#HTTP2Shell

Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell.” A significant blast radius. This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression. Please be aware. Fixes not yet available for all affected services. Look for Brotli (1.2.1) dependency upgrades when they become available.

Your team needs to make decisions about PHP2Shell. Conflicting advice makes that harder. On October 30, Rapid7’s Douglas McKee and Rik Ferguson take the stage for 'PHP2Shell Mythbusters'. Save your spot here:

🚨 𝗣𝗛𝗣𝟮𝗦𝗵𝗲𝗹𝗹: 𝗰𝗼𝗻𝗻𝗲𝗰𝘁𝗶𝗻𝗴 𝗵𝗼𝗻𝗲𝘆𝗽𝗼𝘁 𝘁𝗲𝗹𝗲𝗺𝗲𝘁𝗿𝘆 𝘄𝗶𝘁𝗵 𝗲𝗻𝗱𝗽𝗼𝗶𝗻𝘁 𝗽𝗿𝗲𝘃𝗮𝗹𝗲𝗻𝗰𝗲 ​ An interesting correlation while looking at the ongoing PHP2Shell activity. ​ The 𝗗𝗲𝗹𝗳𝘁 𝗧𝗵𝗿𝗲𝗮𝘁 𝗜𝗻𝘁𝗲𝗹𝗹𝗶𝗴𝗲𝗻𝗰𝗲 𝗟𝗮𝗯, running 𝟯𝟬𝟬 𝗵𝗼𝗻𝗲𝘆𝗽𝗼𝘁𝘀, has been capturing real-world PHP2Shell activity, including attempts to move beyond scanning into OS command execution, PHP code delivery, and malware deployment. ​ One of the associated malware samples has the SHA256: ​ 𝟶𝚌𝟻𝟺𝟾𝟼𝚏𝟶𝟼𝟼𝟸𝟶𝚎𝟸𝟼𝚎𝟹𝟷𝟼𝚏𝟺𝚋𝟹𝟹𝚏𝟹𝟷𝟾𝚋𝟶𝚍𝟼𝟺𝟼𝚍𝟻𝚎𝟷𝟷𝟹𝟹𝟽𝟾𝟿𝟹𝟹𝟷𝚊𝚊𝟸𝚏𝚎𝚍𝟶𝟷𝟸𝟹𝟼𝟶𝚍𝟷𝟺𝟾𝟼 ​ Looking at the same SHA256 in 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗗𝗲𝗳𝗲𝗻𝗱𝗲𝗿, the file prevalence shows 𝟲 𝗱𝗲𝘃𝗶𝗰𝗲𝘀 𝘄𝗼𝗿𝗹𝗱𝘄𝗶𝗱𝗲, with: 🔹 First seen: 𝟮𝟮 𝗢𝗰𝘁 𝟮𝟬𝟮𝟲, 𝟭𝟭:𝟱𝟲 𝗔𝗠 🔹 Last seen: 𝟮𝟯 𝗢𝗰𝘁 𝟮𝟬𝟮𝟲, 𝟴:𝟬𝟭 𝗔𝗠 ​ What makes this interesting is the timing. The Defender observations closely follow the new attack telemetry recorded by the honeypot infrastructure. ​ This doesn't prove that those 6 devices were compromised through PHP2Shell, but it demonstrates the value of 𝗰𝗼𝗿𝗿𝗲𝗹𝗮𝘁𝗶𝗻𝗴 𝗳𝗿𝗲𝘀𝗵 𝗵𝗼𝗻𝗲𝘆𝗽𝗼𝘁 𝗶𝗻𝘁𝗲𝗹𝗹𝗶𝗴𝗲𝗻𝗰𝗲 𝘄𝗶𝘁𝗵 𝗲𝗻𝗱𝗽𝗼𝗶𝗻𝘁 𝘁𝗲𝗹𝗲𝗺𝗲𝘁𝗿𝘆 to understand how quickly newly observed threats may surface across environments. ​ 𝗛𝗼𝗻𝗲𝘆𝗽𝗼𝘁 → 𝗜𝗢𝗖 → 𝗘𝗻𝗱𝗽𝗼𝗶𝗻𝘁 𝘁𝗲𝗹𝗲𝗺𝗲𝘁𝗿𝘆 → 𝗧𝗵𝗿𝗲𝗮𝘁 𝗵𝘂𝗻𝘁 ​ That is where threat intelligence becomes actionable. ​ #PHP2Shell #CyberSecurity #ThreatIntelligence #ThreatHunting #MicrosoftDefender #Malware #IncidentResponse #SOC

