[{"data":1,"prerenderedAt":1474},["ShallowReactive",2],{"post-en-node2shell-warum-node-patchen-nicht-reicht":3,"related-en-node2shell-warum-node-patchen-nicht-reicht":396},{"id":4,"title":5,"author":6,"body":7,"category":366,"date":367,"description":368,"draft":369,"extension":370,"faq":371,"image":381,"imageAlt":382,"lang":383,"legacyUrl":384,"meta":385,"navigation":386,"path":387,"readingTime":388,"seo":389,"sitemap":390,"stem":391,"tags":392,"translation":394,"updated":384,"__hash__":395},"insightsEn\u002Fen\u002Finsights\u002Fnode2shell-warum-node-patchen-nicht-reicht.md","Node2Shell: why patching Node alone is not enough","blacklens.io Team",{"type":8,"value":9,"toc":355},"minimark",[10,19,24,36,49,53,64,79,83,94,141,156,160,181,269,273,276,330,334,352],[11,12,13,14,18],"p",{},"Node.js published security updates for ten vulnerabilities on 21 October 2026. The most severe, ",[15,16,17],"code",{},"CVE-2026-111497",", allows remote code execution through crafted Brotli data. But the faulty code is not in Node.js. It is in the compression library Node.js bundles – and that decides whether an updated Node version closes the hole at all.",[20,21,23],"h2",{"id":22},"what-node2shell-is","What Node2Shell is",[11,25,26,27,29,30,35],{},"Node2Shell is the name Imperva gave its 22 October analysis of ",[15,28,17],{},": an out-of-bounds write in the Brotli decoder that Node.js bundles in its 22.x, 24.x and 26.x lines. Node.js rates the flaw \"high\" and fixed it on 21 October. The CVE record is harsher: ",[31,32,34],"a",{"href":33},"\u002Fen\u002Fwissen\u002Fcvss","CVSS"," 9.2 under version 4.0, severity critical. Khai Tran and Sylvie Mayer of OpenAI Codex Security reported it; two members of the Node.js team wrote the fix.",[11,37,38,39,43,44,48],{},"The flaw landed on the same day as ",[31,40,42],{"href":41},"\u002Fen\u002Finsights\u002Fphp2shell-kritische-rce-lucken-in-php","PHP2Shell",", with the same score. Who reported them is worth noting: OpenAI researchers were among the reporters at PHP, and here it is that company's Codex Security team. The advisories do not say how much of this came from AI tooling – but AI vendors' security teams appearing in the acknowledgements has been routine since ",[31,45,47],{"href":46},"\u002Fen\u002Finsights\u002Fclaude-mythos-wenn-schwachstellen-schneller-kommen-als-patches","April",".",[20,50,52],{"id":51},"the-bug-is-in-brotli-not-in-nodejs","The bug is in Brotli, not in Node.js",[11,54,55,56,59,60,63],{},"The vulnerable code sits in the reference implementation of Brotli, Google's compression format, in ",[15,57,58],{},"c\u002Fdec\u002Fdecode.c",". While decompressing, the decoder checks whether a stream switches to a different block type. When that check reported an error, the responsible function did not pass it on along the fast decoding path: its callers had no return value for it. The decoder carried on with invalid internal state and wrote past its intended buffer. The CVE record files this as ",[15,61,62],{},"CWE-252",", unchecked return value. The fix makes those functions return a format error and aborts the stream.",[11,65,66,67,70,71,74,75,78],{},"What matters for the reach is the version range in the CVE record: Brotli releases 1.0.3 through 1.2.0 are affected \"on all platforms\", and what needs updating is \"any Brotli libraries or binaries\". The fixed releases are ",[15,68,69],{},"1.0.10",", ",[15,72,73],{},"1.1.1"," and ",[15,76,77],{},"1.2.1",", all published on 21 October. Node.js is the best-known consumer of that library, not the only one.",[20,80,82],{"id":81},"the-decoder-is-reachable-without-brotli-in-your-code","The decoder is reachable without Brotli in your code",[11,84,85,86,89,90,93],{},"An application does not have to call Brotli anywhere to reach the decoder. Imperva names three routes in: a direct call through ",[15,87,88],{},"node:zlib",", Node's built-in ",[15,91,92],{},"fetch()",", which decompresses a Brotli response by itself, and the request parsers in Express 5.",[11,95,96,97,70,100,70,103,74,106,109,110,113,114,70,117,70,120,74,123,126,127,130,131,134,135,137,138,140],{},"The third route widens the attack surface most. The Express 5 migration guide lists Brotli decompression as an improvement that needs no migration step: ",[15,98,99],{},"express.json()",[15,101,102],{},"express.urlencoded()",[15,104,105],{},"express.text()",[15,107,108],{},"express.raw()"," accept ",[15,111,112],{},"Content-Encoding: br",". body-parser documents that all parsers support \"automatic inflation\" of ",[15,115,116],{},"gzip",[15,118,119],{},"br",[15,121,122],{},"deflate",[15,124,125],{},"zstd","; the only option documented for it is ",[15,128,129],{},"inflate",", default ",[15,132,133],{},"true",". No switch for Brotli alone is documented. An application using ",[15,136,99],{}," that does not turn ",[15,139,129],{}," off therefore accepts Brotli bodies without that being visible in its own code. A bare HTTP server in Node, by contrast, does not decode incoming Brotli bodies merely by receiving them.",[11,142,143,144,147,148,151,152,48],{},"Imperva took this route to code execution: in the official Node image ",[15,145,146],{},"24.22.0"," for Linux\u002Farm64, a Brotli message created a file the test application had no code to create – with no debugger, but not on every attempt. ",[15,149,150],{},"24.22.1"," rejected the same inputs. That is the only public demonstration so far. Neither Node.js nor Imperva reports attacks in the wild, and as of 23 October the flaw is not in the ",[31,153,155],{"href":154},"\u002Fen\u002Fwissen\u002Fcisa-kev","CISA KEV catalogue",[20,157,159],{"id":158},"why-a-patched-node-version-is-not-enough","Why a patched Node version is not enough",[11,161,162,163,166,167,169,170,173,174,177,178,180],{},"Whether ",[15,164,165],{},"node -v"," shows a corrected release settles the question only where Node uses its own Brotli code. Debian's package does not. Its security tracker notes on ",[15,168,17],{}," that ",[15,171,172],{},"nodejs"," uses the system-provided Brotli library, and lists both packages accordingly: ",[15,175,176],{},"brotli"," in Bookworm, Trixie and Sid as \"vulnerable\", with \"(unfixed)\" as the fixed version, and ",[15,179,172],{}," at urgency \"unimportant\". On those systems only the Brotli package closes the hole, and on 23 October it was not available there.",[182,183,184,200],"table",{},[185,186,187],"thead",{},[188,189,190,194,197],"tr",{},[191,192,193],"th",{},"Component",[191,195,196],{},"Fixed release",[191,198,199],{},"Note",[201,202,203,217,229,242,253],"tbody",{},[188,204,205,209,214],{},[206,207,208],"td",{},"Node.js 26.x",[206,210,211],{},[15,212,213],{},"26.12.1",[206,215,216],{},"current line",[188,218,219,222,226],{},[206,220,221],{},"Node.js 24.x",[206,223,224],{},[15,225,150],{},[206,227,228],{},"current LTS",[188,230,231,234,239],{},[206,232,233],{},"Node.js 