decrypted · 25 october 2026 · vulnerabilities and patching · uk policy and law · ai and llm security · digital sovereignty

PHP2Shell and Node2Shell: the day the web's engines both broke

This is the written companion to a special, two-presenter edition of the Decrypted podcast. This post is the short version, with every source.

What happened

On Tuesday 20 October the PHP project announced an emergency release for 14:00 UTC the next day. The same day the details leaked, with a working tool. On Wednesday 21 October PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for two engine flaws, CVE-2026-109618 and CVE-2026-109619, both scored 9.2 on CVSS v4 and together nicknamed PHP2Shell. Hours earlier Node.js had shipped 22.23.4, 24.22.1 and 26.12.1 for CVE-2026-111497, an out-of-bounds write in the Brotli decompression code it bundles, nicknamed Node2Shell.

PHP2Shell was attacked before the fix existed. Amazon's honeypots logged an attempt on 17 October. ELLIO saw scanning at 08:36 UTC on the 21st, five and a half hours before the release, and had counted 743 exploit requests from 33 addresses by 23:00. Cloudflare had blocking rules live from 03:02 UTC. Node2Shell, by contrast, had no confirmed exploitation in the wild by the end of the week, and Imperva's code execution demonstration took several attempts on one build.

The two PHP bugs, in plain words

One is stale state. A PHP worker handles request after request, and a piece of internal bookkeeping can outlive the memory it points at, so the next request trusts whatever an attacker has put there. The session upload progress feature, on by default and run before any site code, is one confirmed route, so a site with no upload form is still in scope. The other is memory corruption when a request forces PHP past its memory limit mid-setup. The two need different stopgaps.

PHP only patches 8.2 and later. By CybelAngel's count about 59 percent of visible PHP hosts run versions that will never be fixed upstream. Censys counted roughly 36.7 million internet-facing services on affected versions on 22 October.

What the UK did

The NCSC issued an alert on the 21st whose priority actions included "consider taking the system offline" where patching or mitigation was not possible. NHS England's national security operations centre rated future exploitation "highly likely". The Met Police website, the Office for Budget Responsibility, BBC portals, Edinburgh, Oxford, Bristol, Lambeth and Barnet councils, seven Scottish councils and six of Scotland's fourteen health boards went offline as a precaution. On the 22nd the minister told the Lords that 32 central government services were unavailable and four partially, that the NCSC had sent 50,000 proactive notifications, and that no compromise of government systems had been confirmed.

No UK alert was issued for Node2Shell. The Dutch and Belgian national centres issued one each.

Where the exposure is

Beyond public websites: hosting control panels (cPanel and Plesk are PHP), webmail, phpMyAdmin, Nextcloud, wikis, ticketing and monitoring tools, and the admin pages of firewalls, storage boxes and phone systems. OPNsense patched on day one; on that product PHP runs as root. Linux itself is not vulnerable, but every major distribution ships PHP and Node as packages, and Debian builds Node against the system Brotli library, so a Node version number alone does not prove a box is patched. For Node, the reachable routes are Express 5 (which unpacks compressed request bodies by default; Express 4 does not) and Node's own fetch, which unpacks a Brotli reply whenever a server says it is Brotli. Qualys counted 3.3 million Node installations, 1.7 million of them on end-of-life lines, and 42,000 patched. Internal systems are in scope at lower priority: visible and reachable are not the same thing.

Both found by AI

Calif found the first PHP bug on 1 August using an OpenAI model. Wiz found it independently on 19 August with several frontier models and reported it on the 24th. The patch came two months later. Node2Shell was found by OpenAI's Codex Security team. The minister said the NCSC "was briefed by OpenAI last week". Richard Horne of the NCSC said in April that these models "are not finding new attacks, they're just exposing more security vulnerabilities". Finding is now machine speed; fixing is not. Of 6,157 AI-found bugs disclosed to open-source projects under Anthropic's programme by early October, 516 were patched.

Attack speed, defence speed

There is no evidence AI wrote or adapted the PHP2Shell exploit; the leak and ordinary bots did the damage. But Mandiant's measured time from disclosure to exploitation has gone from 63 days in 2018 to minus seven days in 2025. GCHQ's Director has announced a plan to "hardwire cutting-edge agentic AI into machine speed cyber defence"; the NCSC's deputy CTO says AI "cannot be the sole answer" and hygiene comes first.

The practical version: point a coding agent, read-only, at your own configuration and ask what you run, what version, what is switched on that you do not use, what runs as root, and where your secrets are. It would have listed every one of this week's exposures, though before the 20th "upload progress is on" would have sat at the bottom of the report. Its real value is the inventory, and closing the gap between an advisory and an answer to "am I exposed, where, what first". Four rules: read-only tools, a separate machine, no secrets in reach, and "it found nothing" is a statement about the method.

Secure by design, and whose clock

Both bugs are memory-safety flaws in C code, and both let in through defaults doing work nobody asked for. The Cyber Security and Resilience Bill reaches Lords Report stage on Monday 26 October; the minister says it will add "critical patching within defined timelines", though as drafted it does not cover central or local government. The NCSC warned in 2025 of a "digital divide" between systems that keep pace with AI-enabled threats and "a large proportion that are more vulnerable". This week was that divide in miniature.

One thing for Monday: know what you run. If you cannot make the list in an hour, that is your finding.

Opinion, not advice.

Sources

Listen to the special edition, then make the list: every PHP, every Node, every version, every box.