Critical Security vulnerabilities - What's Next?

$ anything2shell

My goal is to make the internet more secure. Together we can!

The biggest challenge with these rapidly evolving threats is getting visibility and determining whether your organization is impacted. We help you understand whether your website is vulnerable, how to recognize if you are impacted, and how to mitigate the vulnerabilities. We do this all by combining the best advisories and offering you safe, passive checks without exposing exploit details. Our goal is to make critical security vulnerabilies understandable for a broader audience from C-Level to IT professionals.

php, node, http, react, ruby, ssh, spring, log. The software changes, the pattern stays the same: a single flaw in core web runtimes, libraries, or edge proxies can turn any internet-facing service into direct remote code execution, even when your own application code is completely secure.

Enter your domain to run a safe, non-intrusive exposure check

Instantly detect exposed runtime headers and verify your security posture in under 10 seconds.

Terms of Use & Liability Disclaimer

1. Authorization: By using this checker, you confirm that you own or have explicit authorization from the system owner to perform a passive HTTP header check on the submitted domain.

2. Passive & Non-Intrusive Scope: This tool only performs a single standard HTTPS request to inspect publicly returned HTTP response headers (Server, X-Powered-By, Set-Cookie, Content-Encoding, Via, Vary). No exploit payloads or intrusive probes are transmitted.

3. No Warranty & No Liability (“As-Is”): All information and scan results on anything2shell.com are provided strictly for informational and defensive purposes on an “as-is” basis without warranty of any kind. Absence of an exposed version banner does not guarantee that a server is patched. The author and operators of anything2shell.com assume no responsibility or liability for any damages, disruptions, false positives, false negatives, or actions taken based on this website.

PHP2Shell

CVE-2026-109618 CVE-2026-109619 CVE-2026-115560 CVSS 9.2 Critical
Boardroom Quick Reference

CIA Risk Posture & Executive Assurance

Active Mass Exploitation Scope: Public Web & Customer Data
Confidentiality
High Risk
Data Exposure & Secret Leakage

Live server memory, database passwords, API keys, and active user sessions can be extracted remotely without authentication.

Integrity
Critical Risk
System Control & Trust

Attackers can hijack the web runtime to execute arbitrary commands, alter site behavior, or plant persistent backdoors.

Availability
Elevated Risk
Service Uptime & Continuity

Automated mass scanning forces web workers out of memory, causing intermittent service degradation and web pool crashes.

Executive Decision Points Assurance vs. Activity — Key questions for your CISO / IT Lead
Are running web workers verified?

Updating packages without restarting worker pools leaves the threat live in memory, and a second related flaw requires disabling upload progress in configuration.

Have in-memory secrets been rotated?

Because attackers probed servers days before public disclosure, exposed systems must rotate database passwords and API keys. Patching alone does not revoke stolen credentials.

Technical Deep-Dive, IoCs & Remediation

PHP2Shell is a set of critical memory-safety vulnerabilities in the core PHP engine affecting roughly 70% of websites—including WordPress, Drupal, Joomla, and Magento—where a flaw in the underlying runtime exposes servers to memory disclosure and unauthenticated remote code execution even when application code is completely secure.

Disclosed on October 21 with emergency patches in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, CVE-2026-109618 and CVE-2026-109619 came under immediate mass scanning. Amazon honeypots logged pre-disclosure exploit attempts as early as October 17, and Cloudflare observed attack traffic surging from tens of thousands of requests within 45 minutes of disclosure to millions within 24 hours, including campaigns attempting to deploy Mirai botnet variants.

Two days later on October 23, PHP warned of a separate, still-unpatched RCE risk (CVE-2026-115560) that is not fixed by the October 21 emergency releases (The Hacker News ↗). It affects setups where session.upload_progress.enabled is active (on by default) and session.serialize_handler is configured as php_binary or php_serialize before being switched at runtime to php via ini_set() prior to session_start(). Until a routine fix ships in the next release cycle, PHP advises setting session.upload_progress.enabled = 0.

Why it’s a risk

Unauthenticated attackers can send crafted HTTP requests that force PHP workers out of memory during session initialization (CVE-2026-109618). This leaks live server memory—such as database passwords, API keys, and session tokens—directly into outbound Set-Cookie: PHPSESSID response headers, and allows remote code execution by corrupting shared OPcache memory (CVE-2026-109619).

