PHP2Shell (CVE-2026-109618, CVE-2026-109619) and Node2Shell (CVE-2026-111497) exploited vulnerabilities; Insignary-Chk detection tool released

Key facts for PHP2Shell PHP core RCE

Detection coverage for PHP2Shell PHP core RCE

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5472 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: PHP2Shell (CVE-2026-109618/CVE-2026-109619) Pre-Application OOM Error in PHP Logs — Exploitation

Detects the PHP error-log signature of PHP2Shell exploitation attempts (TL-2026-5472): an out-of-memory condition raised before any application code runs ('... bytes exhausted (tried to allocate N bytes) in Unknown on line 0'). The Zend engine UAF flaws CVE-2026-109618 and CVE-2026-109619 are triggered by forcing OOM -> zend_bailout()/longjmp(), and WAF/application logs see little, so the PHP error log is one of the few places the attempt is visible. Covers mod_php, PHP-FPM, php-cgi and LiteSpeed error streams. Note that the match is 'exhausted' + 'in Unknown on line 0' because the research IOC string is preceded by the allocation message.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1499.004, T1595.002
• Data sources: index=web sourcetype=apache:error, index=web sourcetype=php:error, index=web sourcetype=php_fpm:error, linux syslog
• Severity: high
• Confidence: medium

Splunk SPL

index=web (sourcetype=apache:error OR sourcetype=php:error OR sourcetype=php_fpm:error) "exhausted" "in Unknown on line 0" earliest=-24h | eval cve="CVE-2026-109618/CVE-2026-109619 PHP2Shell" | stats count AS oom_events min(_time) AS first_seen max(_time) AS last_seen values(source) AS log_files BY host sourcetype cve | where oom_events>=1 | eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T") | sort - oom_events

Microsoft KQL

Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has "exhausted" and SyslogMessage has "in Unknown on line 0"
| extend Vulnerability = "CVE-2026-109618/CVE-2026-109619 PHP2Shell"
| summarize OomEvents = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, ProcessName, Vulnerability
| project Computer, ProcessName, Vulnerability, OomEvents, FirstSeen, LastSeen
| order by OomEvents desc

Sigma

title: PHP2Shell Pre-Application OOM Error in PHP Error Log (CVE-2026-109618/CVE-2026-109619)
id: 3b7e1c52-8a4d-4f0e-9c61-5d2a7f9e1b04
status: experimental
description: Detects the PHP error-log message 'bytes exhausted ... in Unknown on line 0' that indicates an out-of-memory event before application code runs, consistent with PHP2Shell exploitation attempts (TL-2026-5472).
references:
    - https://offsec.com/blog/php2shell-critical-vulnerabilities-in-php-core/
    - https://github.com/NCSC-NL/php2shell/wiki
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-07
tags:
    - attack.initial-access
    - attack.t1190
    - attack.impact
    - attack.t1499.004
    - cve.2026-109618
    - cve.2026-109619
logsource:
    product: apache
    service: error
detection:
    selection_oom:
        - 'exhausted'
    selection_unknown:
        - 'in Unknown on line 0'
    condition: selection_oom and selection_unknown
falsepositives:
    - Legitimate memory exhaustion from oversized uploads or runaway scripts hitting memory_limit
    - Misconfigured PHP extensions that allocate during shutdown
level: high

Known false positives:

• Legitimate scripts or large uploads that exceed memory_limit and are logged during shutdown
• Load tests or fuzzing against staging PHP hosts

Tuning notes: Baseline OOM errors per host for 7 days and alert on a spike or on any hit on patched-version-unknown hosts. Correlate with the source of the triggering request (multipart POST with no Content-Length). Enrich with PHP version: hosts on 8.1 or older are unfixed and should be treated as priority. Exclude known batch hosts that legitimately exhaust memory.