22.x",[206,235,236],{},[15,237,238],{},"22.23.4",[206,240,241],{},"LTS",[188,243,244,247,250],{},[206,245,246],{},"Node.js 20.x and older",[206,248,249],{},"no fix",[206,251,252],{},"end of life, always affected per the advisory",[188,254,255,258,266],{},[206,256,257],{},"Brotli library",[206,259,260,70,262,70,264],{},[15,261,69],{},[15,263,73],{},[15,265,77],{},[206,267,268],{},"decisive where Node uses the system library",[20,270,272],{"id":271},"what-to-do-now","What to do now",[11,274,275],{},"These steps differ from an ordinary update in one respect: the Node version alone does not decide the exposure.",[277,278,279,287,297,303,318,324],"ul",{},[280,281,282,286],"li",{},[283,284,285],"strong",{},"Update the runtimes"," and restart the processes afterwards. A running process keeps the old decoder in memory.",[280,288,289,292,293,296],{},[283,290,291],{},"Check the Brotli library as well"," wherever Node comes from a distribution package. There, ",[15,294,295],{},"libbrotli"," is the binding version, not Node's.",[280,298,299,302],{},[283,300,301],{},"Check every image individually",", not just the host. Version numbers go stale fastest in container images and appliances with a built-in runtime; a host package list does not show them.",[280,304,305,308,309,312,313,74,315,317],{},[283,306,307],{},"Limit Brotli traffic from unknown sources"," while the update waits. ",[15,310,311],{},"inflate: false"," rejects ",[15,314,116],{},[15,316,122],{}," too and may break existing clients; a limit on the affected paths, at the web server or in the web application firewall, is the narrower cut.",[280,319,320,323],{},[283,321,322],{},"Do not lose sight of the other nine flaws."," The 21 October release fixes ten CVEs, three more of them rated \"high\": truncated DNS names containing a NUL character, and two bypasses of the TLS hostname check.",[280,325,326,329],{},[283,327,328],{},"Do not read decoder errors as proof."," Crashed processes and decoder errors on their own are not a reliable sign of an attack, as Imperva points out. They carry weight only together with the release actually deployed and the origin of the compressed data.",[20,331,333],{"id":332},"what-helps-and-why-visibility-decides","What helps – and why visibility decides",[11,335,336,337,341,342,346,347,351],{},"The question on the day of an update like this is not how to update Node.js, but where a runtime is running at all. Through ",[31,338,340],{"href":339},"\u002Fen\u002Fplatform\u002Fattack-surface-management","Attack Surface Management",", blacklens.io continuously discovers from the outside which services and web applications are reachable and which technologies, in which versions, run on them; internal systems are covered by the ",[31,343,345],{"href":344},"\u002Fen\u002Fplatform\u002Fsentry","Sentry Agent",". The ",[31,348,350],{"href":349},"\u002Fen\u002Fplatform\u002Femerging-threats","Threat Center"," matches new CVEs against that inventory in real time and shows whether a hit rests on the exact version or only on the product.",[11,353,354],{},"One limit belongs in the picture: which Brotli library a Node process has loaded is not something any service reveals from the outside. That check stays on the system – which systems it applies to can be answered beforehand.",{"title":356,"searchDepth":357,"depth":357,"links":358},"",3,[359,361,362,363,364,365],{"id":22,"depth":360,"text":23},2,{"id":51,"depth":360,"text":52},{"id":81,"depth":360,"text":82},{"id":158,"depth":360,"text":159},{"id":271,"depth":360,"text":272},{"id":332,"depth":360,"text":333},"threat","2026-10-23","Node2Shell exploits a flaw in the Brotli decoder that Node.js bundles. The fix ships in Node 22.23.4, 24.22.1 and 26.12.1 – and in Brotli itself.",false,"md",[372,375,378],{"q":373,"a":374},"What is Node2Shell?","Node2Shell is the name the security firm Imperva gave its analysis of CVE-2026-111497, an out-of-bounds write in the Brotli decoder that Node.js bundles. An attacker who can send crafted Brotli data to an application that decompresses it can overwrite memory and, in the end, run their own code. Node.js fixed the flaw on 21 October 2026; the CVE record rates it CVSS 9.2 under version 4.0.",{"q":376,"a":377},"Which versions close CVE-2026-111497?","Node.js ships the fix in 22.23.4, 24.22.1 and 26.12.1; the 20.x line and older are end of life and will not receive it. The faulty code comes from the Brotli library, however, which is fixed in 1.0.10, 1.1.1 and 1.2.1. Where Node uses the system Brotli library, as the Debian package does, that library's version decides the matter, not the output of node -v.",{"q":379,"a":380},"Is my application affected if it does not use Brotli?","Possibly, yes. The decoder is also reached without Brotli appearing anywhere in your own source. Node's built-in fetch() decompresses Brotli responses by itself, and the request parsers in Express 5 and body-parser 2 accept Brotli bodies as long as the inflate option sits at its default of true. A bare Node HTTP server, according to Imperva, does not decode incoming Brotli bodies merely by receiving them.","\u002Fimages\u002Finsights\u002Fnode2shell-warum-node-patchen-nicht-reicht.webp","Brightly coloured lines of source code on a dark screen, photographed at an angle","en",null,{},true,"\u002Fen\u002Finsights\u002Fnode2shell-warum-node-patchen-nicht-reicht",5,{"title":5,"description":368},{"loc":387},"en\u002Finsights\u002Fnode2shell-warum-node-patchen-nicht-reicht",[393],"Threat landscape","node2shell-warum-node-patchen-nicht-reicht","MY95xozGQLILY3-yExOH83xtPhR8cwgCdVOJwLDdQGU",[397,665,895],{"id":398,"title":399,"author":6,"body":400,"category":366,"date":643,"description":644,"draft":369,"extension":370,"faq":645,"image":655,"imageAlt":656,"lang":383,"legacyUrl":384,"meta":657,"navigation":386,"path":658,"readingTime":388,"seo":659,"sitemap":660,"stem":661,"tags":662,"translation":663,"updated":384,"__hash__":664},"insightsEn\u002Fen\u002Finsights\u002Ffortinet-hardening-release-patchen-ohne-advisory.md","Fortinet hardening release: patching without an advisory",{"type":8,"value":401,"toc":634},[402,405,409,419,494,513,517,520,533,537,543,546,550,553,561,563,566,592,595,599,614,616,628],[11,403,404],{},"Fortinet is shipping security updates for FortiOS, FortiManager and FortiAnalyzer on 22 October 2026, a day after FortiMail and FortiAuthenticator. Rated critical and high severity — but with no CVE id, no CVSS score and no description of the attack. The advisories only follow on 10 November. Anyone patching this week is closing holes they cannot name.",[20,406,408],{"id":407},"what-fortinet-shipped-on-22-october","What Fortinet shipped on 22 October",[11,410,411,412,418],{},"The security hardening release is a bundled set of security updates for five product lines, announced on 21 October 2026 by Fortinet CISO Carl Windsor on ",[31,413,417],{"href":414,"rel":415},"https:\u002F\u002Fwww.fortinet.com\u002Fblog\u002Fciso-collective\u002Ffortinet-releases-security-hardening-release-for-multiple-products",[416],"nofollow","Fortinet's CISO blog",". On the contents, one sentence: \"These releases include critical and high-severity fixes.