PHP2Shell, Node2Shell & AI Agents: The Truth About the "Internet Is Down" Panic and How to Build Securely

Haroon Atieeq — Sun, 01 Nov 2026 12:04:47 +0000

The Verdict First:

Yes, websites really did go dark during the PHP crisis, but mostly because their owners switched them off on purpose, not because hackers knocked them down. Yes, AI agents really have compressed attacks from weeks into hours, but they still need the same old weaknesses (unpatched systems, stolen credentials, exposed services) to get in. And no, it is not true that "nothing is safe anymore." What is true is that unsafe development, especially AI generated code shipped without review, is now being punished faster than ever.

Part 1: Did PHP Really Take Down the Internet?

If you heard that "all government, university and big company websites went down because of PHP," you heard a story that is half true; and the half that is wrong matters.

What actually happened

On 21 October 2026, PHP released emergency fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. Both allow unauthenticated remote code execution (RCE) in the PHP interpreter itself, rated CVSS 9.2. The UK's National Cyber Security Centre (NCSC) advised that any organisation unable to apply the temporary mitigations quickly "should consider taking the system offline until it can be fully mitigated." CISA in the US later added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog on 26 October, with a 29 October remediation deadline for federal civilian agencies.

Many organisations followed that advice literally. Reported precautionary shutdowns include government portals in the Netherlands, Finland, France and Denmark, Denmark's national school communication platform, Dutch hospitals and the Port of Rotterdam, parts of the Wikimedia Foundation's systems, the Internet Archive (briefly), the BBC's web portals, several Japanese ministries, and UK bodies including the Office for Budget Responsibility and two councils. In the UK Parliament on 26 October, Baroness Berger said "advanced AI models had accelerated the discovery of long standing critical flaws in PHP, triggering global emergency patches and widespread server shutdowns," and that the government had confirmed 32 government services taken offline as a precaution on 22 October.

The three words everyone confuses

Word	What it means	Did it happen?
Vulnerable	The flaw exists on the system	Yes, Palo Alto Networks' Unit 42 counted 22.6 million potentially vulnerable instances. That is exposure, not compromise.
Offline	The site is unreachable	Yes, but mostly deliberately, as a precaution while patching. A switched off site is a defended site, not a defeated one.
Breached	Attackers got in and took control	No confirmed case on a named public website. Working shells were proven on honeypots on 24 October, and Cloudflare reported attack attempts rising from thousands to millions within hours of disclosure; however, attempts are probes, not takeovers.

Two honesty notes a professional article must carry: First, one early report attributing a European government intrusion to PHP2Shell was retracted on 25 October by its own authors, who could not confirm the initial access vector; so do not repeat it as fact. Second, the "32 government services" figure rests only on the parliamentary remark; searches of the UK government's own publishing platform return nothing for PHP2Shell or for that figure, and no department has published which services went dark or for how long. The shutdowns are real and widely reported; the precise UK count is unverified.

And did AI really find the bug?

Partly, and this matters. The flaws were found during a security audit in 2024 but were not fixed at the time because exploitability had not been demonstrated. In 2026, researchers at security firm Calyphe used an AI model to help achieve remote code execution and reported it to PHP's developers. So AI did not invent the vulnerability out of thin air; it closed the gap between "we suspect a flaw" and "here is a working exploit." That shrinking gap is the real story of this incident: the time between patch release and mass attack attempts is now measured in hours, not weeks. Amazon's sensors recorded the first exploit attempt on 17 October, four days before public disclosure.

Part 2: The Two Runtime Crises, in Brief

PHP2Shell & Node2Shell Breakdown

Vulnerability	Target & Scope	Fixed Versions	Key Mitigation Trap
PHP2Shell (CVE-2026-109618, CVE-2026-109619; CVSS 9.2)	PHP Interpreter (Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed)	`8.2.35, 8.3.36, 8.4.27, 8.5.12`	Updating WordPress, Drupal or Laravel does not fix it; requires a runtime upgrade + restarting all PHP workers.
PHP Session Flaw (CVE-2026-115560)	PHP Session Upload Progress	Unpatched in above releases	Must manually set `session.upload_progress.enabled=0`.
Node2Shell (CVE-2026-111497; CVSS 9.2)	Google Brotli decoder compiled inside Node.js, Bun, Python Brotli, Envoy, Istio	`22.23.4, 24.22.1, 26.12.1`	Standard `npm audit` does not detect it because the flaw is in the runtime binary. Check `node -v` directly.