• 🔒 Node2Shell (CVE-2026-111497) [indicator] Decoder Errors and Node SIGSEGV Crashes — Exploitation · unlock with TL Creds
• 🔒 PHP2Shell Web Shell Drop: Random-Hex PHP File in Upload Directory or [indicator] Rewrite — Persistence · unlock with TL Creds
• 🔒 PHP2Shell Lateral Movement: SSH/SCP/Rsync Launched by Web Account or Web Worker — Lateral Movement · unlock with TL Creds
• 🔒 PHP2Shell/Node2Shell Scanner Activity: Nuclei User-Agent and POST Errors Across Hosts — Exploitation · unlock with TL Creds
• 🔒 PHP2Shell Cron Persistence: Web Account crontab or Cron Job Rewriting [indicator] — Persistence · unlock with TL Creds
• 🔒 PHP2Shell Private SSH Key Access by Web Account or Web Worker — Credential Access · unlock with TL Creds
• 🔒 PHP2Shell / Node2Shell Web Worker Spawning Shell or Downloader — Post-Exploitation · unlock with TL Creds
• 🔒 PHP2Shell/Node2Shell Known and Community-Observed Infrastructure Contact — C2 / Scanning Source · unlock with TL Creds

Indicators of compromise for PHP2Shell PHP core RCE

As of 2026-11-07, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-5472.

Sample indicators (1 of 12)

• IP address: 94.154.43[.]7

Defanged, TLP:CLEAR. Full set of 12 indicators: unlock with TL Creds.

How PHP2Shell PHP core RCE works

PHP2Shell comprises CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. Both are use-after-free conditions in the Zend engine triggered by out-of-memory (OOM) errors that force zend_bailout() and a longjmp(). CVE-2026-109618 is memory corruption during request cleanup: in _zend_hash_str_add_or_update_i() internal counters are incremented before the string is initialized, so a bailout leaves a freed region still referenced. CVE-2026-109619 is stale request-owned global state that is not reset after an abort and is reused by a later request on the same worker. An unauthenticated attacker sends crafted HTTP requests (OffSec describes a malformed multipart request with no Content-Length and a nested file upload without a filename) and then manipulates function pointer tables or global state to obtain code execution or memory disclosure before any application code runs. Affected: PHP 5.4 onward; fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (released 2026-10-21). PHP 8.1 and older are end-of-life and get no official fix. Exposed runtimes include Apache mod_php (highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Because the bug fires before application code, WAF and application logging see little. Partial mitigations are session.upload_progress.enabled=0 and memory_limit=-1, both needing worker restarts; updating is the only reliable fix.

Exploitation: Amazon reported attacks beginning 2026-10-17, four days before patches. Details of the flaws leaked online on 2026-10-20 ahead of coordinated disclosure. Cloudflare reported blocking millions of attempts. Perplexity researcher Adel Karimi documented honeypot evidence of RCE against Apache mod_php on PHP 8.4.26; Mend reports 35 successful RCEs on honeypots, with attackers attempting outbound connections via PHP, curl and wget but no further malware observed. By 2026-10-27, more than 60,000 exploitation requests from 600+ IPs in 70+ countries were reported (TU Delft tracker, per vendor reporting). CISA added both CVEs to KEV on 2026-10-26. Vendors describe two clusters: a suspected North Korea-linked scanning campaign (CYFIRMA, moderate confidence, Lazarus ecosystem; 21 compromised scan nodes, 216 hosts) and a criminal extortion operator (SOCRadar) targeting Japanese real estate that added PHP2Shell tooling on 2026-10-21. Reported tradecraft includes slow, low-volume scanning with rotating nodes, new PHP files with random hex names in upload directories, .htaccess rewrites via cron, and SSH-key lateral movement between hosting accounts. Some early vendor claims were retracted and some public exploits reportedly contain malware. These attributions come from single vendors and are not independently confirmed.

