Threat reportVulnerabilityTL-2026-4473
PHP HTTP2Shell: Critical Brotli Out-of-Bounds Write Reachable via cURL (CVE-2026-111497, CVE-2026-109618, CVE-2026-109619)
PHP HTTP2Shell (TL-2026-4473), also tracked as HTTP2Shell, is a critical-severity software vulnerability scored CVSS 9.2, first published 2026-10-26. It has no confirmed attribution, affects Google Brotli, references 3 CVEs (CVE-2026-111497, CVE-2026-109618, CVE-2026-109619), maps to 4 MITRE ATT&CK techniques (T1190, T1195.001, T1203), and is covered by 9 detection rules and 7 indicators of compromise.
- CVSS
- 9.2/10Critical
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-4473
- Threat ID
- TL-2026-4473
- Also known as
- HTTP2Shell, Node2Shell, PHP2Shell
- Severity
- CRITICAL
- CVSS
- 9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, finance, health, telecoms, industrial
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in PHP HTTP2Shell
Malware and tooling: PHP, php2shell
How PHP HTTP2Shell works
PHP published rebuilt Windows packages (8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1) bundling Brotli 1.2.1 to fix CVE-2026-111497, an out-of-bounds write in the Brotli decoder reachable through the cURL extension when automatic HTTP response decompression is enabled. Depending on configuration it can crash a process, expose memory, or allow remote code execution without authentication. CVE-2026-109618 and CVE-2026-109619 are separate PHP engine memory-safety flaws disclosed the same week.
CVE-2026-111497 is an out-of-bounds write (CWE-787, with an unchecked return value, CWE-252) in the decoder of Google's Brotli compression library (c/dec/decode.c). NVD lists versions 1.0.3 through 1.2.0 as affected, and fixes shipped in Brotli 1.0.10, 1.1.1 and 1.2.1. NVD scores it CVSS v4.0 9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). Node.js describes the trigger as a crafted stream that declares only one block type and then contains a block switch. The decoder did not reject this, and the Node.js patch makes it fail immediately on invalid data (new constant BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH). The PHP advisory says the flaw was disclosed on 2026-10-21, originally under the name Node2Shell and later renamed HTTP2Shell as the wider impact emerged.
In PHP on Windows, the vulnerable decoder is reachable through the cURL extension when automatic HTTP response decompression is enabled. That setting is off by default in cURL, but applications and HTTP client libraries can turn it on. The PHP team released Windows package rebuilds on 2026-10-26: PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. The '-1' suffix marks a rebuild with updated dependencies. The PHP source releases and runtime versions are unchanged. The risk is highest when an application decodes Brotli data from an untrusted or attacker-controlled server. Depending on configuration, impact ranges from a crash (availability) to memory disclosure (confidentiality) to remote code execution.
The same Brotli flaw affects other consumers of the library. Node.js 22.x, 24.x and 26.x bundle it, and fixes shipped in 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and older receive no fix. Node.js rates the issue High. GHSA-9v8h-qqgm-4m35 covers the Python brotli and brotlicffi packages (1.0.3-1.2.0, fixed in 1.2.1 and 1.2.1.0). The source article also names .NET, FFmpeg, ClickHouse, Apache Arrow and Microsoft products as downstream; those were not independently verified. A secondary analysis notes that Node.js fetch() decompresses a response automatically when Content-Encoding contains 'br', so a malicious server can force decompression whatever Accept-Encoding the client sent. Servers that accept Content-Encoding: br request bodies (for example Express with body-parser) are also exposed.
CVE-2026-109618 (use of uninitialized request memory after a longjmp() on out-of-memory) and CVE-2026-109619 (global state retaining references to freed request memory) are separate PHP engine memory-safety flaws, not Brotli. They are rated CVSS v4.0 9.2 (v3.1 9.8 and 8.1) and were fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on 2026-10-21. Wiz documents them as 'PHP2Shell' with a working unauthenticated RCE proof of concept against WordPress, Drupal and Joomla container images. Wiz does not mention Brotli or HTTP/2. The hunt skeleton grouped them with HTTP2Shell, and they are kept here as related, distinct issues. Siemens RUGGEDCOM APE1808 and Palo Alto Networks PAN-OS are also listed by NVD as affected by these two CVEs.
Exploitation status for the Brotli flaw is disputed in public sources. One advisory aggregator reports that Imperva confirmed code execution on 2026-10-22 through Node.js fetch() and through Express body-parser. Another reports no confirmed exploitation and no verified public proof of concept. A web search could not corroborate the Imperva claim. This record therefore marks exploitability as THEORETICAL and does not assert in-the-wild exploitation. No threat actor, malware family or network IOC is named in any source.
