Your code is clean. Attackers still got a shell.

[!danger] Critical Advisory — 23 October 2026 · CVSS 9.2 Two critical Remote Code Execution (RCE) vulnerabilities landed on the two most widely deployed web runtimes on the planet in the exact same week.

Because both bugs reside inside the runtime engines themselves, your application-level code — no matter how clean, audited, or well-architected (Laravel, Express, Next.js) — buys you zero protection. The bug triggers before application logic or middleware ever executes.

TL;DR & Executive Overview

Both vulnerabilities grant unauthenticated remote code execution. Both bypass:

• Web framework routers (Laravel, Symfony, WordPress)
• Authentication middleware & JWT guards
• Input validation & sanitize layers
• Application-level firewalls (WAF rules not inspecting chunked OOM patterns)

The Three Core CVEs

1. CVE-2026-109618 — PHP2Shell: OOM Memory Corruption

• Mechanism: Memory corruption during out-of-memory (OOM) handling in PHP-FPM.
• Exploitation: An unauthenticated attacker sends a specially crafted request (no valid credentials or existing route needed). When PHP's memory allocator encounters an induced OOM condition, the handler writes to freed memory structures, yielding arbitrary write-what-where execution.
• Impact: Immediate Remote Code Execution under the privilege of the php-fpm pool user (typically www-data or nginx).

2. CVE-2026-109619 — PHP2Shell: Stale Worker State & Memory Exfiltration

• Mechanism: Stale global state persistence across persistent PHP-FPM worker processes.
• Exploitation: Following an OOM event or partial memory corruption, subsequent requests dispatched to that same persistent worker inherit tainted state. Qualys confirmed that this discloses raw PHP worker process memory back to HTTP responses.
• Data Leaked:
  • Database passwords and connection strings (DB_PASSWORD)
  • Cloud storage keys (AWS S3, Cloudflare R2, GCP credentials)
  • Application secrets (Laravel APP_KEY, Django secret keys)
  • Active user session tokens and JWT signing keys
  • Error monitoring tokens (Sentry, Datadog tokens)

[!warning] The Graceful Reload Trap Standard zero-downtime deployment pipelines typically run systemctl reload php-fpm. A graceful reload keeps existing tainted workers alive until they hit pm.max_requests! You must issue a full hard restart (systemctl restart php8.4-fpm) to flush poisoned worker processes.

3. CVE-2026-111497 — Node2Shell: Bundled Brotli Out-of-Bounds Write

• Mechanism: Out-of-bounds write inside Node.js's native bundled C Brotli decompression library.
• Exploitation: Any Node.js process using native HTTP clients (fetch(), undici, axios, http.get) automatically negotiates Accept-Encoding: br. When an application performing Server-Side Rendering (Next.js SSR, Nuxt, SvelteKit) fetches external resources from an untrusted, compromised, or adversarial API endpoint, the origin returns a malformed compressed Brotli payload that triggers an OOB write during decompression.
• Part of 10-CVE Drop: Shipped alongside fixes for two critical TLS certificate-hostname validation bypasses.

Attack Flow Visualized

PHP2Shell Attack Chain

Node2Shell Attack Chain

Incident Timeline & In-The-Wild Exploitation

17 Oct 2026 ──🔴 First in-the-wild exploitation observed (Amazon telemetry)
               (4 full days BEFORE an official upstream patch existed)
20 Oct 2026 ──🔴 Exploit details and reproduction leak publicly prior to embargo
21 Oct 2026 ──🟢 Upstream PHP security patches released
21 Oct 2026 ──🔬 Datadog Security Labs reproduces exploit; confirms app-auth bypass
22 Oct 2026 ──🟢 Node.js releases emergency 10-CVE security update

Am I Affected? Version Exposure Matrix

PHP Runtimes

Affects virtually all PHP releases dating back to version 5.4.

Node.js Runtimes

Step-by-Step Remediation Runbook

Step 1: Check Runtime Versions Immediately

# Verify running PHP runtime
php -v | head -n 1

# Check which PHP-FPM daemon binary is active on systemd
ps aux | grep php-fpm

# Verify active Node.js version
node -v

Step 2: Patch PHP and Perform a HARD Restart

[!caution] Do NOT use reload! A graceful reload (reload) keeps poisoned worker memory resident. Always use restart.

# Debian / Ubuntu (Ondřej Surý PPA or distro mirrors)
sudo apt update
sudo apt install --only-upgrade php8.4-fpm php8.4-cli php8.4-common

# Verify patched version
php -v | grep 8.4.27

# HARD RESTART: Purge active worker processes
sudo systemctl restart php8.4-fpm

# Verify worker spawn timestamps
systemctl status php8.4-fpm

For RHEL / Rocky / AlmaLinux (Remi Repository):

sudo dnf upgrade php-fpm php-cli
sudo systemctl restart php-fpm

Step 3: Upgrade Node.js & Recompile Native Addons

# If managing via NVM:
nvm install 24.22.1
nvm use 24.22.1
nvm alias default 24.22.1

# Verify version
node -v  # Output must show v24.22.1

# Clean and rebuild dependencies (required for entropy cache fix & native binaries)
npm rebuild
npm run build

Step 4: Assume Memory Compromise — Credential Rotation Protocol

If your PHP servers were exposed to the public internet between October 17 and October 21, 2026, execute the following credential rotation checklist:

• Database Passwords: Rotate MySQL, PostgreSQL, Redis passwords defined in .env.
• Application Secret Keys: Re-generate Laravel APP_KEY or framework session signing keys. (Note: Invalidate old sessions).
• Cloud Storage Credentials: Rotate AWS Access Keys / Secret Keys, Cloudflare R2 tokens, and S3 bucket credentials.
• SaaS & API Tokens: Rotate Stripe keys, GitHub Personal Access Tokens, Sentry tokens, Datadog keys.
• Private Certificates: Re-key any TLS client certificates or private keys located on the worker disk.

Step 5: Harden Deploy Pipelines Against Supply-Chain Worms

This vulnerability arrived alongside the Shai-Hulud npm worm and package hijacking via GitHub repo name reclamation. Update deployment and CI/CD pipelines:

# ❌ VULNERABLE: Resolves dynamic versions and executes postinstall scripts
npm install --no-workspaces --no-audit

# ✅ SECURE: Strict lockfile enforcement + scripts disabled
npm ci --ignore-scripts

Ineffective Workarounds (What DOES NOT Work)

Many teams attempted quick configuration band-aids. Understanding why they fail:

[!tip] The Single Source of Truth There are no configuration flags, headers, or web application firewall rules that substitute for updating the underlying runtime binaries.

References & Telemetry Sources

1. PHP Security Advisory — PHP Group Official Release Notes
2. Datadog Security Labs — PHP2Shell Reproduction, Worker Memory Leaks, and In-the-Wild Indicators
3. Qualys Threat Report — Deep Dive into CVE-2026-109618 and CVE-2026-109619
4. watchTowr Labs — Anatomy of PHP-FPM OOM Exploitation
5. Node.js Security Team — October 2026 Security Release Bulletin for CVE-2026-111497
6. Singapore CSA Advisory — Shai-Hulud npm Lifecycle Script Worm Technical Analysis
7. CERT-EU Alert — Critical Runtime Vulnerabilities in Web Application Infrastructure

Authored by Pushpendra Dev · Infrastructure System Engineer at OverflowByte