Node2Shell (CVE-2026-111497, also Broccoli2Shell / Brotli2Shell; CVSS v4.0 9.2 per NVD, Node.js rates it High; CWE-787 and CWE-252) is an out-of-bounds write in Google's Brotli decoder. DecodeBlockTypeAndLength() returns a boolean that cannot distinguish a malformed stream from 'need more input', so the decoder continues with invalid state and copies unconsumed bytes into a small internal buffer without bounds checking. The impact is a crash, process memory disclosure or RCE for any application decompressing attacker-controlled Brotli data. The vulnerability was reported by OpenAI Codex Security researchers; Imperva named it Node2Shell and demonstrated RCE against Node.js 24.22.0 Linux arm64. Fixed in Node.js 22.23.4, 24.22.1 and 26.12.1, Brotli 1.0.10, 1.1.1 and 1.2.1, Python brotli/brotlicffi 1.2.1, Bun 1.4.4, brotli4j 1.24.0, .NET 8.0.33/9.0.22/10.0.14 (out-of-band 2026-10-25), Envoy 1.36.12+ and Istio 1.29.9+. Other exposed software includes FFmpeg, Apache Arrow and ClickHouse. Inbound vectors are Brotli-compressed request bodies (e.g. Express 5 / body-parser 2.x); outbound vectors are fetch/axios/got/node-fetch decoding Content-Encoding: br from attacker-controlled servers. A public PoC appeared 2026-10-22. CISA added the CVE to KEV on 2026-10-27 (federal due date 2026-11-10); a Datadog write-up gives 2026-10-29. ELLIO sensors recorded a request against Node.js 24.22.0 on 2026-10-26 from IP 94.154.43.7, previously seen targeting PHP2Shell; ELLIO assessed the exploit as broken, a first-generation attempt. Sources disagree on whether successful in-the-wild compromise has occurred.

Insignary-Chk, released 2026-11-06, is a free Linux x86_64-only tool that is read-only by default and checks PHP runtimes, Node.js, the system Brotli library and Python's brotli package; an optional --clarity mode confirms findings by binary analysis. The source article is a press-release-style piece.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.004 Remote Services: SSH

Persistence

T1053.003 Scheduled Task/Job: Cron; T1505.003 Server Software Component: Web Shell

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1212 Exploitation for Credential Access; T1552.004 Unsecured Credentials: Private Keys

Impact

T1499.004 Endpoint Denial of Service: Application or System Exploitation

Resource Development

T1584 Compromise Infrastructure

Reconnaissance

T1595.002 Active Scanning: Vulnerability Scanning

Remediation for PHP2Shell PHP core RCE

Patches

• PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 (2026-10-21)
• Node.js 22.23.4, 24.22.1, 26.12.1 (2026-10-21)
• Google Brotli 1.0.10, 1.1.1, 1.2.1
• Microsoft .NET 8.0.33, 9.0.22, 10.0.14 (out-of-band 2026-10-25)

Immediate actions

• Upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35; upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1
• Patch every other Brotli consumer (system libbrotli 1.0.10/1.1.1/1.2.1, Python brotli/brotlicffi 1.2.1, Bun 1.4.4, brotli4j 1.24.0, .NET 8.0.33/9.0.22/10.0.14, Envoy 1.36.12+, Istio 1.29.9+)
• Hunt PHP upload directories for new PHP files with random hex names and review .htaccess files and crontabs for unexpected rewrites
• Search PHP error logs for 'bytes exhausted in Unknown on line 0' and application logs for Z_BUF_ERROR 'unexpected end of file' after Brotli input
• Run Insignary-Chk (Linux x86_64) to inventory exposed PHP and Brotli runtimes

Workarounds

• PHP: set session.upload_progress.enabled=0 and memory_limit=-1, then restart workers (partial only)
• Node.js/Brotli: reject Content-Encoding: br request bodies where unnecessary and disable automatic Brotli decompression of untrusted sources
• Restart PHP workers regularly until patched

Longer-term hardening

• Retire end-of-life PHP 8.1 and earlier and Node.js 20.x and earlier
• Restrict outbound egress from web workers (PHP, curl, wget) and restrict server-side fetches to controlled destinations
• Reduce post-exploitation privilege via least-privilege IAM/RBAC and separate hosting accounts and SSH keys
• Alert on child-process creation from PHP/Node workers, SIGSEGV exit code 139 and container restart loops

