Critical Security vulnerabilities - What's Next?

$ anything2shell

php, node, http, react, ruby, spring, ssh, log. The software changes, the pattern stays the same, a single flaw in core web runtimes, compression libraries, or edge proxies can turn any internet-facing service into direct remote code execution, even when your own application code is completely secure.

The biggest challenge is getting visibility and determining if your website is impacted. We help you understand whether your website is vulnerable, how to recognize indicators of compromise (IoCs) in your logs, and how to mitigate the issue, we do this all by using public advisories and safe, passive checks without exposing exploit details.

My goal is to make the internet more secure. Together we can!

Check if your URL is vulnerable

Enter your domain to run a safe, non-intrusive exposure check
Terms of Use & Liability Disclaimer

1. Authorization: By using this checker, you confirm that you own or have explicit authorization from the system owner to perform a passive HTTP header check on the submitted domain.

2. Passive & Non-Intrusive Scope: This tool only performs a single standard HTTPS request to inspect publicly returned HTTP response headers (Server, X-Powered-By, Set-Cookie, Content-Encoding, Via, Vary). No exploit payloads or intrusive probes are transmitted.

3. No Warranty & No Liability (“As-Is”): All information and scan results on anything2shell.com are provided strictly for informational and defensive purposes on an “as-is” basis without warranty of any kind. Absence of an exposed version banner does not guarantee that a server is patched. The author and operators of anything2shell.com assume no responsibility or liability for any damages, disruptions, false positives, false negatives, or actions taken based on this website.

PHP2Shell

CVE-2026-109618 CVE-2026-109619 CVE-2026-115560 CVSS 9.2 Critical

PHP2Shell is a set of critical memory-safety vulnerabilities in the core PHP engine affecting roughly 70% of websites—including WordPress, Drupal, Joomla, and Magento.

Because the flaw sits in the PHP runtime itself, websites are at risk even when their own application code is completely secure. An additional flaw disclosed on October 23 (CVE-2026-115560) also allows remote code execution when session upload progress is enabled.

Pre-Patch Runtime Hardening

Google Cloud & Mandiant

Cannot upgrade PHP immediately? Apply these compensating php.ini and php-fpm directives to neutralize stale pointer producers (CVE-2026-109619) and multipart OOM bailout amplification (CVE-2026-109618): 

; 1. Stop CVE-2026-109619 Stale Pointer Producers
session.upload_progress.enabled = 0
fatal_error_backtraces = 0

; 2. Stop CVE-2026-109618 Multipart OOM Bailout
memory_limit = -1
post_max_size = 8M
upload_max_filesize = 4M
max_input_nesting_level = 16
max_input_vars = 250
max_file_uploads = 10
max_multipart_body_parts = 100

; 3. Runtime Hygiene & Worker Reset (www.conf)
expose_php = Off
display_errors = Off
pm.max_requests = 1
Pair with systemd MemoryMax= (avoid ulimit -v) Mandiant Advisory ↗

Why it’s a risk

Unauthenticated attackers can send crafted HTTP requests that force PHP workers out of memory during session initialization (CVE-2026-109618). This leaks live server memory—such as database passwords, API keys, and session tokens—directly into outbound Set-Cookie: PHPSESSID response headers, and allows remote code execution by corrupting shared OPcache memory (CVE-2026-109619).

How to recognize it (Versions, Logs & IoCs)

  • Vulnerable versions: PHP 8.5 < 8.5.12, 8.4 < 8.4.27, 8.3 < 8.3.36, 8.2 < 8.2.35, and all end-of-life PHP 5.4–8.1 releases.
  • In your logs: Unusually long or binary URL-encoded Set-Cookie: PHPSESSID=... headers in outbound responses, bursts of multipart/form-data or PHP_SESSION_UPLOAD_PROGRESS POST requests followed by HTTP 500 errors, and repeated php-fpm worker restarts.
  • Threat Intelligence IoCs: Traffic from Google Threat Intelligence campaign GLOBAL.26.015 and threat actor UNC5638 (see IoC blocklist below).