How to recognize it (Versions, Logs & IoCs)

  • Vulnerable versions: PHP 8.5 < 8.5.12, 8.4 < 8.4.27, 8.3 < 8.3.36, 8.2 < 8.2.35, and all end-of-life PHP 5.4–8.1 releases.
  • In your logs: Unusually long or binary URL-encoded Set-Cookie: PHPSESSID=... headers in outbound responses, bursts of multipart/form-data or PHP_SESSION_UPLOAD_PROGRESS POST requests followed by HTTP 500 errors, and repeated php-fpm worker restarts.
  • Threat Intelligence IoCs: Traffic from Google Threat Intelligence campaign GLOBAL.26.015 and threat actor UNC5638 (see IoC blocklist below).

How to mitigate it

  • Patch & restart workers: Upgrade PHP to a fixed release below and restart php-fpm or Apache so running worker processes load the patched binary.
  • Disable session upload progress: Set session.upload_progress.enabled = 0 in php.ini and block PHP_SESSION_UPLOAD_PROGRESS at your WAF.
  • Pre-patch runtime hardening (if unable to update immediately): Follow Google Cloud & Mandiant’s PHP runtime hardening guidance ↗ for compensating controls while scheduling your upgrade.
    Show full php.ini snippet Hide php.ini snippet
    php.ini / www.conf 
    ; 1. Stop CVE-2026-109619 & CVE-2026-115560 Stale Pointer Producers
session.upload_progress.enabled = 0
fatal_error_backtraces = 0

; 2. Stop CVE-2026-109618 Multipart OOM Bailout
memory_limit = -1
post_max_size = 8M
upload_max_filesize = 4M
max_input_nesting_level = 16
max_input_vars = 250
max_file_uploads = 10
max_multipart_body_parts = 100

; 3. Runtime Hygiene & Worker Reset (www.conf)
expose_php = Off
display_errors = Off
pm.max_requests = 1
Important: Disabling session.upload_progress.enabled blocks CVE-2026-115560, but does not stop the memory leak and RCE in CVE-2026-109618/19. Patching PHP is mandatory.
PHP Branch Vulnerable Releases First Fixed Release Operational Note
PHP 8.5 < 8.5.12 8.5.12 Restart PHP-FPM / web workers after upgrading
PHP 8.4 < 8.4.27 8.4.27 Restart PHP-FPM / web workers after upgrading
PHP 8.3 < 8.3.36 8.3.36 Verify Linux distribution backports if using OS packages
PHP 8.2 < 8.2.35 8.2.35 Oldest upstream-supported branch receiving fixes
PHP 5.4 – 8.1 All EOL releases Distro backport only Place behind Cloudflare Access, Cloud IAP, or VPN

PHP2Shell Indicators of Compromise (IoC)

UNC5638 GTI GLOBAL.26.015 AWS MadPot Arctic Wolf

Verified PHP2Shell mass-scanning, exploitation, and Potassium Mirai C2 indicators — block at your firewall and hunt in your SIEM.

Indicators (IPv4 / Subnet / Domain / SHA-256) Campaign / Role Attribution & Observed Activity
116.98.243.14 (116.98.224.0/19) 176.236.127.109 176.236.127.37 (176.236.0.0/17) 49.87.220.67 (49.87.0.0/16)
OOM Recon & Probing Google Threat Intelligence GLOBAL.26.015 & UNC5638 — Early PHP2Shell mass scanning & OOM probing
103.216.220.92 31.223.184.166 37.19.200.5 134.209.159.64 103.114.163.188 95.217.98.37
Pre & Post-Disclosure Waves AWS Threat Intelligence (MadPot) — Pre-disclosure recon & post-disclosure mass exploitation waves
92.118.112.100 45.198.224.169 5.175.189.76 45.115.26.26:8000 134.199.154.64:50792 85.11.167.243 217.60.242.76
Mirai Loader, Payload & C2 Arctic Wolf Labs — Potassium Mirai staging (/nfs-setup, /mountpoint, :8000/cCmono) & C2 listener (:50792)
thunder.godofthunder.st hackattackkaboom.botlesscucks.st 206.188.197.105:9999
Botnet C2 & Exploit Staging Potassium Mirai C2 domains & staging server hosting aslr_exploit.py, php2shell_fp.py, deep_probe.py, wp_attack.py
87.121.84.174 181.215.186.252 185.196.220.132 185.161.210.29 152.233.51.69
Mass Scanner Nodes High-volume automated PHP2Shell reconnaissance & PHPSESSID heap memory-leak scanner nodes
e2529d4afa39ae4db2eb05d5176317c906289abf09660c75bdeec43e54c55aa3 0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486
SHA-256 Payloads Arctic Wolf Labs — Dropper script (nfs-setup) & Potassium Mirai ELF binary (cCmono / mountpoint)

Node2Shell

CVE-2026-111497 PYSEC-2026-4322 / 4323 CVSS 9.2 Critical
Boardroom Quick Reference

CIA Risk Posture & Executive Assurance

Inbound + Outbound Vector Scope: APIs, Cloud & Microservices
Confidentiality
High Risk
Cloud Secrets & API Payloads

Compromised Node.js, Bun, or Python services expose cloud environment variables, internal API tokens, and customer payloads.

