"Black October" Web Crisis: Node2Shell & PHP Emergency

CYBERSECURITY • ENTERPRISE ALERT • 6 min read

Quick Answer: Security agencies have issued urgent emergency patch directives for dual critical vulnerabilities crippling core web infrastructure. A remote code execution flaw in Node.js's Brotli decoder (CVE-2026-111497) bypasses npm audit, while unauthenticated RCE bugs strike PHP servers worldwide. Systems running Node.js and PHP require immediate runtime binary upgrades to prevent remote compromise.

Last updated: 24 October 2026. Verified with official Node.js, PHP, CISA, and CERT-In security advisories.

Data centers and cloud hosting providers worldwide face urgent runtime patching cycles following foundational software flaws. (Image: My Tech Flux)

Security executives are calling it "Black October." Over a four-day span, two of the modern web's most fundamental software backbones have suffered catastrophic zero-day vulnerabilities. First came the PHP2Shell disclosures affecting millions of legacy and modern web servers. Now, a critical out-of-bounds write vulnerability dubbed "Node2Shell" has struck the core Node.js runtime.

Governments, enterprise security teams, and stock exchanges worldwide have mobilized emergency response plans. On 24 October, India's National Stock Exchange urged financial brokers to treat cyber defense as a core survival layer as automated scanning bots began probing exposed endpoints. Here is a technical breakdown of how these vulnerabilities operate, why your automated package scanners are failing, and the exact steps required to patch your systems.

Urgent Administrator Warning: Running npm audit will not protect you from the Node.js flaw. Because CVE-2026-111497 resides inside the compiled C++ Node binary rather than an application-level npm package, your CI/CD pipelines will report zero vulnerabilities while your servers remain fully exploitable.

Node2Shell Explained: The Brotli Decoder Memory Flaw

The vulnerability tracked as CVE-2026-111497 carries a critical CVSS v4.0 rating of 9.2 to 9.8. It is an out-of-bounds write flaw located in Google's Brotli decompression library bundled directly inside Node.js (deps/brotli).

Brotli compression streams split data into distinct block types (literals, commands, and distances) and permit dynamic switching between them mid-stream. In the flawed decoder logic, the internal function DecodeBlockTypeAndLength used a single return value to signal two completely different conditions: an invalid stream versus a stream that merely needs more input chunks.

Callers in the decompression pipeline incorrectly treated this failure as a recoverable state, and functions like DecodeLiteralBlockSwitch ignored the return status entirely. When an attacker delivers a specially crafted Brotli payload, the decoder does not halt. Instead, it continues operating in a corrupted internal state, triggering an out-of-bounds write past the internal buffer boundary. This grants attackers arbitrary memory corruption, sensitive information disclosure, or full remote code execution (RCE).

Why Node Applications Are Widely Exposed

Many developers assume they are safe because they do not call Brotli decompression directly in their application code. Unfortunately, exposure occurs across three common web architectural patterns:

Production servers handling automated web decompression require binary-level upgrades. Photo: Victor Grigas via Wikimedia Commons (CC BY-SA 3.0).

• Automatic Inbound Body Parsing: Web frameworks such as Express, Fastify, and Koa utilizing body-parser middleware often decompress incoming HTTP request bodies automatically when clients submit Content-Encoding: br headers.
• Outbound API Fetching: When a backend service uses Node's native fetch() or third-party HTTP clients to query external webhook URLs or remote microservices, receiving a compressed malicious payload triggers the local decoder flaw.
• Direct Streaming Usage: Applications using Node's native zlib.brotliDecompress(), zlib.brotliDecompressSync(), or streaming transformation pipelines process payloads directly inside the vulnerable C++ module.

The PHP Crisis: PHP2Shell and New Session Upload Flaws

Compounding the Node.js emergency, the PHP programming language has experienced simultaneous critical breakdowns. On 20 October, researchers disclosed CVE-2026-109618 and CVE-2026-109619 (dubbed PHP2Shell, CVSS 9.2), allowing unauthenticated attackers to execute arbitrary system commands against Apache, PHP-FPM, and LiteSpeed configurations.