Our demo shows PHP2Shell giving a shell on MediaWiki, Symfony, Laravel, and phpBB. We’ve confirmed exploits work on pre-patch releases of PHP 8.2–8.5. If you haven’t updated, assume attackers can compromise your server, and that exploitation will only get easier.

Update: Our PHP exploit is now production-grade. * stock php.ini-production, display_errors=off, normal memory_limit, multi-worker, ASLR, under load * ARM64 + x86-64 targets * MediaWiki, WordPress, phpBB, Laravel * Apache/mod_php and nginx/php-fpm -> root

GreyNoise - Indicators Associated with Successful php2shell Exploitation Based on 01 November 2026, 03:48 UTC update. DefenderXDR Scan:

【注意喚起】 2026年10月30日、PHPの複数の脆弱性（CVE-2026-109618、CVE-2026-109619）に関するJPCET/CCの注意喚起の件に関連して、オランダの国家サイバーセキュリティセンター（NCSC-NL）が本脆弱性の影響を受ける可能性がある製品一覧や対策情報などをまとめたリポジトリーを公開しています。

ご確認ください。

🚨 PHP2Shell exploited in real-world attacks. An attacker chained PHP2Shell with a Linux kernel flaw to gain root access to 25 servers across four countries, including three in a U.S. government-affiliated environment. The intrusion extended into the internal network, where the attacker targeted Active Directory. Suspected China nexus. Signs of AI-assisted tooling. Read the full report:

I took a closer look at the CTF, which aims to demonstrate that PHP2SHELL is not realistically exploitable. So I gave it a try. Note: My analysis could be wrong, and I'm more than happy to be proven otherwise. Here’s what I found: • The server responds with Server: nginx and X-Powered-By: PHP/8.4.26. • My differential fingerprinting scanner independently confirmed at least PHP 8.2+ • Hypotheses: I considered two possible setups: ◦ nginx → PHP-FPM ◦ nginx → Apache → PHP-FPM/mod_php • After comparing the server's behavior against local test environments, the closest match appears to be nginx → PHP cli-server. Plot twist: the response behavior is consistent with the PHP cli-server serving a static index.html rather than an index.php. If that's indeed the case, the challenge appears to be intentionally made unexploitable. My conclusion (for now) is that I'm questioning whether this is a good-faith challenge. Happy to be corrected if I've missed something!

GreyNoise is monitoring exploitation attempts against #php2shell (CVE-2026-109618 and CVE-2026-109619). On 28 Oct 2026, 05:14:01 UTC we observed the first successful exploitation of php2shell against a vulnerable GreyNoise sensor. "We’re seeing successful exploitation of these CVEs, but the conditions make it difficult for a threat actor to scale. Fifty different servers in various configurations can be vulnerable to these CVEs, but the same exploit may not work universally against all of them. Actors need to tailor their exploit for each respective configuration which makes mass exploitation challenging." - @ImposeCost, SVP of Adversary Operations at GreyNoise This live activity report is derived from GreyNoise data and updates as we observe new activity:

Closing out #php2shell: a universal black-box PoC for PHP's session upload-progress bug. One pure-HTTP chain - arm the allocator, spray fake refs, leak the heap, beat ASLR, turn a destructor into system(). Verified blind on Debian 13 PHP 8.4.24, x86-64 + arm64: RCE as www-data.