\"",[182,420,421,434],{},[185,422,423],{},[188,424,425,428,431],{},[191,426,427],{},"Branch",[191,429,430],{},"FortiOS",[191,432,433],{},"FortiManager and FortiAnalyzer",[201,435,436,450,464,479],{},[188,437,438,441,446],{},[206,439,440],{},"8.0",[206,442,443],{},[15,444,445],{},"8.0.2",[206,447,448],{},[15,449,445],{},[188,451,452,455,460],{},[206,453,454],{},"7.6",[206,456,457],{},[15,458,459],{},"7.6.8",[206,461,462],{},[15,463,459],{},[188,465,466,469,474],{},[206,467,468],{},"7.4",[206,470,471],{},[15,472,473],{},"7.4.13",[206,475,476],{},[15,477,478],{},"7.4.12",[188,480,481,484,489],{},[206,482,483],{},"7.2",[206,485,486],{},[15,487,488],{},"7.2.14",[206,490,491],{},[15,492,493],{},"7.2.13",[11,495,496,497,70,499,74,502,505,506,74,509,512],{},"Everything below each fixed version is affected. FortiMail is fixed in ",[15,498,445],{},[15,500,501],{},"7.6.7",[15,503,504],{},"7.4.9",", FortiAuthenticator in ",[15,507,508],{},"8.0.4",[15,510,511],{},"6.6.11","; FortiMail 7.2 gets no fix and has to move to the 7.4 branch. Fortinet updates FortiSASE itself, while FortiManager Cloud may need a manual step.",[20,514,516],{"id":515},"why-there-are-no-cve-ids","Why there are no CVE ids",[11,518,519],{},"The advisories only appear at the next Patch Tuesday, 10 November, on the advisory page of Fortinet's Product Security Incident Response Team — part of an \"ongoing commitment to responsible transparency while balancing customer security\".",[11,521,522,523,528,529,532],{},"The origin of the flaws explains the bundling: not outside researchers, but Fortinet's own AI-assisted testing programme, with thanks to Anthropic, OpenAI, Google and SpaceX for the collaboration. Windsor ",[31,524,527],{"href":525,"rel":526},"https:\u002F\u002Fwww.fortinet.com\u002Fblog\u002Fciso-collective\u002Fupdate-on-fortinet-use-of-frontier-ai",[416],"described the process in June 2026",": frontier models review the source code against a threat model of the firmware built beforehand; what survives is validated in penetration testing. Of the source-code findings from more than 100 tests across 30 product families, 40 per cent were true positives and 30 per cent false positives. What ",[31,530,531],{"href":46},"Claude Mythos"," sketched out in April now arrives as a firmware update.",[20,534,536],{"id":535},"a-patch-without-a-cve-id-is-invisible-to-scanners-and-policies","A patch without a CVE id is invisible to scanners and policies",[11,538,539,540,542],{},"Vulnerability scanners, patch policies and ticket systems all work from CVE ids. Without the id, everything attached to it is missing too: no NVD entry, no EPSS score, no entry in the ",[31,541,155],{"href":154},", no CVSS score for a patch policy to trigger on. A change request that normally draws its justification from a CVE id and a severity rating has nothing but the vendor announcement for 19 days.",[11,544,545],{},"The question shifts: no longer which CVE affects us, but which version runs on which reachable device, and whether it is older than the fixed one. The risk assessment loses its basis too: nothing can be said about attack prerequisites or exploitability before 10 November. What remains is reachability from outside: a FortiManager sitting on the internet is the problem, with or without a CVE id.",[20,547,549],{"id":548},"patch-diffing-the-clock-starts-at-release","Patch diffing: the clock starts at release",[11,551,552],{},"The head start withholding the advisories is meant to create applies only to readers, not to attackers who compare. Fortinet names the risk itself: once the update is public, the fix shows where the code changed. Per the June post, this is exactly what the models excel at — \"analyzing firmware, assessing changes between versions, and developing proof-of-concept exploits\". Fortinet expects exploits in hours or days rather than weeks; the FortiGuard 2026 report puts time to exploit for critical outbreaks at 24 to 48 hours, down from 4.76 days on average in 2024.",[11,554,555,556,560],{},"That Fortinet devices are a preferred target is on record: the CISA KEV catalogue held 32 entries for Fortinet products as of 21 October 2026, two of them added this month. ",[31,557,559],{"href":558},"\u002Fen\u002Finsights\u002Ffortibleed-wenn-zehntausende-firewalls-zur-offenen-tur-werden","FortiBleed"," showed how methodically attackers work through exposed management interfaces. No exploitation is known for the flaws in this release; Fortinet calls the fixes pre-emptive.",[20,562,272],{"id":271},[11,564,565],{},"Fortinet recommends treating the release as a priority change rather than routine maintenance, and names four steps:",[277,567,568,574,580,586],{},[280,569,570,573],{},[283,571,572],{},"Inventory:"," identify every FortiManager installation and FortiOS instance, internet-facing ones first.",[280,575,576,579],{},[283,577,578],{},"Maintenance windows:"," schedule 22 and 23 October for exposed systems.",[280,581,582,585],{},[283,583,584],{},"Back up configurations:"," before the upgrade, not after.",[280,587,588,591],{},[283,589,590],{},"Check logs:"," for unusual administrative access and unapproved configuration changes, before and after patching.",[11,593,594],{},"Where an immediate upgrade is not possible: restrict management access over HTTPS and SSH to trusted addresses, keep FortiManager off the internet entirely, and enforce MFA on every administrator account. Fortinet on that: \"These steps reduce risk but do not replace the need for a timely upgrade.\"",[20,596,598],{"id":597},"not-to-be-confused-php2shell-runs-in-parallel","Not to be confused: PHP2Shell runs in parallel",[11,600,601,602,605,606,609,610,613],{},"The two PHP flaws from 21 October are not part of this release. Fortinet tracks them separately in advisory ",[15,603,604],{},"FG-IR-26-186"," and rates ",[15,607,608],{},"CVE-2026-109618"," critical at CVSS 9.8 there. According to an overview by Help Net Security on 22 October, Fortinet lists twelve products as not affected, among them FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiWeb, and twelve more as under review. Palo Alto Networks reports PAN-OS and Panorama as affected in all versions, still without a fix. Mechanism and immediate measures are in our ",[31,611,612],{"href":41},"PHP2Shell post",". Fortinet operators are running two separate patch tracks.",[20,615,333],{"id":332},[11,617,618,619,621,622,624,625,627],{},"As long as the CVE ids are missing, the version inventory is the only solid basis. Through ",[31,620,340],{"href":339},", blacklens.io records from the outside which services are reachable and which