PHP2Shell, Node2Shell, and a record year for CVEs: what October 2026 means for your systems

On Wednesday, 21 October 2026, two of the most widely used runtimes on the web shipped security fixes on the same day. PHP patched a pair of flaws that can let an attacker run code on a server without logging in. Node.js patched a memory bug in its Brotli decoder that researchers have since shown can lead to code execution. Both picked up the same kind of nickname: PHP2Shell and Node2Shell.

A week earlier, Next.js had fixed two critical flaws of its own. Around the same time, firewall, VPN, mail gateway, and remote-support vendors were patching bugs that attackers were already using. If your October felt like one advisory after another, that is because it was.

This article covers what happened, what it says about where the industry is heading, how AI helps and where it makes things harder, and how we respond when a CVE lands in software we build or run.

This is what the advisories said as of 24 October 2026. Exploitation status and severity scores are still changing. Check the linked advisories before you act on any single detail.

The short answer

• Patch PHP first. Every PHP installation that serves web requests is affected. Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. If you can’t, CISA’s advice is to take the system offline until you can.
• Patch Node.js, then rebuild. Update to 22.23.4, 24.22.1, or 26.12.1, and rebuild any container images that bundle Node.js.
• A severity score is a starting point, not a verdict. Node2Shell scores 9.8 on one scale and “high” from the Node.js project, because whether you are exposed depends on how your application uses compression.
• Bugs are being found faster than they are being fixed. More CVEs were published in the first nine months of 2026 than in all of 2025, and AI-assisted discovery is widely cited as one of the reasons.
• AI works on both sides. It helped find both of this month’s headline bugs. It is also helping attackers turn advisories into working exploits faster.

PHP2Shell: patch this first

PHP2Shell is the name for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that the PHP project rated CVSS v4.0 9.2, critical. In the first, out-of-memory handling interrupts PHP while internal request data is only partly set up, and cleanup then treats that invalid data as valid. In the second, internal state from one request survives after its memory is freed, and a later request on the same worker uses it. Either can lead to remote code execution.

What makes it serious is reach. The advisory covers all PHP installations serving web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP team considers mod_php the highest risk, with a demonstrated exploit in which an unauthenticated request triggers the attack before any application code runs. Your own code, your CMS, and your plugins don’t get a say.

• Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, released on 21 October. PHP 8.1 and older no longer receive official updates. The PHP security team provided minimal source backports for 7.4, 8.0, and 8.1 for people who build PHP from source or have no long-term support vendor.
• Workarounds are partial. The advisory lists settings that block some attack paths and says plainly that they “do not make an installation safe.”
• The clock started before the fix. Amazon’s threat intelligence team logged an exploitation attempt in its honeypots on 17 October, four days before public disclosure, and saw public exploit code appear on release day. Amazon says it is unclear whether any of those attempts would have succeeded. When CISA urged immediate patching on 21 October, it had not yet observed exploitation.
• Popular apps are the proof, not the limit. Wiz, one of the teams that found the bugs, demonstrated unauthenticated remote code execution against the latest WordPress, Drupal, and Joomla container images. It stresses that the flaws are in PHP itself, so any application on a vulnerable version is exposed.
• Expect follow-ups. On 23 October, PHP published an informational advisory on a related session upload issue (CVE-2026-115560), which it calls an unlikely route to code execution. A full advisory will come with the next release. Until then, PHP suggests setting session.upload_progress.enabled=0.

For many Philippine businesses, the PHP question is really a hosting question. If your website runs on WordPress with a shared host or an agency, you may not control the PHP version. Updating your plugins won’t fix this one. Ask your provider, in writing, which PHP version your site runs and when it was last updated.

Node2Shell: serious, but read the conditions

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder that Node.js bundles for its node:zlib module. Malformed compressed input could make the decoder keep writing past the end of an eight-byte internal buffer. An attacker who can get an application to decompress Brotli data they control can crash the process, read its memory, or run code.

The Node.js project rates it high severity. Singapore’s Cyber Security Agency lists it at CVSS 9.8. Both can be right: a base score assumes the worst case, while your real exposure depends on what your application does with compressed data:

• Request bodies. Applications that accept and decompress request bodies sent with Content-Encoding: br. Imperva, the security firm that named its proof of concept Node2Shell, reproduced code execution through Express 5 and body-parser 2 on the official Node.js 24.22.0 image for Linux arm64. It didn’t work on every attempt, and other architectures weren’t tested.
• Responses you fetch. Code that downloads Brotli-compressed responses from servers you don’t control.
• Direct use. Anything that calls Node’s Brotli functions on untrusted data.

No exploitation in the wild had been reported as of 22 October. The fix is in Node.js 22.23.4, 24.22.1, and 26.12.1, part of a release that fixed ten CVEs in all. If any of your services are still on Node.js 20, Vercel notes that it has reached end of life and won’t receive this fix.