Affected and fixed versions

• PHP Group — PHP (mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed)
  Vulnerable versions: 5.4 through 8.1 (EOL, unfixed); 8.2 < 8.2.35; 8.3 < 8.3.36; 8.4 < 8.4.27; 8.5 < 8.5.12
  Fixed in: 8.2.35; 8.3.36; 8.4.27; 8.5.12
• OpenJS Foundation — Node.js
  Vulnerable versions: 22.x through 22.23.3; 24.x through 24.22.0; 26.x through 26.12.0; 20.x and EOL branches (unfixed)
  Fixed in: 22.23.4; 24.22.1; 26.12.1
• Google — Brotli
  Vulnerable versions: 1.0.3-1.0.9; 1.1.0; 1.2.0
  Fixed in: 1.0.10; 1.1.1; 1.2.1
• Microsoft — .NET
  Vulnerable versions: 8; 9; 10 (before 2026-10-25 updates)
  Fixed in: 8.0.33; 9.0.22; 10.0.14
• Various — Python brotli/brotlicffi, Bun, brotli4j, Envoy Proxy, Istio
  Vulnerable versions: brotli/brotlicffi <= 1.2.0; Bun 1.0.21-1.4.3; brotli4j <= 1.23.0; Envoy and Istio pre-fix releases
  Fixed in: 1.2.1; Bun 1.4.4; brotli4j 1.24.0; Envoy 1.36.12+; Istio 1.29.9+

Timeline of PHP2Shell PHP core RCE

Last updated 2026-11-07 · revalidated 1× · latest source

• 2026-02-27 Fix for the locked-ioc-11 decoder flaw committed to google/locked-ioc-11 without an advisory (later tracked as CVE-2026-111497).
• 2026-08-24 PHP2Shell vulnerabilities reported to the PHP project (discovered by Calif, OpenAI and Wiz per OffSec).
• 2026-10-17 Amazon reports first PHP2Shell exploitation attempts, four days before patches shipped.
• 2026-10-20 Details of the two PHP pre-auth RCE flaws leak online ahead of coordinated disclosure.
• 2026-10-21 PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and Node.js publicly discloses and fixes CVE-2026-111497 (22.23.4, 24.22.1, 26.12.1); Cloudflare reports blocking millions of PHP2Shell attempts and SOCRadar says an extortion operator added PHP2Shell tooling.
• 2026-10-22 Public Node2Shell proof-of-concept published; Imperva demonstrates RCE on Node.js 24.22.0 Linux arm64.
• 2026-10-24 Adel Karimi (Perplexity) confirms successful RCE with usable memory disclosure against honeypot systems.
• 2026-10-25 Microsoft ships out-of-band .NET 8, 9 and 10 updates for the locked-ioc-11 flaw.
• 2026-10-26 PHP Windows builds of the fixed releases published.
• 2026-10-26 CISA adds CVE-2026-109618 and CVE-2026-109619 to KEV; ELLIO sensors the same day record a Node2Shell request against Node.js 24.22.0 from locked-ioc-6.
• 2026-10-27 CISA adds CVE-2026-111497 to KEV (federal due date 2026-11-10); SOCRadar exposes a staging server holding PHP2Shell tooling.
• 2026-11-06 Insignary releases the free locked-ioc-5 scanner for PHP2Shell and Node2Shell exposure.

Update history

• 2026-11-07 — PHP2Shell (CVE-2026-109618, CVE-2026-109619) and Node2Shell (CVE-2026-111497) - Unauthenticated RCE in PHP runtime and Node.js locked-ioc-11 decoder, added to CISA KEV; Insignary releases locked-ioc-5 detection tool: What changed No severity, exploitability, status or CVSS change; existing values (CRITICAL, ACTIVE, 9.2) already match the newer report. New indicators (4) Indicator values are withheld at this access level. New MITRE (1) T1212 Exploitation

Sources cited for PHP2Shell PHP core RCE

• NCSC-NL PHP2Shell wiki GitHub · Advisory
• PHP2Shell: Critical Vulnerabilities in PHP Core (OffSec) offsec.com · Research · 2026-10-22
• PHP2Shell campaign tracker (NHIMG) nhimg.org · Research
• PHP2Shell - Remote Code Execution (CVE-2026-109618 & CVE-2026-109619) (Pentest-Tools) pentest-tools.com · Vendor report · 2026-10-21
• CVE-2026-111497: Node2Shell and Brotli2Shell (Datadog Security Labs) securitylabs.datadoghq.com · Research
• PHP2Shell and CISA KEV: PHP runtime (Mend) mend.io · Blog
• CVE-2026-111497: Inside Node2Shell and the Brotli Decoder Flaw (Safe Security) safe.security · Blog
• Insignary Releases Free Insignary-Chk Tool to Detect PHP2Shell and Node2Shell Exposure cybersecuritynews.com · News · 2026-11-07
• CISA confirms PHP2Shell vulnerabilities now exploited in attacks (BleepingComputer) BleepingComputer · News · 2026-10-26
• PHP2Shell CISA KEV, DPRK attribution (SecurityOnline) securityonline.info · News
• Brotli bug reaches far beyond Node.js (CVE-2026-111497) (Help Net Security) Help Net Security · News · 2026-10-27
• Node2Shell puts Microsoft and Node.js on Brotli patch duty (CSO Online) csoonline.com · News
• CISA warns of Node2Shell exploitation as honeypots log attack attempts (SecurityWeek) SecurityWeek · News
• CISA warns of hackers now exploiting critical Node2Shell flaw (BleepingComputer) BleepingComputer · News