🚨 Palo Alto Networks confirms active attacks exploiting PHP2Shell flaws in internet-exposed PAN-OS management interfaces. The flaws allow unauthenticated remote code execution. Multiple PAN-OS versions are affected, with some fixes still pending. Read ↓

FYI I've not seen any proof of an in the wild victim exists for #PHP2SHELL I've seen claims but zero proof. That doesn't mean it hasn't occurred.... I believe it WILL OCCUR to a level (I don't believe this will be a major internet/world ending event, I even blogged last week on why I don't, and I bloody hate having to do that!) But that aside... keep patching, config hardening, improving! remember back ports exist! you can be running version x.y.z and if it's back ported it it will have the fixes. 618/619) and the other CVE needs a config change! I feel this weeks been insane! not totally unlike weeks from years ago in some respects, this is nothing new to the cyber world (thematically) except this week we've had the MOST batshit insane: > AI SLOP > AI POC SLOP > AI Analysis ----- what has gone well: > Notification on Tuesday (due to the leak) > Great work getting patches out early > Great work on initial assessments >> this part is hard, but I think Wednesdays morning/day the analysis was reasonably ok (I won't say good till a few weeks time at least) > Good comms and intel sharing > Good response from community people who use science not FUD > Patching (hard to tell, but me and friends all went to work fast and the vibe I've got from people (ignoring vendor % claims because I think they are wrong!) is that they have been doing the work > Research, intel, monitoring, collab... (so same as normal, the 'security' process: WORKS!) what has been insane: > AI SLOP everywhere > THE FUD.. has been ridiculous > The HYPE has been insane > The wrong analysis (at least one vendor got it wrong, then at least said later, we got it wrong, kudos for being honest!) ------ and probably more ------- the insane part has been exhausting, the insane parts I believe are MORE of a THREAT than the actual technical exploitation parts! Bad intel, bad decision making, bad investments, bad prioritisation etc. is something that can create NATSEC risks etc. (let alone org specific risks!) ==== ok back to the pews! I've got to travel today so I'm probably going to be quiet on this mostly. Other than monitoring the sizzle (unless I'm driving!) Thanks to friends far and wide! This is a team sport, the madness doesn't help, cool, calm heads do!

CVE volume in 2026 has been wild. We're already at more than double last year's total, and October alone added roughly 17,000. If assume compromise isn’t already part of your threat model, now is the time to add it. Look at the last few bugs. PHP2Shell gave unauthenticated remote code execution in PHP core and hit a big chunk of the web. Exploitation attempts started before a patch was even public, and plenty of sites went offline while everyone tried to work out what was actually affected. HTTP2Shell started life as a Node.js issue, then turned out to be a Brotli decoder bug, so it kept spreading into other software. Its name changed, its scope kept growing, and attempts to exploit it int he wild showed up almost straight away. CVE-2026-98432, a 9.8 Linux kernel TCP use-after-free, gave attackers a remote path to memory corruption. Researchers showed remote root in the lab under certain conditions, and exploit material spread while some distro's were still catching up on patches. Public communication on all three was poor and it's increasingly becoming the norm for adversaries to have PoCs running against edge systems well before vendors and defenders can get organised. None of this should surprise anyone, because it’s how nature works. A predator picks the moment, picks the target and makes the first move. Prey only gets to react. A hawk needs just one opening in a field full of mice, while every mouse has to be watching all the time. Security plays out the same way. Attackers need one exposed edge and one unpatched window. Defenders have to cover everything, all the time, and coordinate a whole community while they do it. That imbalance is built in, and faster patching alone won’t close it. In nature, the prey that survives is the prey that notices fast and moves faster. When that isn’t possible, it develops ways to confuse the hunter or turn its skills against it, through camouflage and a range of chemical and behavioral tricks. Survival comes down to sensing the threat early and making the attack harder to land. I keep seeing endpoint detection rolled out to internal servers and user laptops while internet-facing systems get thin coverage. Part of that is speed. Edge services, containers and autoscaling workloads get spun up, redeployed and torn down faster than security tooling gets added to them. A container might live for hours. An image gets rebuilt every release without the sensor baked in. Load balancers, VPN appliances and managed gateways often can't run an agent at all. So the most exposed and most fluid part of the environment ends up being the part nobody is watching. Repeating what @trailofbits has said on this - assume your edge will be compromised at some point and build detection into how it gets deployed.