technologies run on them in which version; the inventory filters by vendor and product, and the ",[31,623,345],{"href":344}," covers internal installations. That answers the question that matters this week: where is a version older than ",[15,626,459],{}," running, and is it reachable from the internet?",[11,629,630,631,633],{},"The ",[31,632,350],{"href":349}," matches new CVEs against that inventory in real time and shows whether a hit rests on the exact version or only on the product — for this release that starts on 10 November, because before then there are no ids to match. This week the release is an inventory question. The vulnerability question arrives in November.",{"title":356,"searchDepth":357,"depth":357,"links":635},[636,637,638,639,640,641,642],{"id":407,"depth":360,"text":408},{"id":515,"depth":360,"text":516},{"id":535,"depth":360,"text":536},{"id":548,"depth":360,"text":549},{"id":271,"depth":360,"text":272},{"id":597,"depth":360,"text":598},{"id":332,"depth":360,"text":333},"2026-10-22","Fortinet shipped critical fixes for FortiOS, FortiManager and FortiAnalyzer on 22 October 2026. The advisories with CVE ids only follow on 10 November.",[646,649,652],{"q":647,"a":648},"What is Fortinet's October 2026 security hardening release?","The security hardening release is a bundled set of security updates that Fortinet shipped on 21 and 22 October 2026 for FortiMail, FortiAuthenticator, FortiOS, FortiManager and FortiAnalyzer. Fortinet rates the fixed flaws critical and high severity, but publishes no CVE ids, no CVSS scores and no attack prerequisites for now. The advisories are announced for 10 November 2026. The flaws came out of Fortinet's own AI-assisted testing programme.",{"q":650,"a":651},"Which Fortinet versions fix the vulnerabilities?","According to Fortinet's announcement the fixes ship in FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14, and in FortiManager and FortiAnalyzer 8.0.2, 7.6.8, 7.4.12 and 7.2.13. FortiMail is fixed in 8.0.2, 7.6.7 and 7.4.9, FortiAuthenticator in 8.0.4 and 6.6.11. FortiMail 7.2 gets no fix and has to move to the 7.4 branch. Fortinet updates FortiSASE itself; FortiManager Cloud may need a manual step.",{"q":653,"a":654},"Why is a patch without a CVE id a problem for vulnerability scanners?","A patch without a CVE id stays invisible to everything that steers vulnerabilities by CVE id: vulnerability scanners, patch policies, ticket systems. Without the id there is no NVD entry, no EPSS score, no CISA KEV status and no CVSS score for a patch policy to trigger on. Until the advisories appear, only the version comparison is left: which Fortinet version runs on which reachable system? A continuously updated technology inventory answers that question.","\u002Fimages\u002Finsights\u002Ffortinet-hardening-release-patchen-ohne-advisory.webp","Tablet showing the Fortinet website in front of a blurred monitor displaying source code",{},"\u002Fen\u002Finsights\u002Ffortinet-hardening-release-patchen-ohne-advisory",{"title":399,"description":644},{"loc":658},"en\u002Finsights\u002Ffortinet-hardening-release-patchen-ohne-advisory",[393],"fortinet-hardening-release-patchen-ohne-advisory","QyzVByPDaT-j8SlgBQrV6xv8fCW8Qn5_n4hTJ6WGhm8",{"id":666,"title":667,"author":6,"body":668,"category":366,"date":643,"description":874,"draft":369,"extension":370,"faq":875,"image":885,"imageAlt":886,"lang":383,"legacyUrl":384,"meta":887,"navigation":386,"path":888,"readingTime":388,"seo":889,"sitemap":890,"stem":891,"tags":892,"translation":893,"updated":384,"__hash__":894},"insightsEn\u002Fen\u002Finsights\u002Fphp2shell-angriffe-vor-dem-patch.md","PHP2Shell: the attacks began four days before the patch",{"type":8,"value":669,"toc":867},[670,673,677,686,692,696,705,767,770,774,777,783,787,790,838,847,850,853,856],[11,671,672],{},"Four days before PHP disclosed the two flaws, the first exploitation attempt was running. Amazon Threat Intelligence found it in the telemetry of its MadPot honeypot network, dated 17 October 2026. Close PHP2Shell the moment the version number is right and you have checked four days too few.",[20,674,676],{"id":675},"what-amazon-saw-before-disclosure","What Amazon saw before disclosure",[11,678,679,680,685],{},"Amazon Threat Intelligence published on 21 October that the earliest PHP2Shell exploitation attempt in its ",[31,681,684],{"href":682,"rel":683},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fsecurity\u002Famazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot\u002F",[416],"MadPot telemetry"," dates to 17 October 2026 — four days before disclosure, three days before the leak. The request came from a commercial anonymisation network and hit a honeypot, which Amazon reads as a sign of a threat actor rather than research. How the actor obtained exploit information beforehand is unclear.",[11,687,688,689,48],{},"From 02:00 UTC on 21 October, twelve hours before the 14:00 UTC release, MadPot saw several proof-of-concept exploits from further anonymised infrastructure. Payloads and origins differed, which points to several independent actors; whether any would have worked against real systems is left open. CJ Moses, CISO of Amazon Integrated Security, sums up the state after the release: \"PHP2Shell is now being broadly exploited in the wild.\" Mechanism, fixed versions and interim measures are in ",[31,690,691],{"href":41},"yesterday's post",[20,693,695],{"id":694},"how-exploits-arrived-before-the-patch","How exploits arrived before the patch",[11,697,698,699,704],{},"17 October remains unexplained. The twelve hours before the release do not. The PHP Foundation laid out that chain in its ",[31,700,703],{"href":701,"rel":702},"https:\u002F\u002Fthephp.foundation\u002Fblog\u002F2026\u002F10\u002F21\u002Ftodays-php-security-release-and-how-were-strengthening-php-security\u002F",[416],"postmortem of 21 October",":",[182,706,707,717],{},[185,708,709],{},[188,710,711,714],{},[191,712,713],{},"Time (UTC)",[191,715,716],{},"Event",[201,718,719,727,735,743,751,759],{},[188,720,721,724],{},[206,722,723],{},"17 Oct",[206,725,726],{},"First exploitation attempt in Amazon's honeypot telemetry, source unknown",[188,728,729,732],{},[206,730,731],{},"20 Oct, 15:00",[206,733,734],{},"CVE numbers circulate in forums, with the wrong release time and a wrong CVSS of 10.0",[188,736,737,740],{},[206,738,739],{},"20 Oct, 20:00",[206,741,742],{},"Calif accidentally publishes a video of its own exploit",[188,744,745,748],{},[206,746,747],{},"20 Oct, 23:00",[206,749,750],{},"Mitigation guidance to critical infrastructure operators may have leaked as well",[188,752,753,756],{},[206,754,755],{},"21 Oct, 07:41",[206,757,758],{},"Chainguard publishes container images carrying the fix, six hours early",[188,760,761,764],{},[206,762,763],{},"21 Oct, 14:00",[206,765,766],{},"Coordinated release of advisories and fixed versions",[11,768,769],{},"The Foundation objects not to the early fix but to its comparability: \"Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release.