[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXR_ZbfkiF-cN8S-3-1i-m-X3VFpNVo0PFJ1NsHwD088":3},{"article":4,"iocs":45,"watch_terms":55,"solutions":56,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"9ef95446-f8ab-42c9-85da-3da8329deae4","PHP2Shell and Node2Shell: Find, Fix, and Verify Across Your Web Apps and APIs","php2shell-and-node2shell-find-fix-and-verify-across-your-web-apps-and-apis-e28ac0","Key Takeaways Neither flaw is in your application code. Every app and API on a vulnerable runtime inherits the risk. PHP2Shell (CVE-2026-109618, CVE-2026-109619) is fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Node2Shell (CVE-2026-111497) is fixed in Node.js 22.23.4, 24.22.1, and 26.12.1. Both are on the CISA KEV list. PHP2Shell was added October 26. Node2Shell […]","Two critical runtime flaws, PHP2Shell (CVE-2026-109618, CVE-2026-109619) and Node2Shell (CVE-2026-111497), affect all applications and APIs on vulnerable PHP and Node.js versions, respectively. Both are now on the CISA KEV list, with exploitation observed before patches were available. PHP2Shell is fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, while Node2Shell is fixed in Node.js 22.23.4, 24.22.1, and 26.12.1.","PHP2Shell and Node2Shell vulnerabilities impact web apps and APIs running on vulnerable runtimes.","https:\u002F\u002Fblog.qualys.com\u002Fproduct-tech\u002F2026\u002F11\u002F12\u002Fphp2shell-node2shell-totalappsec-web-apps-apis","https:\u002F\u002Fblog.qualys.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FBlog-Images-1080x1080.Cloud_.Agent_.2025.Updates-6-9-1.png","2026-11-12T09:15:32+00:00","2026-11-12T10:00:31.264009+00:00",9,[17,20,22,25],{"name":18,"type":19},"PHP","product",{"name":21,"type":19},"Node.js",{"name":23,"type":24},"API","technology",{"name":26,"type":24},"web app","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,38,40],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46,50,52],{"type":47,"value":48,"context":49},"cve","CVE-2026-109618","PHP2Shell vulnerability identifier",{"type":47,"value":51,"context":49},"CVE-2026-109619",{"type":47,"value":53,"context":54},"CVE-2026-111497","Node2Shell vulnerability identifier",[18,21],{"controls":57,"vendors":137},[58,87,112],{"slug":59,"name":60,"problem":61,"products":62},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":88,"name":89,"problem":90,"products":91},"patch-management","Automated patch management","Known holes get closed in days, not months.",[92,100,104],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":88,"product_name":101,"url":102,"description":103},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":113,"name":114,"problem":115,"products":116},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[117,125,130],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":126,"product_name":127,"url":128,"description":129},"axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":132,"url":135,"description":136},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",[138],{"slug":64,"name":65,"logo_path":66,"roles":139},[140],"reported_by",{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":151},"zero-day-runtime-flaws-in-php-and-nodejs-demand-immediate-patching-across-web-apps-and-apis","Zero-Day Runtime Flaws in PHP and Node.js Demand Immediate Patching Across Web Apps and APIs","PHP2Shell and Node2Shell represent critical runtime vulnerabilities affecting PHP and Node.js respectively, enabling remote code execution across any application or API built on vulnerable versions. Crucially, exploitation was observed before patches were available, meaning organizations relying on reactive patch cycles were already exposed. This highlights the danger of running internet-facing applications on unvalidated runtime versions without compensating controls. The incidents underscore that web application runtimes are high-value attack surfaces requiring the same rigorous patch and vulnerability lifecycle management as operating systems and network devices.",[146,147,148,149,150],"CIS Control 2: Inventory and Control of Software Assets (v8)","CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":152,"NIST SP 800-53 SI-2: Flaw Remediation":153,"CIS Control 7: Continuous Vulnerability Management (v8)":154,"CIS Control 2: Inventory and Control of Software Assets (v8)":155,"NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks":156},"NIS2 Article 21(2)(e) explicitly covers vulnerability handling and disclosure in acquisition, development, and maintenance, making it directly applicable to the obligation to track, respond to, and remediate critical runtime vulnerabilities like PHP2Shell and Node2Shell.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner, which would have driven the emergency patching process needed to address these actively exploited runtime vulnerabilities.","CIS Control 7 mandates continuous scanning and prioritized remediation of vulnerabilities, which directly addresses the need to detect and patch PHP2Shell and Node2Shell flaws—especially given their CISA KEV status and active exploitation.","CIS Control 2 requires organizations to maintain an inventory of authorized software including versions, which would have enabled rapid identification of all systems running vulnerable PHP and Node.js runtimes for prioritized remediation.","This category directly applies because PHP2Shell and Node2Shell were exploited before patches existed, requiring organizations to either apply mitigations (WAF rules, runtime isolation) or formally accept and document the residual risk during the zero-day window."]