PHP2Shell and Node2Shell: what’s behind the recent security vulnerabilities
Following the high-profile PHP2Shell vulnerability, another serious vulnerability in Node.js was publicly disclosed on October 21, 2026. Both technologies underpin numerous websites, applications, and online services. Under certain conditions, the vulnerabilities allow attackers to execute malicious code on affected servers. Security researchers have already reported initial attack attempts.
Here is a brief overview of the vulnerabilities, their known impact so far, and what they tell us about IT security.
What are PHP2Shell and Node2Shell?
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) refers to two critical vulnerabilities in the widely used PHP programming language. The flaws affect internal memory management and error handling. Under certain conditions, specially crafted requests can trigger memory errors and allow attackers to execute their own code on a server – without having to log in first.
Depending on the access permissions of the affected system, attackers could, for example, read confidential data, manipulate files, or install malware.
Node2Shell/Broccoli2Shell (CVE-2026-111497) affects the JavaScript runtime Node.js, specifically its built-in Brotli decoder for decompressing data. If an affected application processes specially crafted compressed data, this can also cause memory errors. In the worst case, attackers could execute programs or commands on the server.
The potential consequences range from system crashes and the disclosure of sensitive information to the complete compromise of an affected application.
What impact has been reported so far?
Even before the official disclosure of PHP2Shell, security researchers recorded automated scans and attack attempts. Activity increased significantly after the vulnerabilities were announced. The issue also became particularly visible to the wider public when many website operators – including numerous government agencies and public institutions in Germany – temporarily took their websites offline as a precaution while security updates were prepared and installed.
Security researchers also demonstrated that Node2Shell could be used to execute unauthorized code on vulnerable systems under test conditions.
Good to know: It is important to distinguish between demonstrated ways to exploit a vulnerability, observed attack attempts, and attacks that actually succeed. Not every recorded attempt results in a compromise. Based on the publicly available information, no reliable conclusions can yet be drawn about the extent of successful attacks.
Why do vulnerabilities like these often go undetected for so long?
Memory management errors are particularly difficult to identify. They often occur only under unusual conditions, such as when an application unexpectedly requires large amounts of memory or a process is interrupted at a specific point.
PHP2Shell provides a notable example: according to the PHP Foundation, the first indications of the cause of CVE-2026-109618 were discovered back in 2024. However, the full extent of the issue only became clear through further security investigations in 2026. There was another challenge: a fix had to close the vulnerability without jeopardizing the functionality of numerous existing applications. The PHP Foundation itself acknowledged that technical dependencies, limited resources, and internal decision-making processes had delayed the fix.
This example shows that considerable time can pass between identifying a potential flaw, demonstrating that it can be exploited, and developing a safe fix.
What does this mean for businesses?
PHP2Shell and Node2Shell demonstrate the importance of securing core software components. Even carefully developed applications can be put at risk by vulnerabilities in the runtimes or libraries they use.
For companies, this primarily means knowing which technologies they use and depend on, regularly assessing security advisories, and applying available updates promptly. Continuous security testing and monitoring for suspicious activity are also important parts of effective vulnerability management.
Was the netfiles service affected by these vulnerabilities?
The netfiles service was not affected by either PHP2Shell or Node2Shell. At netfiles, PHP2Shell was relevant only in connection with the public website, not to netfiles applications such as data rooms or the login page. The corresponding security update was applied to the website shortly after the vulnerability became known and a patch was made available.
netfiles promptly assesses security advisories for potential impact and regularly checks its systems and applications for vulnerabilities. If security vulnerabilities affect the netfiles service, we inform our customers promptly and transparently about their potential impact and the necessary measures.
How netfiles protects your data
Data security requires technical safeguards, clear processes, and regular reviews. Read our security overview to learn how netfiles protects your data and what role independent certifications and attestations such as ISO/IEC 27001, BSI C5, and SOC 2 play.