Critical Security vulnerabilities - What's Next?

$ anything2shell

php, node, http, react, ruby, spring, ssh. The software changes, the name stays the same vulnerability in core web runtimes, compression libraries, and edge proxies can turn any internet-facing service into direct remote code execution, even when your own application code is completely secure.

This site breaks down what each *2Shell vulnerability is, why it puts your organization at risk, how to recognize vulnerable versions and indicators of compromise (IoCs) in your logs, and how to mitigate it. Everything here including the URL checker below is based strictly on public advisories and passive checks to help you defend your infrastructure without exposing exploit details.

Check if your URL is vulnerable

Enter your domain to run a safe, non-intrusive exposure check
Terms of Use & Liability Disclaimer

1. Authorization: By using this checker, you confirm that you own or have explicit authorization from the system owner to perform a passive HTTP header check on the submitted domain.

2. Passive & Non-Intrusive Scope: This tool only performs a single standard HTTPS request to inspect publicly returned HTTP response headers (Server, X-Powered-By, Set-Cookie, Content-Encoding, Via, Vary). No exploit payloads or intrusive probes are transmitted.

3. No Warranty & No Liability (“As-Is”): All information and scan results on anything2shell.com are provided strictly for informational and defensive purposes on an “as-is” basis without warranty of any kind. Absence of an exposed version banner does not guarantee that a server is patched. The author and operators of anything2shell.com assume no responsibility or liability for any damages, disruptions, false positives, false negatives, or actions taken based on this website.

PHP2Shell

CVE-2026-109618 CVE-2026-109619 CVE-2026-115560 CVSS 9.2 Critical

PHP2Shell is a set of critical memory-safety vulnerabilities in the core PHP engine affecting roughly 70% of websites—including WordPress, Drupal, Joomla, and Magento.

Because the flaw sits in the PHP runtime itself, websites are at risk even when their own application code is completely secure. An additional flaw disclosed on October 23 (CVE-2026-115560) also allows remote code execution when session upload progress is enabled.

Pre-Patch Runtime Hardening (Google Cloud & Mandiant)

If you cannot upgrade PHP immediately, apply these compensating php.ini and php-fpm directives to neutralize stale pointer producers (CVE-2026-109619) and multipart OOM bailout amplification (CVE-2026-109618):

php.ini & php-fpm (www.conf) 
; 1. Neutralize CVE-2026-109619 Stale Pointer Producers
session.upload_progress.enabled = 0
fatal_error_backtraces = 0

; 2. Neutralize CVE-2026-109618 OOM Bailout & Multipart Amplification
; Pair with systemd/container MemoryMax= (avoid OS ulimit -v)
memory_limit = -1
post_max_size = 8M
upload_max_filesize = 4M
max_input_nesting_level = 16
max_input_vars = 250
max_file_uploads = 10
max_multipart_body_parts = 100

; 3. Runtime Hygiene & Worker Reset
expose_php = Off
display_errors = Off
display_startup_errors = Off
log_errors = On
; In php-fpm www.conf: set pm.max_requests = 1 (resets worker state)

Source: Google Cloud & Mandiant PHP Runtime Hardening Advisory ↗

Why it’s a risk

Unauthenticated attackers can send crafted HTTP requests that force PHP workers out of memory during session initialization (CVE-2026-109618). This leaks live server memory—such as database passwords, API keys, and session tokens—directly into outbound Set-Cookie: PHPSESSID response headers, and allows remote code execution by corrupting shared OPcache memory (CVE-2026-109619).

How to recognize it (Versions, Logs & IoCs)

  • Vulnerable versions: PHP 8.5 < 8.5.12, 8.4 < 8.4.27, 8.3 < 8.3.36, 8.2 < 8.2.35, and all end-of-life PHP 5.4–8.1 releases.
  • In your logs: Unusually long or binary URL-encoded Set-Cookie: PHPSESSID=... headers in outbound responses, bursts of multipart/form-data or PHP_SESSION_UPLOAD_PROGRESS POST requests followed by HTTP 500 errors, and repeated php-fpm worker restarts.
  • Threat Intelligence IoCs: Traffic from Google Threat Intelligence campaign GLOBAL.26.015 and threat actor UNC5638 (see full IoC table below).