How to mitigate it

  • Patch & restart workers: Upgrade PHP to a fixed release below and restart php-fpm or Apache so running worker processes load the patched binary.
  • Disable session upload progress: Set session.upload_progress.enabled = 0 in php.ini and block PHP_SESSION_UPLOAD_PROGRESS at your WAF.
  • Pre-patch runtime hardening (if unable to update immediately): Follow Google Cloud & Mandiant’s PHP runtime hardening guidance ↗ for compensating controls while scheduling your upgrade.
Important: Disabling session.upload_progress.enabled blocks CVE-2026-115560, but does not stop the memory leak and RCE in CVE-2026-109618/19. Patching PHP is mandatory.
PHP Branch Vulnerable Releases First Fixed Release Operational Note
PHP 8.5 < 8.5.12 8.5.12 Restart PHP-FPM / web workers after upgrading
PHP 8.4 < 8.4.27 8.4.27 Restart PHP-FPM / web workers after upgrading
PHP 8.3 < 8.3.36 8.3.36 Verify Linux distribution backports if using OS packages
PHP 8.2 < 8.2.35 8.2.35 Oldest upstream-supported branch receiving fixes
PHP 5.4 – 8.1 All EOL releases Distro backport only Place behind Cloudflare Access, Cloud IAP, or VPN

PHP2Shell Indicators of Compromise (IoC)

UNC5638 GTI GLOBAL.26.015 AWS MadPot Arctic Wolf

Verified PHP2Shell mass-scanning, exploitation, and Potassium Mirai C2 indicators — block at your firewall and hunt in your SIEM.

Indicators (IPv4 / Subnet / Domain / SHA-256) Campaign / Role Attribution & Observed Activity
116.98.243.14 (116.98.224.0/19) 176.236.127.109 176.236.127.37 (176.236.0.0/17) 49.87.220.67 (49.87.0.0/16)
OOM Recon & Probing Google Threat Intelligence GLOBAL.26.015 & UNC5638 — Early PHP2Shell mass scanning & OOM probing
103.216.220.92 31.223.184.166 37.19.200.5 134.209.159.64 103.114.163.188 95.217.98.37
Pre & Post-Disclosure Waves AWS Threat Intelligence (MadPot) — Pre-disclosure recon & post-disclosure mass exploitation waves
92.118.112.100 45.198.224.169 5.175.189.76 45.115.26.26:8000 134.199.154.64:50792 85.11.167.243 217.60.242.76
Mirai Loader, Payload & C2 Arctic Wolf Labs — Potassium Mirai staging (/nfs-setup, /mountpoint, :8000/cCmono) & C2 listener (:50792)
thunder.godofthunder.st hackattackkaboom.botlesscucks.st 206.188.197.105:9999
Botnet C2 & Exploit Staging Potassium Mirai C2 domains & staging server hosting aslr_exploit.py, php2shell_fp.py, deep_probe.py, wp_attack.py
87.121.84.174 181.215.186.252 185.196.220.132 185.161.210.29 152.233.51.69
Mass Scanner Nodes High-volume automated PHP2Shell reconnaissance & PHPSESSID heap memory-leak scanner nodes
e2529d4afa39ae4db2eb05d5176317c906289abf09660c75bdeec43e54c55aa3 0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486
SHA-256 Payloads Arctic Wolf Labs — Dropper script (nfs-setup) & Potassium Mirai ELF binary (cCmono / mountpoint)

Node2Shell

CVE-2026-111497 PYSEC-2026-4322 / 4323 CVSS 9.2 Critical

Crafted Brotli-compressed data triggers a critical memory corruption flaw in Google’s C Brotli decoder (1.0.3–1.2.0), enabling remote code execution in Node.js, Bun, and Python HTTP clients.

Because the vulnerability sits in the underlying compression library bundled with the runtime, it affects both incoming API requests and outbound HTTP fetches made by your server.

Why it’s a risk (Inbound & Outbound)

Inbound Server Risk: Triggered when Express 5 or body-parser automatically decompresses an incoming request with Content-Encoding: br. Outbound Client Risk: Triggered when Node.js fetch(), Next.js image optimization (/_next/image), or Python HTTP libraries (requests, urllib3, httpx) download a response from an untrusted URL that returns Content-Encoding: br.

How to recognize it (Versions & Logs)

  • Vulnerable versions: Node.js 22.x < 22.23.4, 24.x < 24.22.1, 26.x < 26.12.1; Bun <= 1.4.3; Python Brotli <= 1.2.0.
  • In your logs: Unexpected POST or PUT requests using Content-Encoding: br, or repeated Node.js / Bun worker crashes (SIGSEGV) prior to shell execution.