Integrity
Critical Risk
Inbound & Outbound Takeover

A single compressed request or your backend fetching data from an untrusted third-party URL can grant full remote control.

Availability
High Risk
Instant Runtime Crashes

Malformed compressed payloads crash runtime processes immediately, taking down APIs and serverless functions in a single request.

Executive Decision Points Assurance vs. Activity — Key questions for your CISO / IT Lead
Did we audit outbound fetches, not just incoming traffic?

Even if your firewall blocks compressed uploads, backends can still be compromised when fetching external webhooks, images, or partner APIs.

Are base container images rebuilt and redeployed?

Because compression libraries are bundled inside language runtimes, teams must rebuild and redeploy container images across all cloud environments.

Technical Deep-Dive & Remediation

Crafted Brotli-compressed data triggers a critical memory corruption flaw in Google’s C Brotli decoder (1.0.3–1.2.0), enabling remote code execution in Node.js, Bun, and Python HTTP clients.

Because the vulnerability sits in the underlying compression library bundled with the runtime, it affects both incoming API requests and outbound HTTP fetches made by your server.

Why it’s a risk (Inbound & Outbound)

Inbound Server Risk: Triggered when Express 5 or body-parser automatically decompresses an incoming request with Content-Encoding: br. Outbound Client Risk: Triggered when Node.js fetch(), Next.js image optimization (/_next/image), or Python HTTP libraries (requests, urllib3, httpx) download a response from an untrusted URL that returns Content-Encoding: br.

How to recognize it (Versions & Logs)

  • Vulnerable versions: Node.js 22.x < 22.23.4, 24.x < 24.22.1, 26.x < 26.12.1; Bun <= 1.4.3; Python Brotli <= 1.2.0.
  • In your logs: Unexpected POST or PUT requests using Content-Encoding: br, or repeated Node.js / Bun worker crashes (SIGSEGV) prior to shell execution.

How to mitigate it

  • Patch runtimes & containers: Upgrade to Node.js 22.23.4, 24.22.1, or 26.12.1, Bun 1.4.4, and Python Brotli 1.2.1.
  • Block Brotli request bodies at the edge: Configure your WAF or API gateway to reject incoming Content-Encoding: br requests while keeping gzip and deflate enabled. In Next.js, set images.unoptimized: true until Node.js is patched.
Software / Runtime Vulnerable Versions First Fixed Release
Node.js 22.x < 22.23.4 · 24.x < 24.22.1 · 26.x < 26.12.1 22.23.4 · 24.22.1 · 26.12.1
Bun <= 1.4.3 1.4.4 (bundles Brotli 1.2.1)
Python Brotli / brotlicffi <= 1.2.0 / <= 1.2.0.x 1.2.1 · 1.2.1.0
Google Brotli (Upstream C) 1.0.3 – 1.2.0 1.2.1 · 1.1.1 · 1.0.10

HTTP2Shell

CVE-2026-111497 (Envoy/Istio) CVE-2026-15176 / 93479 / 97205 CVE-2026-95101 / 97629 CVSS 9.2 Critical
Boardroom Quick Reference

CIA Risk Posture & Executive Assurance

Perimeter & Zero-Trust Risk Scope: Ingress Gateways & Service Mesh
Confidentiality
High Risk
Zero-Trust & mTLS Bypass

Attackers can forge session tickets to bypass mutual TLS (mTLS), gaining unauthorized access to internal-only APIs and partner endpoints.

Integrity
Critical Risk
Front-Door Gateway Compromise

Compromising the reverse proxy or Kubernetes ingress gateway exposes every internal application behind it, even if those apps are fully patched.

Availability
Critical Risk
Downstream Routing Outage

Edge proxy worker crashes sever traffic routing for all downstream websites, APIs, and microservices simultaneously.

Executive Decision Points Assurance vs. Activity — Key questions for your CISO / IT Lead
Is our Zero-Trust perimeter actually enforcing identity?