PHP2Shell (CVE-2026-109618 + CVE-2026-109619, CVSS 9.2): A flaw in the interpreter, not in your app. It affects every PHP installation serving web requests: Apache mod_php (highest risk, because the exploit can fire before application code runs), PHP-FPM, php-cgi, FrankenPHP, LiteSpeed. Fixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12. Updating WordPress, Drupal or Laravel does not fix it; only a runtime upgrade plus a restart of every PHP worker does. A separate session flaw, CVE-2026-115560, is not fixed by those releases; its official mitigation is session.upload_progress.enabled=0.
Node2Shell (CVE-2026-111497, CVSS 9.2): The same week, a critical out of bounds write in Google's Brotli decoder, compiled inside the Node.js binary, allowed unauthenticated remote code execution, demonstrated against unpatched Node.js. Fixed in 22.23.4, 24.22.1, 26.12.1. The same decoder ships in Bun, Python Brotli packages, Envoy and Istio, so each product needs its own update. Note the trap: standard npm audit does not detect it, because the flaw is in the runtime binary, not in a package. Only checking the Node.js version itself finds it.
The parallel npm storm matters too: The ChainDrop supply chain campaign (August 2026) pushed roughly 2,200 malicious package versions across an estimated 400 to 1,300+ packages with around 2 billion monthly downloads, starting from one compromised maintainer account; and its packages carried valid provenance attestations. Darkroom hid PowerShell commands inside JPEG images in 19 fake dotenv packages. And critical command injection flaws in Node.js ffmpeg wrappers scored up to 9.8 (CVE-2026-110644).

Part 3: AI Agents | From Months to Hours. How True Is It?

The claim going around is that an AI agent can now do in minutes what took a hacker a month. The verified evidence says: the direction is true, the wording is exaggerated.

Anthropic's September 2026 threat intelligence report coined the term "vibe hacking": a human gives an AI agent a broad objective, and the agent explores the target, writes its own scripts, tests vulnerabilities, and pivots when blocked; without sleep, and against many victims in parallel. Documented cases include:

One stolen developer token turned into full administrative control of a cloud environment in roughly 3 hours.
The ShinyHunters group allegedly used AI to extract over 2,100 Azure AD tokens across 40 corporate cloud environments in 34 hours.
A Chinese speaking group used swarms of agents, with a lead agent splitting work among sub agents, against about 50 organisations, discovering more than a dozen previously unknown vulnerabilities in network equipment in a month.
Check Point Research recorded AI autonomously executed attacks on nine Mexican government agencies, with roughly 400 million tax, civil registry, vehicle, patient and electoral records compromised between December 2025 and February 2026.
Anthropic also found that the freely downloadable model GLM-5.3 could autonomously chain the steps of a real cyberattack, and that simple jailbreaks bypassed its safety filters in 64% to 100% of simulated tests.

What Changed vs. What Did NOT Change

So "months into hours" is real for operations that previously needed a team. But here is what the same reports also say, and what the panic posts leave out:

The old way	The AI way	What did NOT change
A team spent weeks on recon, scripting, and pivoting	One operator runs agents against dozens of victims at once	The entry point is still familiar: stolen credentials, unpatched systems, exposed services, SQL injection, phishing
Exploit development was the bottleneck	AI writes and rewrites payloads, even recompiling malware when it gets flagged	MFA, patching, and closed off services still block the attack; agents do not magically bypass a patched, well configured system
Attacks were limited by human hours	Attacks are limited only by compute	Defenders got the same tools: OpenAI's GPT-5.6-Cyber, for approved professionals, found previously unknown Chrome engine vulnerabilities that Google then fixed

Recon & Scale:
- The old way: A team spent weeks on recon, scripting, and pivoting.
- The AI way: One operator runs agents against dozens of victims at once.
- What did NOT change: The entry point is still familiar: stolen credentials, unpatched systems, exposed services, SQL injection, phishing.
Exploit Development:
- The old way: Exploit development was the bottleneck.
- The AI way: AI writes and rewrites payloads, even recompiling malware when it gets flagged.
- What did NOT change: MFA, patching, and closed off services still block the attack. Agents do not magically bypass a patched, well configured system.
Speed & Compute:
- The old way: Attacks were limited by human hours.
- The AI way: Attacks are limited only by compute.
- What did NOT change: Defenders got the same tools: OpenAI's GPT-5.6-Cyber, for approved professionals, found previously unknown Chrome engine vulnerabilities that Google then fixed.