More in vulnerability

• Siemens SSA-827968: Multiple Vulnerabilities in Nozomi Guardian/CMC < V26.2.0 on RUGGEDCOM APE1808 (17 CVEs)
• Local Privilege Escalation in Siemens TeleControl Server Basic before V3.1.2.4 (CVE-2025-40942)
• Privilege Escalation in WIBU CodeMeter Runtime Affecting Siemens Desigo CC Product Family and SENTRON Powermanager (CVE-2025-47809)
• Siemens SSA-282044: DLL Hijacking in Siemens Web Installer (SIWA) used by Online Software Delivery (CVE-2025-30033)
• Siemens SSA-364175: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 (CVE-2024-3596, CVE-2025-4231 and others)

Other reports on CVE-2026-109618

• October 2026 CVE Landscape: PHP2Shell (CVE-2026-109618/109619) + Fragnesia (CVE-2026-46300) chain, Longlegs/Storm-2603 SharePoint exploitation, and other actively exploited CVEs
• NCSC Warns of AI-Enabled Ransomware Threat to UK Critical National Infrastructure by 2028 (PHP2Shell CVE-2026-109618/109619 cited)
• ThreatsDay Bulletin: Fortinet Critical Firewall Updates (Details Embargoed), Gotenberg RCE CVE-2026-42589 Under Active Exploitation, PHP2Shell Scanning
• Warp Panda exploits VMware ESX CVE-2026-41709; PHP2Shell (CVE-2026-109618/109619) chained with Fragnesia (CVE-2026-46300) to root firewalls
• Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities (Campaign Classic APSB26-162, Connect APSB26-182, Veeam B365 8.6 / B&R 13.1.2, Juniper Session Smart Router JSA112183)
• Cybersecurity Black Week: LiteLLM 1.107.0 PyPI/Docker supply-chain compromise, PHP2Shell (CVE-2026-109618/109619), Node2Shell (CVE-2026-111497), GitLab CVE-2026-110264, KSMBD flaws and eMudhra emSign intermediate CA key compromise

Other reports on CVE-2026-109619

• Eclypsium InfraTrust Pulse (Oct 2026): Actively Exploited Flaws Across Network Infrastructure Appliances (NetScaler CVE-2026-88771, Ivanti CVE-2026-104935, Check Point CVE-2026-93616, Cisco, Arista VeloCloud, FortiMail, F5 BIG-IP APM, PAN-OS, PHP2Shell, Linux Copy Fail)
• PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Weaponized Following Japanese Real Estate Extortion Campaign by kkkkevin777
• PHP HTTP2Shell: Critical Brotli Out-of-Bounds Write Reachable via cURL (CVE-2026-111497, CVE-2026-109618, CVE-2026-109619)
• Critical Okta Access Gateway Flaw (CVE-2026-115547) Lets Admin-Level Attackers Execute System Commands
• PHP Unpatched RCE CVE-2026-115560 Disclosed Two Days After Emergency PHP2Shell Patches (CVE-2026-109618/CVE-2026-109619)
• October 21 Roundup: PHP2Shell (CVE-2026-109618/109619), LiteLLM 1.107.0 Supply-Chain Backdoor, Palo Alto GlobalProtect CVE-2026-0257 Exploitation

Previous and next in vulnerability

• Multiple Vulnerabilities in Google Chrome prior to 156.0.8078.73 (52 CVEs incl. CVE-2026-118306 FileSystem sandbox escape) - HKCERT Alert A26-10-59 Previous report
• SSA-365200: Google Chrome V8 Type Confusion Vulnerability (CVE-2025-6554) in Siemens HyperLynx and Industrial Edge App Publisher Next report