# PHP2Shell (CVE-2026-109618, CVE-2026-109619) and Node2Shell (CVE-2026-111497) exploited vulnerabilities; Insignary-Chk detection tool released

> Two unauthenticated RCE flaws in the PHP core runtime (PHP2Shell) and an out-of-bounds write in Google's Brotli decoder bundled with Node.js and other runtimes (Node2Shell) are being exploited in the wild and are listed in CISA KEV. Insignary released the free Insignary-Chk scanner on 2026-11-06 to help defenders find exposed hosts.

- **Published:** 2026-11-07T02:24:27Z
- **Last reviewed:** 2026-11-07T02:45:29.154Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5472
- **ID:** TL-2026-5472
- **Severity:** CRITICAL (CVSS 9.2)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 12 (1 shown free below)
- **CVEs:** CVE-2026-109618, CVE-2026-109619, CVE-2026-111497

## Description

PHP2Shell comprises CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. Both are use-after-free conditions in the Zend engine triggered by out-of-memory (OOM) errors that force zend_bailout() and a longjmp(). CVE-2026-109618 is memory corruption during request cleanup: in _zend_hash_str_add_or_update_i() internal counters are incremented before the string is initialized, so a bailout leaves a freed region still referenced. CVE-2026-109619 is stale request-owned global state that is not reset after an abort and is reused by a later request on the same worker. An unauthenticated attacker sends crafted HTTP requests (OffSec describes a malformed multipart request with no Content-Length and a nested file upload without a filename) and then manipulates function pointer tables or global state to obtain code execution or memory disclosure before any application code runs. Affected: PHP 5.4 onward; fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (released 2026-10-21). PHP 8.1 and older are end-of-life and get no official fix. Exposed runtimes include Apache mod_php (highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Because the bug fires before application code, WAF and application logging see little. Partial mitigations are session.upload_progress.enabled=0 and memory_limit=-1, both needing worker restarts; updating is the only reliable fix.

Exploitation: Amazon reported attacks beginning 2026-10-17, four days before patches. Details of the flaws leaked online on 2026-10-20 ahead of coordinated disclosure. Cloudflare reported blocking millions of attempts. Perplexity researcher Adel Karimi documented honeypot evidence of RCE against Apache mod_php on PHP 8.4.26; Mend reports 35 successful RCEs on honeypots, with attackers attempting outbound connections via PHP, curl and wget but no further malware observed. By 2026-10-27, more than 60,000 exploitation requests from 600+ IPs in 70+ countries were reported (TU Delft tracker, per vendor reporting). CISA added both CVEs to KEV on 2026-10-26. Vendors describe two clusters: a suspected North Korea-linked scanning campaign (CYFIRMA, moderate confidence, Lazarus ecosystem; 21 compromised scan nodes, 216 hosts) and a criminal extortion operator (SOCRadar) targeting Japanese real estate that added PHP2Shell tooling on 2026-10-21. Reported tradecraft includes slow, low-volume scanning with rotating nodes, new PHP files with random hex names in upload directories, .htaccess rewrites via cron, and SSH-key lateral movement between hosting accounts. Some early vendor claims were retracted and some public exploits reportedly contain malware. These attributions come from single vendors and are not independently confirmed.

Node2Shell (CVE-2026-111497, also Broccoli2Shell / Brotli2Shell; CVSS v4.0 9.2 per NVD, Node.js rates it High; CWE-787 and CWE-252) is an out-of-bounds write in Google's Brotli decoder. DecodeBlockTypeAndLength() returns a boolean that cannot distinguish a malformed stream from 'need more input', so the decoder continues with invalid state and copies unconsumed bytes into a small internal buffer without bounds checking. The impact is a crash, process memory disclosure or RCE for any application decompressing attacker-controlled Brotli data. The vulnerability was reported by OpenAI Codex Security researchers; Imperva named it Node2Shell and demonstrated RCE against Node.js 24.22.0 Linux arm64. Fixed in Node.js 22.23.4, 24.22.1 and 26.12.1, Brotli 1.0.10, 1.1.1 and 1.2.1, Python brotli/brotlicffi 1.2.1, Bun 1.4.4, brotli4j 1.24.0, .NET 8.0.33/9.0.22/10.0.14 (out-of-band 2026-10-25), Envoy 1.36.12+ and Istio 1.29.9+. Other exposed software includes FFmpeg, Apache Arrow and ClickHouse. Inbound vectors are Brotli-compressed request bodies (e.g. Express 5 / body-parser 2.x); outbound vectors are fetch/axios/got/node-fetch decoding Content-Encoding: br from attacker-controlled servers. A public PoC appeared 2026-10-22. CISA added the CVE to KEV on 2026-10-27 (federal due date 2026-11-10); a Datadog write-up gives 2026-10-29. ELLIO sensors recorded a request against Node.js 24.22.0 on 2026-10-26 from IP 94.154.43.7, previously seen targeting PHP2Shell; ELLIO assessed the exploit as broken, a first-generation attempt. Sources disagree on whether successful in-the-wild compromise has occurred.