\" Chainguard CEO Dan Lorenc does not dispute the timing, but he does dispute the reading: \"I made the call to get these out early when exploits hit in the wild.\" The Foundation's own security team had identified no functional public exploit by release time, and calls the delay since the first signs in 2024 \"a structural failure\".",[20,771,773],{"id":772},"status-on-22-october-millions-of-attempts-no-confirmed-breach","Status on 22 October: millions of attempts, no confirmed breach",[11,775,776],{},"No successful break-in through PHP2Shell has been confirmed. The number of attempts has. Cloudflare CEO Matthew Prince reports thousands across his network in the ten hours before the announcement, tens of thousands in the 45 minutes after, hundreds of thousands within two hours and millions by now. Cloudflare also sees attackers varying payloads and reading which requests the web application firewall blocks.",[11,778,779,780,782],{},"Volume is not success. Jake Knott of watchTowr says none of the circulating proof-of-concepts achieves code execution: they fail, measure timing differences, or crash the target process. VulnCheck saw at least one address trying, unsuccessfully, to drop a web shell. Germany's BSI states in version 1.1 of its 21 October warning that no confirmed exploitation is known so far. Neither number appears in the ",[31,781,155],{"href":154}," as of 22 October. JFrog also found fake exploits and prank malware in public repositories — test that code against your own systems and you may be testing something other than the flaw.",[20,784,786],{"id":785},"what-this-means-for-your-investigation","What this means for your investigation",[11,788,789],{},"Amazon recommends starting the investigation window on 17 October, not on patch day. In practice the first step is preserving evidence before rotation deletes it: web server logs and the process and file state of every reachable PHP system from 16 October.",[277,791,792,806,826,832],{},[280,793,794,797,798,801,802,805],{},[283,795,796],{},"Requests:"," POST requests carrying the string ",[15,799,800],{},"PHP_SESSION_UPLOAD_PROGRESS"," in ",[15,803,804],{},"multipart\u002Fform-data"," bodies, plus clusters of HTTP 500 responses and crashed PHP workers.",[280,807,808,811,812,70,815,70,818,821,822,825],{},[283,809,810],{},"Processes:"," any shell, interpreter or download tool started by ",[15,813,814],{},"php-fpm",[15,816,817],{},"php-cgi",[15,819,820],{},"httpd"," or ",[15,823,824],{},"apache2",", plus new files in the web root.",[280,827,828,831],{},[283,829,830],{},"Detection without signatures:"," Amazon recommends detections that do not depend on CVE-specific signatures — first exploitation regularly precedes the first signature.",[280,833,834,837],{},[283,835,836],{},"Indicators:"," Amazon publishes six addresses from its telemetry. They belong to shared anonymisation infrastructure and are not exclusive to this activity: a reason to investigate, not a block list.",[839,840,845],"pre",{"className":841,"code":843,"language":844},[842],"language-text","103.216.220.92     17.10.2026\n31.223.184.166     21.10.2026\n37.19.200.5        21.10.2026\n134.209.159.64     21.10.2026\n103.114.163.188    21.10.2026\n95.217.98.37       21.10.2026\n","text",[15,846,843],{"__ignoreMap":356},[11,848,849],{},"On the deadline such cases set, Amazon's driest sentence matters most: \"A 7-day or 30-day SLA assumes a delay that no longer exists.\" The reason is structural and not limited to PHP: AI-assisted analysis makes it cheaper to turn a patch diff or an advisory into a working exploit.",[20,851,852],{"id":332},"What helps — and why visibility decides",[11,854,855],{},"A deadline measured in hours assumes the inventory exists when the advisory lands. Between 17 and 21 October it was the only usable information there was.",[11,857,858,859,861,862,346,864,866],{},"blacklens.io uses ",[31,860,340],{"href":339}," to track which services and web applications are reachable from outside and which technologies run on them; internal systems are covered by the ",[31,863,345],{"href":344},[31,865,350],{"href":349}," matches new CVEs against that inventory and shows, per hit, the EPSS score, KEV membership, available exploits and whether the match rests on the exact version or only on the product. Hunting on the host itself is not part of that; logs and monitoring on the system cover it.",{"title":356,"searchDepth":357,"depth":357,"links":868},[869,870,871,872,873],{"id":675,"depth":360,"text":676},{"id":694,"depth":360,"text":695},{"id":772,"depth":360,"text":773},{"id":785,"depth":360,"text":786},{"id":332,"depth":360,"text":852},"Amazon found the first PHP2Shell exploitation attempt on 17 October 2026, four days before disclosure. That changes the window your investigation must cover.",[876,879,882],{"q":877,"a":878},"Was PHP2Shell exploited before public disclosure?","Yes, according to Amazon Threat Intelligence. The earliest exploitation attempt in the telemetry of its MadPot honeypot network dates to 17 October 2026, four days before PHP's advisory, and came from a commercial anonymisation network. How the actor obtained exploit information beforehand is unclear. Further proof-of-concept attempts followed from 02:00 UTC on 21 October, twelve hours before the release.",{"q":880,"a":881},"How far back should I hunt for compromise?","Amazon recommends taking PHP2Shell investigations back to at least 17 October 2026 rather than only to patch day. In practice that means preserving web server logs and the process and file state of every reachable PHP system from 16 October onwards, before log rotation deletes them. Look for POST requests carrying the string PHP_SESSION_UPLOAD_PROGRESS, for processes started by a PHP worker, and for new files in the web root.",{"q":883,"a":884},"How fast does a critical update have to be installed?","Amazon recommends measuring patch and mitigation timelines in hours for critical vulnerabilities on internet-facing systems: a 7-day or 30-day SLA assumes a delay that no longer exists. That assumes the inventory already exists on advisory day. blacklens.io matches new CVEs in the Threat Center against the technologies it has recorded and shows CVSS, EPSS, KEV membership and whether an exploit is public for each hit.","\u002Fimages\u002Finsights\u002Fphp2shell-angriffe-vor-dem-patch-en.webp","Timeline showing the first exploitation attempt on 17 October and the PHP patch on 21 October 