How to mitigate it

  • Patch & restart workers: Upgrade PHP to a fixed release below and restart php-fpm or Apache so running worker processes load the patched binary.
  • Disable session upload progress: Set session.upload_progress.enabled = 0 in php.ini and block PHP_SESSION_UPLOAD_PROGRESS at your WAF.
  • Pre-patch runtime hardening (if unable to update immediately): Follow Google Cloud & Mandiant’s PHP runtime hardening guidance ↗ for compensating controls while scheduling your upgrade.
Important: Disabling session.upload_progress.enabled blocks CVE-2026-115560, but does not stop the memory leak and RCE in CVE-2026-109618/19. Patching PHP is mandatory.
PHP Branch Vulnerable Releases First Fixed Release Operational Note
PHP 8.5 < 8.5.12 8.5.12 Restart PHP-FPM / web workers after upgrading
PHP 8.4 < 8.4.27 8.4.27 Restart PHP-FPM / web workers after upgrading
PHP 8.3 < 8.3.36 8.3.36 Verify Linux distribution backports if using OS packages
PHP 8.2 < 8.2.35 8.2.35 Oldest upstream-supported branch receiving fixes
PHP 5.4 – 8.1 All EOL releases Distro backport only Place behind Cloudflare Access, Cloud IAP, or VPN

Indicators of Compromise (IoC)

Verified Indicators of Compromise for PHP2Shell mass scanning and exploitation.

Use these indicators from threat actor UNC5638 and other threat intelligence sources to block active scanners at your firewall and hunt for probing activity in your SIEM.

Indicator (IPv4 / Domain / Hash) Subnet / Role Attribution & Observed Activity
116.98.243.14 116.98.224.0/19 GTI GLOBAL.26.015 — Early PHP2Shell mass scanning & OOM probing
176.236.127.109 176.236.0.0/17 GTI GLOBAL.26.015 — Opportunistic PHP2Shell recon & payload testing
176.236.127.37 176.236.0.0/17 GTI GLOBAL.26.015 — Sibling scanner node in same /17 block
49.87.220.67 49.87.0.0/16 GTI GLOBAL.26.015 & Threat Actor UNC5638 probing PHP endpoints
103.216.220.92
31.223.184.166
37.19.200.5 		Pre-Disclosure Recon AWS Threat Intelligence (MadPot) — Pre-disclosure PHP2Shell reconnaissance & exploitation prior to public advisory
134.209.159.64
103.114.163.188
95.217.98.37 		Post-Disclosure Wave AWS Threat Intelligence (MadPot) — Post-disclosure mass exploitation & automated payload delivery
92.118.112.100 Mirai Loader & Staging Arctic Wolf Labs — Potassium Mirai loader hosting http://92.118.112.100/nfs-setup & http://92.118.112.100/mountpoint
45.198.224.169
5.175.189.76 		Exploitation & C2 Arctic Wolf Labs — Active PHP2Shell exploitation & Potassium Mirai botnet infrastructure
45.115.26.26 Payload Server (:8000) Arctic Wolf Labs — Serves second-stage Mirai ELF payload http://45.115.26.26:8000/cCmono
thunder.godofthunder.st
hackattackkaboom.botlesscucks.st 		Botnet C2 Domains Arctic Wolf Labs — Potassium Mirai command-and-control domains targeting PHP2Shell
e2529d4afa39ae4db2eb05d5176317c906289abf09660c75bdeec43e54c55aa3
0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486 		SHA-256 Payloads Arctic Wolf Labs — Dropper script (nfs-setup) & Potassium Mirai ELF binary (cCmono / mountpoint)
206.188.197.105:9999 Exploit Staging Exposed server hosting aslr_exploit.py, php2shell_fp.py, deep_probe.py, wp_attack.py
134.199.154.64:50792
85.11.167.243
217.60.242.76 		Mirai C2 & Relay Potassium Mirai botnet C2 listener (:50792) & exploit propagation nodes
87.121.84.174
181.215.186.252
185.196.220.132
185.161.210.29
152.233.51.69 		Mass Scanner Nodes High-volume automated PHP2Shell reconnaissance & PHPSESSID memory-leak scanner nodes

Node2Shell

CVE-2026-111497 PYSEC-2026-4322 / 4323 CVSS 9.2 Critical

Crafted Brotli-compressed data triggers a critical memory corruption flaw in Google’s C Brotli decoder (1.0.3–1.2.0), enabling remote code execution in Node.js, Bun, and Python HTTP clients.

Because the vulnerability sits in the underlying compression library bundled with the runtime, it affects both incoming API requests and outbound HTTP fetches made by your server.

Why it’s a risk (Inbound & Outbound)

Inbound Server Risk: Triggered when Express 5 or body-parser automatically decompresses an incoming request with Content-Encoding: br. Outbound Client Risk: Triggered when Node.js fetch(), Next.js image optimization (/_next/image), or Python HTTP libraries (requests, urllib3, httpx) download a response from an untrusted URL that returns Content-Encoding: br.

How to recognize it (Versions & Logs)

  • Vulnerable versions: Node.js 22.x < 22.23.4, 24.x < 24.22.1, 26.x < 26.12.1; Bun <= 1.4.3; Python Brotli <= 1.2.0.
  • In your logs: Unexpected POST or PUT requests using Content-Encoding: br, or repeated Node.js / Bun worker crashes (SIGSEGV) prior to shell execution.