If you run Next.js, Vercel’s guidance is to upgrade Node.js itself, because Next.js doesn’t block Brotli responses in image optimization. Vercel is rolling out patched Node.js 22 and 24 runtimes on its own platform and has added firewall rules against incoming attacks, but those rules don’t cover responses your functions fetch from other servers. Self-hosted apps need a patched Node.js base image, a rebuild, and a redeploy.

It was already a busy month for that stack. On 14 October, Next.js shipped an out-of-band update for two critical unauthenticated remote code execution flaws: one for apps using Cache Components, in use cache functions that return typed arrays, and one in an image library used by the Image Optimization API on glibc-based Linux. The fixes are in Next.js 16.4.1 and 15.5.28. The “2Shell” names echo React2Shell, the critical React Server Components flaw of December 2025 that, according to Amazon, China-linked groups began attacking within hours of disclosure.

The rest of October: attacks at the edge

The runtimes made the headlines. The devices at the edge of company networks were where attackers were already at work. Between late September and mid-October, CISA flagged actively exploited flaws in:

• Firewalls: Palo Alto Networks PAN-OS (CVE-2026-0322), a remote code execution flaw in the management interface that needs a logged-in attacker and that Palo Alto says has seen “very limited” exploitation. It was added to CISA’s Known Exploited Vulnerabilities catalog on 14 October.
• Mail gateways: Cisco Secure Email Gateway (CVE-2026-76519), added the same day.
• VPNs: Ivanti Connect Secure (CVE-2026-104935), exploited as a zero-day to steal credentials.
• Remote support tools: BeyondTrust Remote Support (CVE-2026-102764), a critical authentication bypass.
• Application gateways: Citrix NetScaler ADC and Gateway (CVE-2026-88771 and CVE-2026-88772), which CISA says threat actors are actively exploiting around the world.

Microsoft’s October Patch Tuesday fixed more than 1,400 flaws, including a Windows zero-day already being exploited (CVE-2026-96951).

These are the systems that sit in front of everything else. They are also hard to patch in a hurry, because a reboot interrupts everyone. Attackers know both of those things.

What a record year of CVEs means for the industry

The numbers explain why October felt relentless.

• More vulnerabilities. By 30 September, the NVD had published 72,812 CVEs for 2026, already more than in all of 2025. NIST says CVE submissions grew 263% between 2020 and 2025.
• Less analysis from the national database. Since April, NIST no longer adds its own analysis to every CVE. It prioritizes vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog, software used by the US federal government, and critical software. Everything else is marked “Lowest Priority - not scheduled for immediate enrichment.” A process that waits for an NVD score can wait a long time.
• Less time. CrowdStrike reports that in the first half of 2026, 88% of the exploitation it observed of vulnerabilities with a public proof of concept happened within 48 hours of that proof of concept’s release. With PHP2Shell, Amazon logged an exploitation attempt four days before the fix was public.
• More reporting duties. Since 11 September 2026, manufacturers of digital products sold in the EU must report actively exploited vulnerabilities under the Cyber Resilience Act: an early warning within 24 hours, then a full notification within 72. Closer to home, after confirmed incidents involving the Department of Migrant Workers website and a DOLE web host, the DICT and CICC gave national agencies, GOCCs, LGUs, and Critical Information Infrastructure operators 24 hours to give their agency head or chief executive a one-page cyber readiness assessment. The measures they were told to prioritize include fixing critical vulnerabilities, requiring multi-factor authentication on critical and privileged accounts, removing unnecessary internet exposure, and reviewing third-party access.

Put together, the industry is moving from monthly patch cycles to responses measured in hours, with less pre-digested information and more reporting duties. The teams that cope are the ones that already know what they run.

How AI helps, and where it cuts the other way

AI played a part in finding both of this month’s headline bugs. Wiz says it found PHP2Shell using its own Wiz Atlas platform together with frontier models from Google and OpenAI. The Node.js advisory credits OpenAI’s Codex Security with reporting the Brotli bug. Earlier in the year, Google said its Big Sleep agent had helped find a vulnerability that attackers were about to use, so it could be cut off first.

That is the hopeful part: defenders can now search code at a scale no human team could. Here is where AI genuinely helps:

• Finding flaws before release. AI review of code and dependency changes catches whole classes of bugs while they are still cheap to fix.
• Triage at volume. With more than 70,000 CVEs this year and fewer of them analyzed by NIST, AI can read an advisory, check it against a lockfile, a container image, or a server’s configuration, and answer the real question: are we affected? For Node2Shell, that question isn’t “do we run Node.js 24?” It’s “do we decompress Brotli data from anyone we don’t trust?”
• Spotting supply-chain attacks. In August, the ChainDrop worm spread through hundreds of npm packages after a maintainer’s account was compromised, stealing cloud, GitHub, npm, and AI-tool credentials. A new package version with an install script it never had before is exactly the kind of change AI review can flag before a build runs it.
• Drafting the fix and the test. A model can draft the version bump, the configuration change, and the test that proves it, so the person reviewing spends their time on judgment rather than typing.