2026",{},"\u002Fen\u002Finsights\u002Fphp2shell-angriffe-vor-dem-patch",{"title":667,"description":874},{"loc":888},"en\u002Finsights\u002Fphp2shell-angriffe-vor-dem-patch",[393],"php2shell-angriffe-vor-dem-patch","CmoIJqrLGf2ifl1_EZ7uomptiOZ8ogKLBf8XMEszWeY",{"id":896,"title":897,"author":6,"body":898,"category":366,"date":1451,"description":1452,"draft":369,"extension":370,"faq":1453,"image":1465,"imageAlt":1466,"lang":383,"legacyUrl":384,"meta":1467,"navigation":386,"path":41,"readingTime":1311,"seo":1468,"sitemap":1469,"stem":1470,"tags":1471,"translation":1472,"updated":643,"__hash__":1473},"insightsEn\u002Fen\u002Finsights\u002Fphp2shell-kritische-rce-lucken-in-php.md","PHP2Shell: the patches are out, the cause was something else",{"type":8,"value":899,"toc":1441},[900,903,909,913,940,943,947,956,962,966,975,978,1033,1047,1051,1054,1115,1118,1122,1131,1219,1234,1237,1241,1255,1326,1329,1359,1362,1366,1372,1385,1394,1416,1418,1421,1437],[11,901,902],{},"PHP published out-of-band security releases on 21 October 2026 for two critical flaws circulating under the name PHP2Shell: versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Both allow remote code execution without authentication, both sit in the PHP core rather than in an application. And both have a different cause from the one that travelled through forums and newsletters after the leak of 20 October.",[11,904,905],{},[906,907,908],"em",{},"Updated on 21 October 2026, after the release: this post previously described an unreleased patch and followed the reading of the time, that session upload progress was the cause. PHP's advisory disproves that. The mechanism, the interim measures and the version details now follow the official advisories.",[20,910,912],{"id":911},"what-is-php2shell","What is PHP2Shell?",[11,914,915,916,74,922,929,930,932,933,74,936,939],{},"PHP2Shell is the unofficial name for two critical vulnerabilities in the PHP core, tracked as ",[31,917,920],{"href":918,"rel":919},"https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-w8hw-w9fx-j79w",[416],[15,921,608],{},[31,923,926],{"href":924,"rel":925},"https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-6wmf-4rv5-p3rp",[416],[15,927,928],{},"CVE-2026-109619",". Both allow unauthenticated remote code execution, meaning an attacker runs their own commands on the server with the privileges of the web server process. PHP rates both ",[31,931,34],{"href":33}," 9.2 under version 4.0. The vector explains why it is not 10.0: ",[15,934,935],{},"AC:H",[15,937,938],{},"AT:P"," record high attack complexity and additional requirements. The exploit does not succeed on every attempt — but attackers may try as often as they like.",[11,941,942],{},"According to the advisories, every installation that serves web requests is affected, regardless of the application on top: PHP-FPM, Apache with mod_php, php-cgi, LiteSpeed and FrankenPHP. The highest risk sits with mod_php. W3Techs reports that 69 per cent of all websites with a known server-side language run PHP, for example under WordPress, TYPO3, Magento or Shopware. The acknowledgements in the advisories credit the researcher lcfr-hax along with researchers at Wiz, Areion and OpenAI; four members of the PHP team developed the fix.",[20,944,946],{"id":945},"flaw-1-when-php-runs-out-of-memory","Flaw 1: when PHP runs out of memory",[11,948,949,951,952,955],{},[15,950,608],{}," abuses the way PHP leaves a request when memory runs out. It jumps out via ",[15,953,954],{},"longjmp()",". At certain moments a request's memory is already reachable but not yet fully initialised. If an allocation fails at exactly that point, PHP does not account for the early exit, and the memory is left in an invalid state. Request shutdown then reads that state and branches on it.",[11,957,958,959,48],{},"The attacker triggers the memory exhaustion themselves, during multipart form parsing: through unbounded headers, empty file controls or nested field names. No form in the application is required, and no login. The patch replaces the hard jump: on memory exhaustion PHP now ends the request at the next safe point in the virtual machine, and only above a higher threshold does it abort via ",[15,960,961],{},"_exit()",[20,963,965],{"id":964},"flaw-2-when-remnants-of-the-previous-request-stay-behind","Flaw 2: when remnants of the previous request stay behind",[11,967,968,970,971,974],{},[15,969,928],{}," concerns state that outlives the request it belongs to. A PHP worker handles many requests in sequence and holds global state for error handling, sessions, objects and extensions. Some of that state points to memory owned by the request and must be reset before the request frees it. Some operations, however, run ",[906,972,973],{},"before"," the next request is properly initialised and read the old references — a use-after-free.",[11,976,977],{},"The advisory separates producers from consumers, and that separation is why a single setting is not enough:",[277,979,980,990,996,1006],{},[280,981,982,985,986,989],{},[283,983,984],{},"Producers:"," fatal errors such as parse and compile failures, uncaught errors, a failed ",[15,987,988],{},"require"," or exceeding the maximum execution time; also memory exhaustion and diagnostics emitted during shutdown or extension cleanup.",[280,991,992,995],{},[283,993,994],{},"Consumers:"," INI diagnostics raised before request initialisation, and session upload progress handling, which is enabled by default.",[280,997,998,1001,1002,1005],{},[283,999,1000],{},"Confirmed as RCE:"," the route via ",[15,1003,1004],{},"fatal_error_backtraces"," on PHP 8.5, and the session upload progress path, triggered there through memory exhaustion.",[280,1007,1008,1011,1012,74,1015,1018,1019,1018,1022,1025,1026,74,1029,1032],{},[283,1009,1010],{},"Reachable through:"," ",[15,1013,1014],{},".htaccess",[15,1016,1017],{},"php_value","\u002F",[15,1020,1021],{},"php_flag",[15,1023,1024],{},"php_admin_*"," under Apache mod_php; conditionally under PHP-FPM via ",[15,1027,1028],{},"PHP_VALUE",[15,1030,1031],{},"PHP_ADMIN_VALUE"," from a frontend; LSAPI is considered a candidate. For FrankenPHP, PHP found no early consumer in the default configuration.",[11,1034,1035,1036,70,1039,1042,1043,1046],{},"What does not help: hiding error messages. ",[15,1037,1038],{},"error_reporting",[15,1040,1041],{},"display_errors"," and the ",[15,1044,1045],{},"@"," prefix suppress the output, not the error — the producer remains.",[20,1048,1050],{"id":1049},"what-the-leak-got-wrong","What the leak got wrong",[11,1052,1053],{},"On 20 October an anonymous post on the Hacker News forum announced two PHP flaws, with no evidence beyond the author's trust in their source. watchTowr confirmed the same day that the flaws were real, and PHP moved the release planned for 22 October forward by a day. Anyone working from Monday's screenshots is working from several wrong figures:",[182,1055,1056,1069],{},[185,1057,1058],{},[188,1059,1060,1063,1066],{},[191,1061,1062],{},"Topic",[191,1064,1065],{},"Leak of 20 October",[191,1067,1068],{},"PHP advisory of 21 October",[201,1070,1071,1082,1093,1104],{},[188,1072,1073,1076,1079],{},[206,1074,1075],{},"Severity",[206,1077,1078],{},"CVSS 