PHP2Shell and Node2Shell: The Complete Guide

PHP2Shell and Node2Shell are separate security problems patched on 21 October 2026. PHP2Shell covers two remote code execution flaws in PHP; Node2Shell, also called HTTP2Shell, is a memory-corruption flaw in the Brotli decoder used by Node.js and other software.⁠¹⁠² Both are confirmed as exploited. Update the affected runtime, restart it, then check whether anything happened before the patch.

Last verified: 4 November 2026

Start here: what should you do?

Do today

1. Check which PHP or Node.js runtime serves your application, including copies inside containers and hosting platforms.
2. Patch to the applicable fixed release or verified vendor-backported package, then restart the workers.
3. Investigate suspicious activity if the vulnerable service was publicly reachable before the fix.

For WordPress or shared hosting, start with checking your site's exposure, then the WordPress-specific risks and whether your host has patched PHP.

For Node.js, use the Node.js update guide. If you cannot patch today, go to the PHP workarounds or Express's temporary controls.

Do this week

Audit containers, bundled libraries and services that fetch data from external servers. Review what your WAF does and doesn't protect and what your logs can reveal.

Can wait

Defer unrelated framework migrations and replacing a working web server. Fix the affected component first.

All 19 guides, by what you run

Start with the news

• CVE-2026-115560: The Third PHP Flaw, Explained — The separate session-upload-progress issue.
• The 25-Server Firewall Campaign — The reported attack chain and what independent researchers confirmed.

WordPress and shared hosting

• How to Check Whether Your Website Is Vulnerable — Identify the PHP actually serving your site.
• WordPress and PHP2Shell — Why a WordPress update alone is insufficient.
• Is Your Web Host Patched? — Verify what your provider has installed.

PHP servers and containers

• How to Patch PHP2Shell on Linux — PHP-FPM, Apache and package updates.
• PHP2Shell in Docker, FrankenPHP and PaaS — Which runtime copy needs replacing.

Can't patch yet

• PHP2Shell Workarounds for Older PHP — Temporary controls and their limits.
• Disabling PHP Upload Progress: What It Covers — One setting, two possible mitigations, and what breaks.
• Does Cloudflare or a WAF Protect You? — Edge filtering versus actual patching.

Tools and checks

• PHP2Shell Scanner and Free Checkers — What a non-invasive check can establish.

Node.js and Brotli

• How to Check and Update Node.js — Find the runtime and verify the fix.
• Node.js 18, 20 and 25: No Upstream Fix — What to do on unsupported lines.
• HTTP2Shell Beyond Node.js — Python, .NET, Bun and bundled decoders.
• Express 5 and body-parser Mitigation — Reduce inbound exposure while patching.
• Are nginx and Apache Affected? — Compression versus vulnerable decompression.
• Node.js October Security Release: All 10 CVEs — The other fixes in the same release.

Detection and response

• Hacked After PHP2Shell or Node2Shell? — Evidence preservation and recovery.
• How to Detect PHP2Shell and Node2Shell — Logs, process events and alerts.

What is confirmed, and what isn't?

There are four evidence levels: vulnerability confirmed, exploit demonstrated, exploitation observed and breach confirmed. Do not treat them as interchangeable.

PHP2Shell: Both vulnerabilities are confirmed, working exploitation has been demonstrated, and CISA records exploitation in the wild.⁠¹⁠³ On 29 October, Unit 42 said it independently verified the attacker's tooling and results in Dream Research's reported firewall campaign. Dream reports 25 compromised servers; that count remains attributed to Dream, while the exploitation findings have independent corroboration.⁠⁵⁠⁶ Claims about the attacker's nationality or AI-assisted development are not established attribution.

Node2Shell: The Brotli flaw is confirmed, Imperva demonstrated exploitation under tested configurations, and CISA lists exploitation.⁠³⁠⁷ The sources reviewed here do not establish a publicly named compromised organization. That does not mean no compromise occurred.

CVE-2026-115560: PHP published an informational advisory and a temporary mitigation. The sources reviewed do not establish exploitation in the wild.⁠¹