If mutual TLS (mTLS) protects B2B or internal routes, TLS session tickets must be disabled or proxies upgraded to prevent silent authentication bypass.

Were both external proxies and internal service meshes updated?

Patching the external load balancer is not enough if internal Kubernetes ingress controllers (NGINX, Envoy, Istio) remain on vulnerable releases.

Technical Deep-Dive & Remediation

Reverse proxies and Kubernetes ingress gateways face two converging HTTP-layer threats: Brotli decompression RCE in Envoy Proxy and Istio, and five critical NGINX worker memory, HTTP/3, and mTLS bypass flaws.

Because edge proxies inspect traffic first, a compromise or authentication bypass at the proxy layer exposes every internal service behind it.

Why it’s a risk

Envoy & Istio RCE (CVE-2026-111497): Gateways with Brotli decompression enabled can suffer memory corruption and remote code execution. NGINX Worker Overflows & mTLS Bypass: Three buffer overflow flaws (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205, rated 9.2 CVSS) allow worker memory corruption, while CVE-2026-97629 allows attackers to forge TLS resumption tickets and bypass client certificate (mTLS) authentication.

How to recognize it (Versions & Logs)

  • Vulnerable versions: NGINX < 1.31.7 / < 1.30.6; Envoy <= 1.39.2 / 1.38.5 / 1.37.7; Istio <= 1.31.1 / 1.30.5.
  • In your logs: NGINX worker process ... exited on signal 11 crash entries in error.log, or unexpected TLS session resumptions on mTLS-protected routes.

How to mitigate it

  • Upgrade ingress & proxy binaries: Update NGINX to 1.31.7 or 1.30.6, Envoy to 1.40.0 / 1.39.3, and Istio to 1.31.2 / 1.30.6.
  • Hardening settings: Disable the Brotli decompressor filter in Envoy/Istio, set proxy_request_buffering off; for NGINX HTTP/3, and set ssl_session_tickets off; on mTLS endpoints.
Edge Proxy / Mesh Vulnerable Releases First Fixed Release
NGINX 0.1.29 – 1.31.6 · 1.30.0 – 1.30.5 1.31.7 · 1.30.6
Envoy Proxy <= 1.39.2 · <= 1.38.5 · <= 1.37.7 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8
Istio <= 1.31.1 · <= 1.30.5 1.31.2 · 1.30.6

Beyond PHP, Node & HTTP: What other threats to watch out?

From the original React2Shell disclosure to this month’s emergency patches in Next.js, Ruby/GitLab, and Python Pillow, these critical vulnerabilities are actively tracked alongside the *2Shell wave.

CVE-2025-55182 CVE-2026-96889 CVSS 10.0 & 9.5

React2Shell & Next.js Emergency RCE Patches

React2Shell (CVE-2025-55182) exposed ~968K servers to unauthenticated RCE via React Server Components (RSC) serialization. On October 14, 2026, Next.js shipped emergency releases 16.4.1 and 15.5.28 (with React 19.3.1) for two new 9.5 CVSS RCE flaws in RSC caching and SVG image rendering (CVE-2026-96889).

How to mitigate

Upgrade Next.js to 16.4.1 or 15.5.28 (with React 19.3.1)
and ensure the version of sharp 0.35.5 or newer.

CVE-2026-110264 / 110265 GitLab CVE-2026-6654 CVSS 9.9 Critical

Ruby Regex RCEs Behind 4x GitLab Flaws (Oct 23)

Ruby released 4.0.9, 3.4.12, and 3.3.13 on October 23 to fix memory corruption flaws in its Onigmo regex engine that caused four critical GitLab RCEs (CVE-2026-6654, CVE-2026-5986, CVE-2026-9651, CVE-2026-10124).

How to mitigate

Patch GitLab and upgrade Ruby runtimes to 4.0.9, 3.4.12, or 3.3.13 immediately.

CVE-2026-112900 436M Monthly Downloads

Python Pillow Image Library RCE

Python’s Pillow imaging library (< 13.0.0) allows OS command injection when processing EPS images with untrusted filenames.

How to mitigate

Upgrade to Pillow 13.0.0 and rename uploaded files to random UUIDs before processing.

CVE-2026-5027 CVE-2026-42271 Active Exploitation

AI Gateways: Langflow & LiteLLM RCEs

Attackers are actively exploiting Langflow (CVE-2026-5027) and LiteLLM (CVE-2026-42271) to steal LLM API keys and cloud credentials.

How to mitigate

Keep AI orchestration gateways off the public internet and behind identity-aware proxies.