10.0",[206,1080,1081],{},"CVSS 9.2 under v4.0",[188,1083,1084,1087,1090],{},[206,1085,1086],{},"Cause",[206,1088,1089],{},"session upload progress",[206,1091,1092],{},"two core flaws; upload progress is one consumer of several",[188,1094,1095,1098,1101],{},[206,1096,1097],{},"Mitigation",[206,1099,1100],{},"turning off upload progress is enough",[206,1102,1103],{},"only the update closes both flaws",[188,1105,1106,1109,1112],{},[206,1107,1108],{},"Affected",[206,1110,1111],{},"all versions from PHP 5",[206,1113,1114],{},"everything before 8.2.35, 8.3.36, 8.4.27 and 8.5.12",[11,1116,1117],{},"For internal communication, use the advisories, not Monday's screenshots.",[20,1119,1121],{"id":1120},"which-versions-get-a-patch","Which versions get a patch",[11,1123,1124,1125,1130],{},"According to ",[31,1126,1129],{"href":1127,"rel":1128},"https:\u002F\u002Fwww.php.net\u002Farchive\u002F2026.php",[416],"PHP's release announcement",", PHP ships security updates for its four supported branches. For the end-of-life branches 7.4, 8.0 and 8.1 the security team additionally provided minimal source backports, intended for self-built installations and for operators without an LTS vendor.",[182,1132,1133,1144],{},[185,1134,1135],{},[188,1136,1137,1139,1141],{},[191,1138,427],{},[191,1140,196],{},[191,1142,1143],{},"Updates until",[201,1145,1146,1159,1172,1185,1198,1209],{},[188,1147,1148,1151,1156],{},[206,1149,1150],{},"8.5",[206,1152,1153],{},[15,1154,1155],{},"8.5.12",[206,1157,1158],{},"end of 2029",[188,1160,1161,1164,1169],{},[206,1162,1163],{},"8.4",[206,1165,1166],{},[15,1167,1168],{},"8.4.27",[206,1170,1171],{},"end of 2028",[188,1173,1174,1177,1182],{},[206,1175,1176],{},"8.3",[206,1178,1179],{},[15,1180,1181],{},"8.3.36",[206,1183,1184],{},"end of 2027",[188,1186,1187,1190,1195],{},[206,1188,1189],{},"8.2",[206,1191,1192],{},[15,1193,1194],{},"8.2.35",[206,1196,1197],{},"31 December 2026",[188,1199,1200,1203,1206],{},[206,1201,1202],{},"8.1, 8.0, 7.4",[206,1204,1205],{},"source backport or distro package",[206,1207,1208],{},"end of life",[188,1210,1211,1214,1217],{},[206,1212,1213],{},"7.3 and older",[206,1215,1216],{},"no patch",[206,1218,1208],{},[11,1220,1221,1222,1225,1226,1229,1230,1233],{},"Three points on this cost real time in practice. First, Debian, Ubuntu and Red Hat backport the fix into their packages without raising the version number: ",[15,1223,1224],{},"php -v"," still shows the old number, and the package changelog is what counts. Second, PHP explicitly notes that the volunteer-maintained ",[15,1227,1228],{},"rpms.remirepo.net"," repository had no update on release day, and advises moving to distribution packages; AlmaLinux initially published its packages in ",[15,1231,1232],{},"testing",". Third, 8.2 is only covered for a limited time — patch an 8.2 server today and plan the upgrade in the same breath.",[11,1235,1236],{},"How many systems run without a vendor fix was counted by the security firm Mallory on 20 October, using publicly visible HTTP banners: more than 880,000 internet-facing hosts reported PHP 8.1 or older, 59 per cent of the roughly 1.5 million hosts that state a version. Around 740,000 more showed PHP without a version. In German-speaking Europe the share without an official patch is 41 per cent in Germany, 53 per cent in Austria and 64 per cent in Switzerland, according to Mallory. The figures describe banners, not confirmed vulnerable systems.",[20,1238,1240],{"id":1239},"interim-measures-when-the-update-has-to-wait","Interim measures when the update has to wait",[11,1242,1243,1244,1247,1248,74,1251,1254],{},"PHP is unambiguous on this point: only the update is a complete mitigation. The settings below, taken from the advisories, reduce exposure but do not make an installation safe. They belong in ",[15,1245,1246],{},"php.ini",", the FPM pool or the server configuration — somewhere the application cannot override them. ",[15,1249,1250],{},"ini_set()",[15,1252,1253],{},".user.ini"," apply too late. Restart every worker afterwards, and rebuild containers.",[839,1256,1260],{"className":1257,"code":1258,"language":1259,"meta":356,"style":356},"language-ini shiki shiki-themes material-theme-lighter github-light github-dark","; against CVE-2026-109618 (memory exhaustion)\nmemory_limit = -1          ; as php_admin_value, not overridable\npost_max_size = 8M         ; 32M if uploads are required\nupload_max_filesize = 8M   ; must stay below post_max_size\n\n; against CVE-2026-109619 (stale state)\nsession.upload_progress.enabled = 0\nfatal_error_backtraces = 0 ; PHP 8.5 only\n\n; optional, costs performance\npm.max_requests = 1        ; FPM: one request per worker\n","ini",[15,1261,1262,1270,1275,1280,1286,1291,1297,1303,1309,1314,1320],{"__ignoreMap":356},[1263,1264,1267],"span",{"class":1265,"line":1266},"line",1,[1263,1268,1269],{},"; against CVE-2026-109618 (memory exhaustion)\n",[1263,1271,1272],{"class":1265,"line":360},[1263,1273,1274],{},"memory_limit = -1          ; as php_admin_value, not overridable\n",[1263,1276,1277],{"class":1265,"line":357},[1263,1278,1279],{},"post_max_size = 8M         ; 32M if uploads are required\n",[1263,1281,1283],{"class":1265,"line":1282},4,[1263,1284,1285],{},"upload_max_filesize = 8M   ; must stay below post_max_size\n",[1263,1287,1288],{"class":1265,"line":388},[1263,1289,1290],{"emptyLinePlaceholder":386},"\n",[1263,1292,1294],{"class":1265,"line":1293},6,[1263,1295,1296],{},"; against CVE-2026-109619 (stale state)\n",[1263,1298,1300],{"class":1265,"line":1299},7,[1263,1301,1302],{},"session.upload_progress.enabled = 0\n",[1263,1304,1306],{"class":1265,"line":1305},8,[1263,1307,1308],{},"fatal_error_backtraces = 0 ; PHP 8.5 only\n",[1263,1310,1312],{"class":1265,"line":1311},9,[1263,1313,1290],{"emptyLinePlaceholder":386},[1263,1315,1317],{"class":1265,"line":1316},10,[1263,1318,1319],{},"; optional, costs performance\n",[1263,1321,1323],{"class":1265,"line":1322},11,[1263,1324,1325],{},"pm.max_requests = 1        ; FPM: one request per worker\n",[11,1327,1328],{},"Three things are easy to get wrong here:",[277,1330,1331,1340,1353],{},[280,1332,1333,1339],{},[283,1334,1335,1338],{},[15,1336,1337],{},"memory_limit = -1"," is not a typo."," The memory limit is the trigger the attacker wants to reach. Cap memory through containers or cgroups instead, and check that no pool, directory or application sets a finite limit.",[280,1341,1342,1352],{},[283,1343,1344,1345,1348,1349,48],{},"No ",[15,1346,1347],{},"RLIMIT_AS"," and no ",[15,1350,1351],{},"RLIMIT_DATA"," PHP advises against them explicitly: such limits make the attack easier, not harder.",[280,1354,1355,1358],{},[283,1356,1357],{},"Remove errors from reachable paths."," That includes execution timeouts an attacker can trigger predictably, and warnings from obsolete INI directives raised before request initialisation. Large multipart requests can additionally be capped at the web server or in the web application firewall.",[11,1360,1361],{},"End-of-life systems that cannot be updated immediately belong behind a VPN or off the public network — as CERT-EU recommended before the release.",[20,1363,1365],{"id":1364},"exploitation-what-had-been-seen-by-21-october","Exploitation: what had been seen by 21 October",[11,1367,1368,1369,1371],{},"Several vendors report exploitation attempts; confirmed compromises, so far, none. watchTowr saw the first attempts on its sensors at roughly the time of the release, and Jake Knott, who leads threat intelligence there, told SecurityWeek: \"Whilst nobody has been successful to date, we don't expect that will last long.