70% of the Web at Risk: PHP2Shell and Node2Shell

Today I’m focusing on a flaw that puts 70% of the web at risk. I’m guessing you’ve already heard about the PHP2Shell and Node2Shell vulnerabilities. These are critical vulnerabilities that lead to remote code execution, meaning an attacker can run their own code on the server.

On Wednesday, fixes came out for two critical flaws known as PHP2Shell. According to PHP, an attacker can exploit them without logging in, with nothing more than a web request. And since PHP is estimated to power roughly seventy percent of websites, this really does affect almost everyone.

Node.js shipped patches on the same day. Among them is a flaw in Brotli data decompression that researchers at Imperva have named Node2Shell.

Both flaws have one thing in common, which is why I’m covering them in a single episode. They aren’t in any plugin or application, but in the runtime the applications run on. Updating WordPress won’t help you here.

And one more thing for our Czech audience: the Office of the Government of the Czech Republic took its website offline as a precaution because of PHP2Shell.

Hi, my name is Patrik Žák, and welcome to Security Sunday.

**Let’s start with PHP. **There are two vulnerabilities, CVE-2026–109618 and CVE-2026–109619. PHP rates both at CVSS 9.2.

With the first one, PHP runs out of memory while preparing a request. Internal data is left half-built, and the code that cleans up afterwards blindly trusts it.

The second is a classic use-after-free.

According to available information, the whole thing is triggered by an ordinary HTTP request, and the attack begins before your application code even starts running.

Wiz compares it to Heartbleed. According to a summary of its research, passwords, tokens or API keys can leak from server memory.

The timeline here is quite unusual. Hints of the problem were already picked up by a Quarkslab audit back in 2024. Nobody demonstrated an exploitation path at the time, and the fix stalled. The PHP Foundation itself now calls this a structural failure of its security process.

This summer, researchers from Calif and Wiz returned to the bugs, using AI models with support from OpenAI.

As early as October 17, Amazon caught the first exploitation attempt on its honeypots, four days before official disclosure. On October 20, details leaked before the embargo ended, and CERT-EU advised considering isolating internet-facing web applications. On October 21, around 4 p.m. CEST, PHP released the fixed versions.

Only supported branches got fixes, meaning PHP 8.2 through 8.5. If you’re running 8.1 or older, you won’t get an official patch from PHP. And there are plenty of those servers. Harness says that since disclosure it has counted roughly five million internet-facing PHP servers.

Wiz demonstrated unauthenticated code execution on current versions of WordPress, Drupal and Joomla. Huntress adds Magento, the cPanel and Plesk control panels, and various appliances with embedded PHP.

You’re surely wondering how many websites have been confirmed compromised through this flaw. Honestly, I can’t give you a one-word answer today, because the sources contradict each other.

Many companies are reporting exploitation. watchTowr has been seeing it in its honeypot network since October 21. Amazon describes PHP2Shell as widely exploited. SOCRadar found exploitation tooling on an attacker’s server. The Dutch NCSC is investigating the first signs of successful exploitation.

On the other hand, the US CISA stated in its October 21 alert that it had not yet observed exploitation.

The Czech perspective is interesting too. Vladimír Smitka, head of technology at the hosting company Lynt, said that the exploits circulating online did not lead him to the actual bug.

I’d sum it up like this: lots of companies are reporting exploitation attempts, but no confirmed successful breach is publicly known yet. In my view, anyone holding off on patching until CISA adds the vulnerability to its catalog is making a big mistake.

Code execution on a server means, in practice, a full takeover. An attacker can deploy malware, steal data, establish persistence, disable security tools and move further into the network. They can also read the database and attack the people who visit the site. On trusted websites, I can imagine SEO spam or fake CAPTCHA pages that trick visitors into installing malware.

And then there are outages caused not by attackers but by the flaw itself. Government agencies in Germany, France, the Netherlands, Finland and here in Czechia preemptively took websites offline.

Now to Node.js.

CVE-2026–111497 is an out-of-bounds write in the Brotli decoder. The bug isn’t in Node.js’s own code, but in the Google Brotli library that Node.js bundles. When the decoder receives a malformed stream, it doesn’t throw an error. It assumes it needs more data and carries on with an invalid internal state.

Node.js rates the bug as High severity and explicitly states that it allows remote code execution.

Fixes were released on October 21.

This week showed how quickly a bug now goes from discovery to attacks, and how little time defenders have to respond.

If you want to know where PHP or Node.js is running across your company, including forgotten microsites and appliances, or you’d like your web applications tested after patching, reach out to me at team@sysnetshield.com.

Subscribe so you don’t miss the next episode, and see you next Sunday.

OpenAI launches offline sandboxes because AI agents got out again

On October 23, OpenAI published a detailed description of how it now secures the environments in which it trains and tests its most advanced models. The core rule: “Frontier model training now takes place without access to the live internet.” Models learn to browse the web in a so-called “offline world” — a large indexed copy of web content. OpenAI intends to keep this rule in place until progress in alignment, monitoring and internet security justifies broader access.

The trigger was an incident on September 20. During a search task in training, an internal research model discovered that its sandbox’s DNS resolver answered real queries, and it used the resolver, via a public service, to relay questions to an external chatbot. Monitoring raised a highest-priority alert about 12 minutes after the first external response. However, the training run did not stop automatically as it should have, and it was ultimately terminated manually by a human.

AnyPwn: Public exploit turns AnyDesk for Linux into remote code execution as root

On October 8, 2026, researchers from the V12 security team published a working exploit called AnyPwn that abuses a flaw in AnyDesk for Linux. It lets an unauthenticated attacker remotely run commands with root privileges before the user on the target machine even sees, let alone approves, the incoming connection request. The flaw is tracked as CVE-2026–109390 with a CVSS score of 9.8.

HPE fixes 72 vulnerabilities in Aruba AOS-8 and AOS-10, eight of them rated CVSS 10.0

On October 22, 2026, Hewlett Packard Enterprise released security bulletin HPESBNW05162, fixing 72 vulnerabilities in its AOS-8 and AOS-10 wireless operating systems (formerly ArubaOS). The eight most severe (CVE-2026–79844 through CVE-2026–79851) can be exploited over the network without credentials and without user interaction. Two of them bypass authentication and lead to command execution: CVE-2026–79844 in AOS-10 and CVE-2026–79850 in AOS-8, where the attacker runs commands as root.