[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVhCn0c8JTYdrMPj9udvKXUxliqQbDlEogE-h9DPsC7E":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"f9ab75e3-2cf9-4f40-bad7-ff9cd083aaad","critical-php-and-nodejs-runtime-vulnerabilities-actively-exploited-in-the-wild","b70f3e36-e9df-43af-ad0b-9b81f001f479","Critical PHP and Node.js Runtime Vulnerabilities Actively Exploited in the Wild","PHP2Shell and Node2Shell represent critical runtime vulnerabilities in two of the most widely deployed web technologies, meaning a vast number of Linux servers and container images are potentially exposed. These flaws have been actively exploited and added to CISA's Known Exploited Vulnerabilities catalog, indicating real-world threat actors are already taking advantage of unpatched systems. The release of a free scanner by Insignary highlights that many organizations still lack adequate visibility into whether their environments are affected. This matters because undetected exposure in runtime environments can lead to full server compromise, data exfiltration, and lateral movement through containerized infrastructure.","**Immediate actions:**\n- Run the Insignary-chk scanner (or equivalent tooling) against all Linux servers and container images to identify PHP2Shell and Node2Shell exposure today.\n- Apply vendor-supplied patches or upgrade PHP and Node.js to the latest secure versions on all affected systems without delay.\n- Cross-reference your asset inventory against CISA's Known Exploited Vulnerabilities catalog and treat any matches as a P1 remediation priority.\n\n**Long-term improvements:**\n- Establish a formal vulnerability management program with defined SLAs for patching critical vulnerabilities (e.g., 24–72 hours for CISA KEV entries).\n- Maintain a continuously updated software bill of materials (SBOM) for all container images and server workloads to accelerate future exposure assessments.\n- Integrate automated vulnerability scanning into CI\u002FCD pipelines so vulnerable runtime components are caught before reaching production.\n\n**Detection measures:**\n- Deploy runtime threat detection (e.g., Falco, eBPF-based tools) on Linux hosts and containers to identify exploitation attempts or anomalous shell spawning behavior.\n- Ensure centralized logging captures PHP and Node.js process activity so that indicators of compromise can be detected and investigated promptly.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":20,"PCI DSS Requirement 6":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices; failure to track and patch actively exploited vulnerabilities listed in CISA KEV is a direct violation of this obligation.","PCI DSS Requirement 6 mandates that organizations develop and maintain secure systems and software by applying security patches in a timely manner, which would have directly prevented exposure to these actively exploited runtime vulnerabilities.","SI-2 mandates that organizations identify, report, and correct information system flaws; had this control been rigorously applied, patches for these critical runtime vulnerabilities would have been deployed before threat actors weaponized them.","PHP and Node.js are third-party runtime components, and A06 specifically warns that using vulnerable or outdated versions of such components is a leading cause of compromise—precisely the risk these vulnerabilities represent.","Regularly scanning for known vulnerabilities like PHP2Shell and Node2Shell—and remediating them on a defined schedule—is exactly what CIS Control 7 requires, which would have identified exposure before active exploitation occurred.","This control requires organizations to obtain timely information about technical vulnerabilities and take appropriate action, directly addressing the failure to detect and remediate PHP2Shell and Node2Shell in a timely manner.","While primarily an access control reference, the shell-access nature of PHP2Shell and Node2Shell means that exploitation grants unauthorized runtime access—reinforcing the need to limit and monitor what processes can spawn interactive sessions.","published","2026-11-07T03:20:41.761345+00:00","2026-11-07T03:20:41.746+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fcybersecuritynews.com\u002Finsignary-releases-free-insignary-chk-tool-to-detect-php2shell-and-node2shell-exposure\u002F","insignary-releases-free-insignary-chk-tool-to-detect-php2shell-and-node2shell-ex-aa7c4a","Insignary Releases Free Insignary-Chk Tool to Detect PHP2Shell and Node2Shell Exposure",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[49,52,55],{"slug":38,"name":50,"problem":51},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":44,"name":53,"problem":54},"Automated patch management","Known holes get closed in days, not months.",{"slug":56,"name":57,"problem":58},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have."]