cybersecurity 🏠 Home