PHP2Shell This Week: The Patch Wasn't Out Yet, and the Attacks Had Already Started
From an advance notice of the patch to leaked details and a warning from Japan's prime minister, PHP2Shell showed how dangerous the gap between announcement and fix can be. Node.js and Go also shipped updates the same day.
This week's security news was almost entirely taken over by PHP2Shell. Laid out by date, the order turns out to be a bit backwards.
Timeline
- October 17, Amazon's threat intelligence team spotted PHP2Shell exploitation in their honeypots. The traffic came from a commercial anonymity network. The vulnerability was not public yet at that point.
- October 20, the PHP development team announced that a security update would ship at 10 PM Taiwan time on the 21st, fixing two vulnerabilities rated 9.2 under CVSS v4.0 (CVE-2026-109618, CVE-2026-109619), and asked people to get ready. After that, reports kept surfacing in the security community that the vulnerability details had already leaked.
- Before the patch came out, Japanese Prime Minister Sanae Takaichi reminded website administrators on social media to check their systems and to install the update as soon as it was out. This was the first time a head of state issued a warning about a security vulnerability.
- October 21, PHP released 8.5.12, 8.4.27, and 8.3.36. The same day, Amazon said publicly that they had seen attacks as early as the 17th, and the US CISA added both vulnerabilities to its KEV catalog.
- October 22, Taiwan's Administration for Cyber Security (Ministry of Digital Affairs) said that about 28,000 internet-facing websites in Taiwan use PHP, and about 200 of them are government agency sites. It asked for these to be patched first, and to suspend service if necessary.
- October 23, the PHP Foundation said there is another RCE (CVE-2026-115560) that will be handled in a later release. For now, setting
session.upload_progress.enabledto0can serve as a mitigation.
The attacks came three days before the announcement and four days before the patch.
Was the advance notice a good idea
Announcing a patch in advance is common. The point is to let operators schedule their time so they can apply the update as soon as it ships. The trouble with PHP this time is that the announcement told everyone a big release was coming, and then the details leaked. Defenders were waiting for the update while attackers were already using the flaw.
I don't think this means advance notices should stop. Without one, the admins of those 28,000 sites would probably have found out later and acted later still. But this made it clear that the few days between the announcement and the patch are the most dangerous. The only tools available in that window are a WAF and mitigation settings. If those are not enough, take the site offline, as the Administration for Cyber Security suggested.
A decade-old bug, found this time with AI
The two vulnerabilities were reported by Wiz, part of Google Cloud. Wiz says the problem goes back to PHP 5.4 in 2012. Their research team found them in late August using their own tool together with several AI models. Wiz's view is that AI has greatly lowered the bar for validating complex vulnerabilities, so a flaw that sat in the code for more than ten years became a working attack.
The same week also brought BlockStrap for Adobe Commerce. The security firm Sansec found four remote code execution paths in one day, and also noted that AI can be used to reverse-engineer patches.
So "wait for the patch, then schedule the work at your own pace" is no longer very safe. Once a patch is public, the location of the bug is public too, and the time needed to work out an attack from it gets very short.
Don't skip past this if you don't write PHP
On October 21, the same day, Node.js and Go also released security updates.
Node.js fixed 10 vulnerabilities, 4 of them high severity, affecting all currently supported branches: 22.x, 24.x, and 26.x. The one to watch most closely is CVE-2026-111497 in Brotli decompression, known as Node2Shell. During decompression it can write memory outside the intended range, and in serious cases this can lead to remote code execution. Separately, TLS may accept certificates that should not pass when a particular IP format is used, and DNS resolution truncates a domain name when it hits a NUL character. The fixed versions are 26.12.1, 24.22.1, and 22.23.4. The release also refreshed the certificate trust data to deal with the private key leak of an eMudhra intermediate certificate. Go released 1.26.10 and 1.27.3.
This site's build requires Node.js 22.18 or above. That is a handy way to write it, but it does not tell you whether the version you have installed includes the fix. Few people check which version the local machine and the build environment each run, so it's worth looking at both this time. For PHP, the one still unfixed is CVE-2026-115560. Remember to update again when the next version is out.
Sources:
- Security Weekly Report, October 19–22 (iThome, in Chinese)
- Two days after the PHP2Shell patch, the PHP Foundation warns of another unpatched remote code execution vulnerability (iThome, in Chinese)
- Node.js patches 4 high-severity vulnerabilities, Brotli decompression bug could let attackers execute code remotely (iThome, in Chinese)