How to mitigate it

  • Patch runtimes & containers: Upgrade to Node.js 22.23.4, 24.22.1, or 26.12.1, Bun 1.4.4, and Python Brotli 1.2.1.
  • Block Brotli request bodies at the edge: Configure your WAF or API gateway to reject incoming Content-Encoding: br requests while keeping gzip and deflate enabled. In Next.js, set images.unoptimized: true until Node.js is patched.
Software / Runtime Vulnerable Versions First Fixed Release
Node.js 22.x < 22.23.4 · 24.x < 24.22.1 · 26.x < 26.12.1 22.23.4 · 24.22.1 · 26.12.1
Bun <= 1.4.3 1.4.4 (bundles Brotli 1.2.1)
Python Brotli / brotlicffi <= 1.2.0 / <= 1.2.0.x 1.2.1 · 1.2.1.0
Google Brotli (Upstream C) 1.0.3 – 1.2.0 1.2.1 · 1.1.1 · 1.0.10

HTTP2Shell

CVE-2026-111497 (Envoy/Istio) CVE-2026-15176 / 93479 / 97205 CVE-2026-95101 / 97629 CVSS 9.2 Critical

Reverse proxies and Kubernetes ingress gateways face two converging HTTP-layer threats: Brotli decompression RCE in Envoy Proxy and Istio, and five critical NGINX worker memory, HTTP/3, and mTLS bypass flaws.

Because edge proxies inspect traffic first, a compromise or authentication bypass at the proxy layer exposes every internal service behind it.

Why it’s a risk

Envoy & Istio RCE (CVE-2026-111497): Gateways with Brotli decompression enabled can suffer memory corruption and remote code execution. NGINX Worker Overflows & mTLS Bypass: Three buffer overflow flaws (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205, rated 9.2 CVSS) allow worker memory corruption, while CVE-2026-97629 allows attackers to forge TLS resumption tickets and bypass client certificate (mTLS) authentication.

How to recognize it (Versions & Logs)

  • Vulnerable versions: NGINX < 1.31.7 / < 1.30.6; Envoy <= 1.39.2 / 1.38.5 / 1.37.7; Istio <= 1.31.1 / 1.30.5.
  • In your logs: NGINX worker process ... exited on signal 11 crash entries in error.log, or unexpected TLS session resumptions on mTLS-protected routes.

How to mitigate it

  • Upgrade ingress & proxy binaries: Update NGINX to 1.31.7 or 1.30.6, Envoy to 1.40.0 / 1.39.3, and Istio to 1.31.2 / 1.30.6.
  • Hardening settings: Disable the Brotli decompressor filter in Envoy/Istio, set proxy_request_buffering off; for NGINX HTTP/3, and set ssl_session_tickets off; on mTLS endpoints.
Edge Proxy / Mesh Vulnerable Releases First Fixed Release
NGINX 0.1.29 – 1.31.6 · 1.30.0 – 1.30.5 1.31.7 · 1.30.6
Envoy Proxy <= 1.39.2 · <= 1.38.5 · <= 1.37.7 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8
Istio <= 1.31.1 · <= 1.30.5 1.31.2 · 1.30.6

Beyond PHP, Node & HTTP: What else is in the news?

From the original React2Shell disclosure to this month’s emergency patches in Next.js, Ruby/GitLab, and Python Pillow, these critical vulnerabilities are actively tracked alongside the *2Shell wave.

CVE-2025-55182 CVE-2026-96889 CVSS 10.0 & 9.5

React2Shell & Next.js Emergency RCE Patches

React2Shell (CVE-2025-55182) exposed ~968K servers to unauthenticated RCE via React Server Components (RSC) serialization. On October 14, 2026, Next.js shipped emergency releases 16.4.1 and 15.5.28 (with React 19.3.1) for two new 9.5 CVSS RCE flaws in RSC caching and SVG image rendering (CVE-2026-96889). Upgrade Next.js and ensure sharp >= 0.35.5.

CVE-2026-110264 / 110265 GitLab CVE-2026-6654 CVSS 9.9 Critical

Ruby Regex RCEs Behind 4x GitLab Flaws (Oct 23)

Ruby released 4.0.9, 3.4.12, and 3.3.13 on October 23 to fix memory corruption flaws in its Onigmo regex engine that caused four critical GitLab RCEs (CVE-2026-6654, CVE-2026-5986, CVE-2026-9651, CVE-2026-10124). Patch GitLab and Ruby runtimes immediately.

CVE-2026-112900 436M Monthly Downloads

Python Pillow Image Library RCE

Python’s Pillow imaging library (< 13.0.0) allows OS command injection when processing EPS images with untrusted filenames. Upgrade to Pillow 13.0.0 and rename uploaded files to random UUIDs before processing.

CVE-2026-5027 CVE-2026-42271 Active Exploitation

AI Gateways: Langflow & LiteLLM RCEs

Attackers are actively exploiting Langflow (CVE-2026-5027) and LiteLLM (CVE-2026-42271) to steal LLM API keys and cloud credentials. Keep AI orchestration gateways off the public internet and behind identity-aware proxies.