php2shell is one of the most impactful bugs in recent times, yet threat actors aren’t mass exploiting it the bug is so complex that even porting the exploit between targets takes serious skill, human or ai so i benchmarked how well open and frontier models can do it. 🧵

Bitcoin reward offered to anyone who could break into an unpatched server running PHP, hacker cracks site and claims bounty — PHP2Shell challenge tested claims that AI makes exploiting vulnerabilities easy | Tom's Hardware

PHP2Shell One Week Later: Honeypot Shells on the Web, a Path to Root on Palo Alto Firewalls One week after the #php2shell patch, around 25 internet-facing #PaloAlto firewalls have been rooted, the first confirmed production compromises. On the open internet, the same bug is still only landing shells on honeypots. We pivoted from the public exploitation reports into our AttackCapture open-directory data to see who is running it. What we found: - ~25 internet-facing Palo Alto PAN-OS firewalls rooted, the first confirmed production compromises. Reported by Dream Research, verified by Unit 42, matched in operator logs we captured. - The chain is two bugs: php2shell lands as nobody on the PAN-OS management interface, then a kernel bug (Fragnesia, CVE-2026-46300) escalates to root. - On the open web, watchTowr, 0x4D31, and GreyNoise see shells only on honeypots. Wiz and CrowdStrike found none. - 616 php2shell files across live open directories: a shared ASLR-bypass kit byte-identical across four hosts, a custom heap exploit with a log cleaner, and cloned PoCs. - One operator handed the exploit research to an AI assistant and left the session log exposed. Full research, IOCs, and detection guidance 👇

Patch now: PHP2Shell, Brotli, and eMudhra guidance for customers

PHP2Shell, a Brotli decoder vulnerability, and the eMudhra certificate authority key issue each require attention. Microsoft is updating the services it operates and releasing fixes for affected products. Customers should review the issue-by-issue guidance for updates and actions in environments they manage:

Can't patch PHP2Shell yet? Here's how to build a stopgap with the controls you own. PHP2Shell comes with a clear instruction: update PHP. But patching at this scale still takes time. In Qualys telemetry, only 199,000 of the 156 million PHP package installations with a known version (about 0.13%) had been patched in the first 12 hours after disclosure. Here is how to bridge the gap between disclosure and patch, in four steps: 1. Find and Prioritize Exposed PHP 2. Apply the Qualys Mitigation 3. Add Layers from the Security Stack you already run 4. Patch, Restart, and Re-Validate Learn more and don't forget to access our free PHP2Shell service to help product your environment against this threat: #PHP2Shell

StealMyBitcoin is solved! This is the absolute best explanation you’ll see on how hard #php2shell is to exploit. The author had to trigger a precise memory corruption condition, leak internal memory addresses, bypass aslr, reverse engineer php’s internal memory structures, forge structures to hijack execution, and account for php build differences, worker behavior and timing to get RCE. 20 http requests with a 7 out of 10 success rate. What an amazingly successful CTF. Impressive the creator was able to keep the server up during all the attempts. With all the BS around it’s nice to see something concrete that moves the art forward.

Love this. The💰is still in the wallet. Finally we get some ground truth around how hard php2shell is to exploit. The amount of bullshit flying around from vendors capitalizing on the moment is staggering, And the alert fatigue they’re creating is really going to hurt when a mass exploitable RCE emerges. We still haven’t seen a production site hacked via #php2shell at Wordfence.

Php2shell-scanner Tool for scanning php2shell using 3 methods: via URL, localhost, SSH