And here is where it cuts the other way:

• Attackers use it too. In May, Google’s threat intelligence team reported, for the first time, a criminal group with a zero-day exploit that Google believes was developed with AI. One giveaway was a hallucinated CVSS score in the exploit’s own comments. Wiz says frontier models “substantially reduced” the barrier to turning PHP2Shell into a working exploit.
• Finding is outpacing fixing. Anthropic, whose models we use alongside others, reported in May that its Mythos Preview model had turned up an estimated 6,202 high- or critical-severity vulnerabilities across more than 1,000 open-source projects. Of about 530 serious bugs disclosed to maintainers by then, 75 had been patched, and several maintainers said they were “severely capacity constrained.” These are Anthropic’s own figures. The point stands either way: every bug found is work for someone who may already be overloaded.
• AI tools are new attack surface. ChainDrop went after AI-tool credentials on purpose. The connectors that let AI agents use other tools, such as MCP servers, now receive CVEs of their own, including prompt-injection flaws that try to turn a coding assistant against the developer using it. In August, for example, CVE-2026-75130 described a flaw in the Context7 MCP server that could push a connected coding assistant to leak credentials from environment files or delete files.

This is why we don’t think the answer is “let the AI patch everything.” AI makes the first pass faster: reading, matching, drafting. A person still decides whether to take a site offline, roll out a fix at night, or call a client, and that person’s name is on the decision.

How we respond when a CVE lands

We build and run software for clients, and we build our own products, including Batayan, ariarian.ai, Habi, and 3C. When a CVE like PHP2Shell or Node2Shell is published, this is the loop we follow.

1. Know what we run before it matters. For the systems we build or operate, we keep track of runtimes, frameworks, the packages in each lockfile, container base images, and where each system is hosted. Without that, “are we affected?” becomes a guess.
2. Match each advisory against what we run. We follow vendor advisories, CISA’s Known Exploited Vulnerabilities catalog, and regional alerts. AI helps with the first pass: matching an advisory to the systems it touches and checking the conditions, such as whether a service decompresses untrusted Brotli data. A person then checks that answer against the evidence: which version was found, and where.
3. Escalate to a named owner. Each affected system gets an owner and a decision: patch now, mitigate and schedule, or take it offline. Anything exploited in the wild or reachable without logging in goes first.
4. Patch, rebuild, and confirm. A new version number in a file isn’t a fix until the running system uses it. We rebuild, run the tests, and confirm the version that is actually deployed.
5. Tell clients early and plainly. What is affected, what we have done, what is still unknown, and anything they need to do on their side, such as asking a hosting provider to update PHP.
6. Keep the record. Who decided what, when, and on what evidence. It is the same principle our products are built on, and it is what you need when a regulator, an auditor, or your own board asks what happened.

We won’t promise that nothing we build will ever have a vulnerability. Nobody honestly can. What we can promise is that we know what we run, a person owns every decision, and we will tell you what we know.

A checklist for this week

1. Find every PHP installation, including PHP bundled inside other software, and update to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. If you can’t, or you run PHP 8.1 or older, CISA advises taking those systems offline until they are patched or upgraded.
2. Ask your hosting provider which PHP and Node.js versions your sites run, and when they were last updated.
3. Update Node.js to 22.23.4, 24.22.1, or 26.12.1, rebuild your container images, and move anything still on Node.js 20 to a supported release.
4. Update Next.js to 16.4.1 or 15.5.28.
5. Patch your edge devices: firewalls, VPNs, mail gateways, and remote-support tools. Keep management interfaces off the public internet.
6. Watch for the warning signs CISA lists, such as PHP worker processes starting shells or downloading tools.
7. Stop waiting for a score. Use CISA’s Known Exploited Vulnerabilities catalog and your own inventory to decide what to fix first.

The bottom line

October’s CVEs didn’t stand out because they were severe. Severe bugs arrive every year. They stood out because they came together, in software almost everyone runs, and for several of them, attackers moved before a fix was public. That is the new normal, and AI is speeding up both sides of it.

The answer isn’t panic, and it isn’t handing the keys to a model. It’s knowing what you run, letting software do the first pass, and keeping a person accountable for the call.

If you’re not sure whether your website or systems are affected, or you want to see how we would handle a CVE in software we build for you, contact us.

Facts are summarized from the vendor, government, and researcher advisories linked above, as of 24 October 2026. Exploitation status, severity scores, and fixed versions can change, and the official advisories always take precedence over this summary. This article is general information, not security or legal advice.