Making matters worse, on 23 October the PHP security team published an additional advisory for CVE-2026-115560, involving remote code execution via session upload progress configurations. AI-assisted security testing tools originally helped uncover these decade-old dormant bugs, illustrating how machine learning has accelerated the discovery of foundational flaws faster than maintainers can quietly patch them.

Emergency Patching Guide: Verified Safe Versions

Temporary configuration workarounds are insufficient for memory corruption vulnerabilities of this magnitude. System administrators and DevOps engineers must deploy patched runtime binaries immediately:

Platform / Software	Vulnerable Versions	Minimum Safe Version	Patch Urgency
Node.js 22.x LTS	v22.0.0 through v22.23.3	v22.23.4 or higher	Immediate (Production Priority)
Node.js 24.x Current	v24.0.0 through v24.22.0	v24.22.1 or higher	Immediate
Node.js 26.x Beta	v26.0.0 through v26.12.0	v26.12.1 or higher	Immediate
PHP 8.5 Release	Up to 8.5.11	PHP 8.5.12	Critical
PHP 8.4 Release	Up to 8.4.26	PHP 8.4.27	Critical
PHP 8.3 / 8.2 LTS	Up to 8.3.35 / 8.2.34	PHP 8.3.36 / 8.2.35	Critical
End-of-Life Node / PHP	Node 18/20; PHP 7.x/8.0	No official patches available	Migrate runtime immediately

Step-by-Step Production Action Plan

1. Audit Your Base Container Images: Inspect all Dockerfiles and Kubernetes pod definitions. If your base image relies on unpinned tags like node:22 or php:8.3-fpm, rebuild your container images immediately without cached layers to pull the latest security patch levels.
2. Verify Local Host Binaries: On Linux and macOS production hosts, run node -v and php -v. Ensure production versions match or exceed the minimum safe versions listed above.
3. Implement Temporary Ingress Filtering: If immediate container redeployment is impossible, configure your Web Application Firewall (WAF) or NGINX reverse proxy to temporarily reject inbound requests containing Content-Encoding: br until backend runtimes are patched.
4. Disable PHP Session Upload Progress: If you cannot update PHP immediately, edit your php.ini configuration to set session.upload_progress.enabled = Off to neutralize CVE-2026-115560.

My Take

First, the myth that package audits equal software security has been completely shattered. Modern security pipelines depend excessively on scanning lockfiles. When a flaw lives in the core runtime binary, automated tools report a false clean bill of health.

Second, AI-assisted reverse-engineering has fundamentally shifted the offensive timeline. Attackers and researchers now probe decades-old C and C++ source code with automated reasoning models, finding subtle state machine flaws in hours. Defensive patching cycles must match this new velocity.

Third, legacy runtime neglect is no longer sustainable. Organizations running unsupported versions of Node.js 18 or 20 have received zero official security patches during this crisis. If your company treats runtime upgrades as optional maintenance, you are operating on borrowed time.

Frequently Asked Questions

Why does npm audit fail to detect CVE-2026-111497?

The vulnerability exists in the compiled C++ Brotli library inside the Node.js engine itself. Because it is not a third-party npm package in your package.json, npm audit cannot see or report it.

Can an attacker exploit this vulnerability without authentication?

Yes. If your Node.js application accepts compressed request bodies or fetches untrusted remote URLs that return Brotli-encoded responses, attackers can trigger memory corruption remotely without logging in.

Are older Node.js versions like v18 or v20 safe?

No. Older unsupported versions contain the vulnerable Brotli code but do not receive official security patches. You must upgrade your infrastructure to a supported release line like v22.23.4.

What is the fastest temporary workaround if I cannot patch immediately?

Configure your edge load balancer or reverse proxy to strip or block HTTP requests with Content-Encoding set to Brotli, and disable Brotli decompression middleware until backend runtimes are updated.

Is PHP2Shell related to the Node.js Brotli vulnerability?

They are separate vulnerabilities in different runtimes, but their simultaneous disclosure in October 2026 has created a combined emergency for web infrastructure teams managing mixed application environments.

Sources: Node.js Official Security Releases, CISA Cybersecurity Advisories, CERT-In Vulnerability Alerts, Qualys Threat Research.

Disclaimer: This security bulletin provides urgent technical analysis for system administrators and developers. Always perform software updates in a controlled staging environment prior to full production deployment.