Insignary-Chk, released 2026-11-06, is a free Linux x86_64-only tool that is read-only by default and checks PHP runtimes, Node.js, the system Brotli library and Python's brotli package; an optional --clarity mode confirms findings by binary analysis. The source article is a press-release-style piece.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505.003 Server Software Component: Web Shell
- T1053.003 Scheduled Task/Job: Cron
- T1552.004 Unsecured Credentials: Private Keys
- T1021.004 Remote Services: SSH
- T1595.002 Active Scanning: Vulnerability Scanning
- T1584 Compromise Infrastructure
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1212 Exploitation for Credential Access

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**PHP2Shell (CVE-2026-109618/CVE-2026-109619) Pre-Application OOM Error in PHP Logs — Exploitation** (`TL-2026-5472-SPL-001`)

Detects the PHP error-log signature of PHP2Shell exploitation attempts (TL-2026-5472): an out-of-memory condition raised before any application code runs ('... bytes exhausted (tried to allocate N bytes) in Unknown on line 0'). The Zend engine UAF flaws CVE-2026-109618 and CVE-2026-109619 are triggered by forcing OOM -> zend_bailout()/longjmp(), and WAF/application logs see little, so the PHP error log is one of the few places the attempt is visible. Covers mod_php, PHP-FPM, php-cgi and LiteSpeed error streams. Note that the match is 'exhausted' + 'in Unknown on line 0' because the research IOC string is preceded by the allocation message.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1499.004, T1595.002
- **Data sources:** index=web sourcetype=apache:error, index=web sourcetype=php:error, index=web sourcetype=php_fpm:error, linux syslog
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=web (sourcetype=apache:error OR sourcetype=php:error OR sourcetype=php_fpm:error) "exhausted" "in Unknown on line 0" earliest=-24h | eval cve="CVE-2026-109618/CVE-2026-109619 PHP2Shell" | stats count AS oom_events min(_time) AS first_seen max(_time) AS last_seen values(source) AS log_files BY host sourcetype cve | where oom_events>=1 | eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T") | sort - oom_events
```

### Microsoft KQL

```kql
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has "exhausted" and SyslogMessage has "in Unknown on line 0"
| extend Vulnerability = "CVE-2026-109618/CVE-2026-109619 PHP2Shell"
| summarize OomEvents = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, ProcessName, Vulnerability
| project Computer, ProcessName, Vulnerability, OomEvents, FirstSeen, LastSeen
| order by OomEvents desc
```

### Sigma