\" Hadrian reported exploitation \"at scale\" a few hours before the release and names the session upload progress path as the one most used. Patchstack, Cloudflare and Vega also observed attempts, Vega with publicly available proof-of-concept code. Neither flaw appears in the ",[31,1370,155],{"href":154}," as of 21 October.",[11,1373,1374,1375,1378,1379,1384],{},"That it moved quickly was to be expected. The update makes the corrected source public, and a comparison with the previous version shows where the flaw sat. When ",[15,1376,1377],{},"CVE-2024-4577",", a PHP flaw in CGI mode on Windows, became public in June 2024, ",[31,1380,1383],{"href":1381,"rel":1382},"https:\u002F\u002Fwww.akamai.com\u002Fblog\u002Fsecurity-research\u002F2024-php-exploit-cve-one-day-after-disclosure",[416],"Akamai"," saw exploitation attempts on its honeypots within 24 hours. Here the leak came before the patch.",[11,1386,1387,1390,1391,48],{},[283,1388,1389],{},"Update, 22 October:"," Amazon Threat Intelligence has since reported an exploitation attempt from 17 October, four days before disclosure. What that means for logs, hunting and patch deadlines is in the ",[31,1392,1393],{"href":888},"follow-up post",[11,1395,1396,1397,70,1399,70,1401,821,1403,1405,1406,70,1409,821,1412,1415],{},"A successful attack is ultimately detectable because a process starts: alert when ",[15,1398,814],{},[15,1400,817],{},[15,1402,820],{},[15,1404,824],{}," invokes a shell, an interpreter or tools such as ",[15,1407,1408],{},"curl",[15,1410,1411],{},"wget",[15,1413,1414],{},"certutil.exe",". Unusually frequent HTTP 500 responses and crashed PHP workers are a second signal — the exploits do not always succeed, and many crashes mean many attempts. Once a web server has started a shell, treat the system as compromised: disconnect it first, do not power it off, then preserve logs, the process list and connections, search for web shells, new files in the web root, cron jobs and accounts, rebuild, and rotate every credential held in configuration files. Assume they are known.",[20,1417,852],{"id":332},[11,1419,1420],{},"On patch day the problem is rarely the updating. It is the question of where PHP runs. Beyond the obvious web servers, that means hosting panels such as Plesk and cPanel, which bring several parallel PHP versions with them, Docker images, appliances with a web interface from the phone system to time tracking, Windows software with PHP built in, and intranet tools nobody has touched in years. If you do not run the web server yourself, ask your host for its patch date.",[11,1422,858,1423,1425,1426,1428,1429,1431,1432,74,1434,1436],{},[31,1424,340],{"href":339}," to track continuously, from the outside, which domains, services and web applications are reachable and which technologies run on them; the ",[31,1427,345],{"href":344}," covers internal systems. The ",[31,1430,350],{"href":349}," matches new CVEs such as ",[15,1433,608],{},[15,1435,928],{}," against that inventory in real time and shows whether a match rests on the exact version or only on the product, for example because a server hides its version. Without a check template for a verification scan, it flags the match for manual review. What a PHP process starts on the server is not something blacklens.io sees; that remains the job of monitoring on the host.",[1438,1439,1440],"style",{},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":356,"searchDepth":357,"depth":357,"links":1442},[1443,1444,1445,1446,1447,1448,1449,1450],{"id":911,"depth":360,"text":912},{"id":945,"depth":360,"text":946},{"id":964,"depth":360,"text":965},{"id":1049,"depth":360,"text":1050},{"id":1120,"depth":360,"text":1121},{"id":1239,"depth":360,"text":1240},{"id":1364,"depth":360,"text":1365},{"id":332,"depth":360,"text":852},"2026-10-21","PHP released patches for two critical RCE flaws on 21 October 2026. The cause sits in the PHP core, not in session upload progress.",[1454,1456,1459,1462],{"q":912,"a":1455},"PHP2Shell is the unofficial name for two critical vulnerabilities in the PHP core, CVE-2026-109618 and CVE-2026-109619, both of which allow unauthenticated remote code execution. PHP rates them CVSS 9.2 under version 4.0 and published patches on 21 October 2026. One flaw occurs when PHP runs out of memory; the other when state from one request survives in the worker and a later request reuses it.",{"q":1457,"a":1458},"Which PHP versions get a patch for PHP2Shell?","The fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; the GitHub advisories list every earlier release as affected. For the end-of-life branches 7.4, 8.0 and 8.1 the PHP security team published minimal source backports, and PHP 7.3 and older get no fix. Debian, Ubuntu and Red Hat ship the patch without raising the version number, so the package changelog counts, not the output of php -v.",{"q":1460,"a":1461},"Is turning off session upload progress enough?","No. That setting circulated as the fix after the leak, but PHP's advisory disagrees: session upload progress is only one of several routes into CVE-2026-109619, and it plays no part in CVE-2026-109618. PHP names the update as the only complete mitigation. The recommended settings reduce exposure, but they do not make an installation safe.",{"q":1463,"a":1464},"How do I find every PHP system in my organisation?","On patch day the problem is rarely the patching. It is knowing where PHP runs, often unnoticed in appliances, hosting panels and old intranet tools. blacklens.io uses Attack Surface Management to track continuously which domains, services and web applications are reachable from outside and which technologies run on them; the Sentry Agent covers internal systems. The Threat Center matches new CVEs against that inventory.","\u002Fimages\u002Finsights\u002Fphp2shell-kritische-rce-lucken-in-php.webp","Abstract illustration of overlapping lines of source code in blue and red on a dark background",{},{"title":897,"description":1452},{"loc":41},"en\u002Finsights\u002Fphp2shell-kritische-rce-lucken-in-php",[393],"php2shell-kritische-rce-lucken-in-php","UmqdoDcNTRg2Lt5hvczHcBVqeEXNJZpXxYiHw5AsdiU",1792748372747]