MITRE ATT&CK techniques used in TL-2026-4473
Initial Access
T1190 Exploit Public-Facing Application; T1195.001 Compromise Software Dependencies and Development Tools
Execution
T1203 Exploitation for Client Execution
Credential Access
Affected products and versions in PHP HTTP2Shell
- Google — Brotli
Vulnerable versions: 1.0.3 through 1.2.0
Fixed in: 1.0.10; 1.1.1; 1.2.1 - The PHP Group — PHP for Windows (cURL extension with automatic decompression enabled)
Vulnerable versions: Windows builds before 8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1
Fixed in: 8.5.12-1; 8.4.27-1; 8.3.36-1; 8.2.35-1 - OpenJS Foundation — Node.js
Vulnerable versions: 22.x; 24.x; 26.x before patch releases; 20.x and older (no fix)
Fixed in: 22.23.4; 24.22.1; 26.12.1 - Python Package Index — brotli and brotlicffi
Vulnerable versions: 1.0.3 through 1.2.0
Fixed in: brotli 1.2.1; brotlicffi 1.2.1.0 - The PHP Group — PHP (CVE-2026-109618 and CVE-2026-109619, separate engine flaws)
Vulnerable versions: 8.2.x before 8.2.35; 8.3.x before 8.3.36; 8.4.x before 8.4.27; 8.5.x before 8.5.12
Fixed in: 8.2.35; 8.3.36; 8.4.27; 8.5.12
Remediation for PHP HTTP2Shell
Patches
- PHP Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1
- Brotli 1.0.10, 1.1.1 or 1.2.1
- Node.js 22.23.4, 24.22.1 or 26.12.1
- Python brotli 1.2.1 and brotlicffi 1.2.1.0
- PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 for CVE-2026-109618 and CVE-2026-109619
Immediate actions
- Install the updated PHP Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 or 8.2.35-1, which bundle Brotli 1.2.1
- Inventory every application that bundles or links Brotli (Node.js, Python brotli/brotlicffi, .NET, FFmpeg, ClickHouse, Apache Arrow) and confirm the version is 1.0.10, 1.1.1, 1.2.1 or later
- Avoid decoding Brotli data from untrusted sources until patched, and review where cURL automatic decompression (CURLOPT_ENCODING) is enabled in PHP code and HTTP client libraries
Workarounds
- Leave cURL automatic response decompression disabled (the default) where it is not needed
- Do not send Accept-Encoding: br to untrusted servers, noting that a malicious server can still send Content-Encoding: br in Node.js fetch()
- Reject Content-Encoding: br request bodies at the edge or proxy for services that do not require them
Longer-term hardening
- Track bundled third-party libraries (SBOM) so dependency-only fixes like the '-1' Windows rebuilds are detected
- Rebuild applications packaged as Node.js single executables or snapshots after upgrading
- Restrict outbound requests from application servers to trusted endpoints and monitor repeated worker crashes
CVEs associated with PHP HTTP2Shell
Weaknesses (CWE) in PHP HTTP2Shell
Timeline of PHP HTTP2Shell
- Wiz researchers discover the PHP engine memory-safety flaws later tracked as CVE-2026-109618 and CVE-2026-109619 (PHP2Shell, a separate issue from the Brotli bug)
- PHP2Shell flaws reported to the PHP security team
- Brotli 1.0.10, 1.1.1 and 1.2.1 and Node.js 22.23.4, 24.22.1 and 26.12.1 are released with the fix for CVE-2026-111497. It is first disclosed as Node2Shell and later renamed HTTP2Shell. PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 fix CVE-2026-109618 and CVE-2026-109619 the same day
- One advisory aggregator reports that Imperva confirmed code execution through Node.js fetch() and Express body-parser. Another source reports no confirmed exploitation, and the claim could not be corroborated
- NVD and GitHub Advisory GHSA-9v8h-qqgm-4m35 publish CVE-2026-111497 with CVSS v4.0 9.2 and affected range 1.0.3 through 1.2.0
- Cyber Security News reports the PHP Windows update for HTTP2Shell
- PHP releases Windows rebuilds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 bundling Brotli 1.2.1
Sources cited for PHP HTTP2Shell
- PHP Releases New Windows Build Security Updates to Fix Critical HTTP2Shell Vulnerability
- Updated PHP Windows builds for Brotli security fix
- Brotli v1.2.1 release
- NVD: CVE-2026-111497
- GitHub Advisory GHSA-9v8h-qqgm-4m35 (brotli / brotlicffi)
- Node.js October 2026 security releases (Konfirmity)
- Node.js v24.22.1 fixes four HIGH CVEs (lilting.ch)
- Node.js Security Release: Brotli RCE and TLS Vulnerabilities (SecurityOnline)
- NVD: CVE-2026-109618
- NVD: CVE-2026-109619
- PHP security advisory GHSA-6wmf-4rv5-p3rp
- Wiz: PHP2Shell PHP RCE analysis
Detection coverage for TL-2026-4473
As of 2026-10-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4473 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.