How to mitigate it

  • Patch runtimes & containers: Upgrade to Node.js 22.23.4, 24.22.1, or 26.12.1, Bun 1.4.4, and Python Brotli 1.2.1.
  • Block Brotli request bodies at the edge: Configure your WAF or API gateway to reject incoming Content-Encoding: br requests while keeping gzip and deflate enabled. In Next.js, set images.unoptimized: true until Node.js is patched.
Software / Runtime Vulnerable Versions First Fixed Release
Node.js 22.x < 22.23.4 · 24.x < 24.22.1 · 26.x < 26.12.1 22.23.4 · 24.22.1 · 26.12.1
Bun <= 1.4.3 1.4.4 (bundles Brotli 1.2.1)
Python Brotli / brotlicffi <= 1.2.0 / <= 1.2.0.x 1.2.1 · 1.2.1.0
Google Brotli (Upstream C) 1.0.3 – 1.2.0 1.2.1 · 1.1.1 · 1.0.10

HTTP2Shell

CVE-2026-111497 (Envoy/Istio) CVE-2026-15176 / 93479 / 97205 CVE-2026-95101 / 97629 CVSS 9.2 Critical

Reverse proxies and Kubernetes ingress gateways face two converging HTTP-layer threats: Brotli decompression RCE in Envoy Proxy and Istio, and five critical NGINX worker memory, HTTP/3, and mTLS bypass flaws.

Because edge proxies inspect traffic first, a compromise or authentication bypass at the proxy layer exposes every internal service behind it.

Why it’s a risk

Envoy & Istio RCE (CVE-2026-111497): Gateways with Brotli decompression enabled can suffer memory corruption and remote code execution. NGINX Worker Overflows & mTLS Bypass: Three buffer overflow flaws (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205, rated 9.2 CVSS) allow worker memory corruption, while CVE-2026-97629 allows attackers to forge TLS resumption tickets and bypass client certificate (mTLS) authentication.

How to recognize it (Versions & Logs)

  • Vulnerable versions: NGINX < 1.31.7 / < 1.30.6; Envoy <= 1.39.2 / 1.38.5 / 1.37.7; Istio <= 1.31.1 / 1.30.5.
  • In your logs: NGINX worker process ... exited on signal 11 crash entries in error.log, or unexpected TLS session resumptions on mTLS-protected routes.

How to mitigate it

  • Upgrade ingress & proxy binaries: Update NGINX to 1.31.7 or 1.30.6, Envoy to 1.40.0 / 1.39.3, and Istio to 1.31.2 / 1.30.6.
  • Hardening settings: Disable the Brotli decompressor filter in Envoy/Istio, set proxy_request_buffering off; for NGINX HTTP/3, and set ssl_session_tickets off; on mTLS endpoints.
Edge Proxy / Mesh Vulnerable Releases First Fixed Release
NGINX 0.1.29 – 1.31.6 · 1.30.0 – 1.30.5 1.31.7 · 1.30.6
Envoy Proxy <= 1.39.2 · <= 1.38.5 · <= 1.37.7 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8
Istio <= 1.31.1 · <= 1.30.5 1.31.2 · 1.30.6

Beyond PHP, Node & HTTP: What else is in the news?

From the original React2Shell disclosure to this month’s emergency patches in Next.js, Ruby/GitLab, and Python Pillow, these critical vulnerabilities are actively tracked alongside the *2Shell wave.

CVE-2025-55182 CVE-2026-96889 CVSS 10.0 & 9.5

React2Shell & Next.js Emergency RCE Patches

React2Shell (CVE-2025-55182) exposed ~968K servers to unauthenticated RCE via React Server Components (RSC) serialization. On October 14, 2026, Next.js shipped emergency releases 16.4.1 and 15.5.28 (with React 19.3.1) for two new 9.5 CVSS RCE flaws in RSC caching and SVG image rendering (CVE-2026-96889). Upgrade Next.js and ensure sharp >= 0.35.5.

CVE-2026-110264 / 110265 GitLab CVE-2026-6654 CVSS 9.9 Critical

Ruby Regex RCEs Behind 4x GitLab Flaws (Oct 23)

Ruby released 4.0.9, 3.4.12, and 3.3.13 on October 23 to fix memory corruption flaws in its Onigmo regex engine that caused four critical GitLab RCEs (CVE-2026-6654, CVE-2026-5986, CVE-2026-9651, CVE-2026-10124). Patch GitLab and Ruby runtimes immediately.

CVE-2026-112900 436M Monthly Downloads

Python Pillow Image Library RCE

Python’s Pillow imaging library (< 13.0.0) allows OS command injection when processing EPS images with untrusted filenames. Upgrade to Pillow 13.0.0 and rename uploaded files to random UUIDs before processing.

CVE-2026-5027 CVE-2026-42271 Active Exploitation

AI Gateways: Langflow & LiteLLM RCEs

Attackers are actively exploiting Langflow (CVE-2026-5027) and LiteLLM (CVE-2026-42271) to steal LLM API keys and cloud credentials. Keep AI orchestration gateways off the public internet and behind identity-aware proxies.