```yaml
title: PHP2Shell Pre-Application OOM Error in PHP Error Log (CVE-2026-109618/CVE-2026-109619)
id: 3b7e1c52-8a4d-4f0e-9c61-5d2a7f9e1b04
status: experimental
description: Detects the PHP error-log message 'bytes exhausted ... in Unknown on line 0' that indicates an out-of-memory event before application code runs, consistent with PHP2Shell exploitation attempts (TL-2026-5472).
references:
    - https://offsec.com/blog/php2shell-critical-vulnerabilities-in-php-core/
    - https://github.com/NCSC-NL/php2shell/wiki
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-07
tags:
    - attack.initial-access
    - attack.t1190
    - attack.impact
    - attack.t1499.004
    - cve.2026-109618
    - cve.2026-109619
logsource:
    product: apache
    service: error
detection:
    selection_oom:
        - 'exhausted'
    selection_unknown:
        - 'in Unknown on line 0'
    condition: selection_oom and selection_unknown
falsepositives:
    - Legitimate memory exhaustion from oversized uploads or runaway scripts hitting memory_limit
    - Misconfigured PHP extensions that allocate during shutdown
level: high

```

**Known false positives:**

- Legitimate scripts or large uploads that exceed memory_limit and are logged during shutdown
- Load tests or fuzzing against staging PHP hosts

**Tuning notes:** Baseline OOM errors per host for 7 days and alert on a spike or on any hit on patched-version-unknown hosts. Correlate with the source of the triggering request (multipart POST with no Content-Length). Enrich with PHP version: hosts on 8.1 or older are unfixed and should be treated as priority. Exclude known batch hosts that legitimately exhaust memory.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Node2Shell (CVE-2026-111497) [indicator] Decoder Errors and Node SIGSEGV Crashes — Exploitation (locked: unlock with TL Creds)
- PHP2Shell Web Shell Drop: Random-Hex PHP File in Upload Directory or [indicator] Rewrite — Persistence (locked: unlock with TL Creds)
- PHP2Shell Lateral Movement: SSH/SCP/Rsync Launched by Web Account or Web Worker — Lateral Movement (locked: unlock with TL Creds)
- PHP2Shell/Node2Shell Scanner Activity: Nuclei User-Agent and POST Errors Across Hosts — Exploitation (locked: unlock with TL Creds)
- PHP2Shell Cron Persistence: Web Account crontab or Cron Job Rewriting [indicator] — Persistence (locked: unlock with TL Creds)
- PHP2Shell Private SSH Key Access by Web Account or Web Worker — Credential Access (locked: unlock with TL Creds)
- PHP2Shell / Node2Shell Web Worker Spawning Shell or Downloader — Post-Exploitation (locked: unlock with TL Creds)
- PHP2Shell/Node2Shell Known and Community-Observed Infrastructure Contact — C2 / Scanning Source (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 12)

Defanged, TLP:CLEAR.

- IP address: `94.154.43[.]7`

Full set of 12 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Insignary Releases Free Insignary-Chk Tool to Detect PHP2Shell and Node2Shell Exposure](https://cybersecuritynews.com/insignary-releases-free-insignary-chk-tool-to-detect-php2shell-and-node2shell-exposure/)
- [PHP2Shell: Critical Vulnerabilities in PHP Core (OffSec)](https://offsec.com/blog/php2shell-critical-vulnerabilities-in-php-core/)
- [NCSC-NL PHP2Shell wiki](https://github.com/NCSC-NL/php2shell/wiki)
- [CISA confirms PHP2Shell vulnerabilities now exploited in attacks (BleepingComputer)](https://bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks)
- [PHP2Shell and CISA KEV: PHP runtime (Mend)](https://www.mend.io/blog/php2shell-cisa-kev-php-runtime/)
- [PHP2Shell campaign tracker (NHIMG)](https://nhimg.org/php2shell-campaign-tracker)
- [PHP2Shell CISA KEV, DPRK attribution (SecurityOnline)](https://securityonline.info/php2shell-cisa-kev-confirmed-rce-dprk/)
- [PHP2Shell - Remote Code Execution (CVE-2026-109618 & CVE-2026-109619) (Pentest-Tools)](https://pentest-tools.com/vulnerabilities-exploits/php2shell-remote-code-execution-cve-2026-109618-and-cve-2026-109619_29870)
- [CVE-2026-111497: Node2Shell and Brotli2Shell (Datadog Security Labs)](https://securitylabs.datadoghq.com/articles/node2shell-cve-2026-111497-nodejs-brotli-decoder.md)
- [Brotli bug reaches far beyond Node.js (CVE-2026-111497) (Help Net Security)](https://helpnetsecurity.com/2026/10/27/node2shell-broccoli2shell-vulnerability-cve-2026-111497)
- [CVE-2026-111497: Inside Node2Shell and the Brotli Decoder Flaw (Safe Security)](https://safe.security/resources/blog/cve-2026-111497-inside-node2shell-and-the-brotli-decoder-flaw/)
- [Node2Shell puts Microsoft and Node.js on Brotli patch duty (CSO Online)](https://www.csoonline.com/article/4241027/node2shell-puts-microsoft-and-node-js-on-brotli-patch-duty.html)
- [CISA warns of Node2Shell exploitation as honeypots log attack attempts (SecurityWeek)](https://securityweek.com/cisa-warns-of-node2shell-exploitation-as-honeypots-log-attack-attempts)
- [CISA warns of hackers now exploiting critical Node2Shell flaw (BleepingComputer)](https://bleepingcomputer.com/news/security/cisa-warns-of-hackers-now-exploiting-critical-node2shell-flaw)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5472