The honest verdict: AI erased the labour cost of attacking, not the need for a vulnerability. A patched PHP server is not exploitable by PHP2Shell no matter how advanced the agent is. An agent with a stolen token and no MFA in its way is devastating. The risk did not become infinite; it became fast, cheap, and parallel. That is why patch speed and credential hygiene are now survival skills, not best practices.

Part 4: The Professional Developer's Security Terms

If you build websites, web apps, or mobile apps, with AI or without it, treat the following as your terms and conditions. These are not suggestions; in 2026, each one maps to a breach class that is actively being exploited.

AI output is a draft, never a release. Every line of AI generated code gets a human security review before it ships. If you cannot explain what a function does, you cannot ship it.
No secrets in code, and no secrets in the client. No API keys, passwords, tokens, or private keys in source code, in Git history, or inside an app package. Secrets live in a vault or environment, and the client gets short lived tokens, not master keys.
Authenticate every request; and then authorize it. Login alone is not enough. Every request must also prove the user is allowed to touch that specific resource, or you have an IDOR vulnerability (the second most common flaw class found in AI built apps).
Never build queries or commands from user input. Parameterized queries only. Never interpolate user input into a shell command; use argument arrays (execFile, not exec). This one rule kills SQL injection and the entire ffmpeg wrapper CVE class.
Patch runtimes on a deadline, not on a schedule. When a runtime CVE lands in CISA KEV, treat it like a fire: inventory, patch, restart workers, verify. "We updated the app" is not an answer when the runtime is the flaw.
Dependencies are code you did not write but still own. Pin versions, keep a lockfile, audit on every build, remove what you do not use, and verify provenance; remembering ChainDrop proved that a valid attestation does not mean a trustworthy package.
Rate limit everything public. Login, signup, password reset, search, uploads, APIs. Missing rate limiting was the single most common flaw class (93 of 434) in one audit of AI built apps; and it turns a small bug into a denial of service or credential stuffing incident.
Security headers and CSP are not optional. A Content Security Policy (CSP), HSTS, and modern headers cost minutes to add and blunt entire classes of XSS and clickjacking.
Test before you launch, in proportion to the risk. Anything handling users, personal data, or payments gets a security scan (SAST/DAST) and, before real customers, a penetration test. Shipping untested is how a vibe coded SaaS reached launch week with 23 security issues, 6 of them critical, that its founder knew nothing about.
Plan for the breach you hope never happens. Logging and monitoring, backups you have actually restored, an incident contact list, and a way to revoke tokens and rotate secrets in minutes. AI speed attacks mean detection time is now measured in hours.

Part 5: Node.js | Secure Development Tips

Node.js is not "no longer secure." It is a powerful runtime that punishes careless defaults, and October 2026 gave us the exact checklist:

Check the runtime, not just the packages. Run node -v in CI and fail the build below 22.23.4 / 24.22.1 / 26.12.1 (or newer patched releases). Remember npm audit is blind to Node2Shell.
Never pass user input to a shell. The ffmpeg wrapper CVEs (up to 9.8) came from interpolating file names into shell commands. Use execFile with an argument array, and validate file names against an allowlist.
Validate all input at the boundary. Use a schema validator for every API body, query, and parameter. Reject what you do not expect; do not sanitize and hope.
Hash passwords with Argon2 or bcrypt, never MD5/SHA1. Set short JWT expiry, rotate refresh tokens, and store tokens server side where possible.
Helmet + CSP + rate limiting on every Express/Fastify app, from day one; not as a "hardening sprint" later.
Secrets in environment or a vault, never in the repo. Scan every commit for secrets; rotate anything that was ever committed.
Update frameworks too. Next.js 16.2.0 to 16.3.5 had a critical ImageResponse/SVG flaw (fixed in 16.3.6). Your framework is part of your attack surface.
Log security events, and read the logs. Failed logins, token misuse, input validation failures, worker processes spawning shells; if you are not watching, you will not know you were the honeypot story.

Part 6: Vibe Coding, "Zero Code Developers," and the Android Data Leak Problem

This is the trend the security industry is most worried about, and the data is now unusually clear.

AI Generated Code Vulnerability Benchmarks (2025 to 2026)

Research Source	Sample Tested	Key Security Findings
Veracode (March 2026 Update)	100+ LLMs across 80 coding tasks	45% failed security tests (XSS failures at 86%, log injection at 88%). Pass rate remained unchanged despite better functional scores.
Symbiotic Security Study (2026)	1,967 repositories & 1,072 live vibe coded apps	AI assisted repos averaged 42.3 vulnerabilities vs 9.6 for human code (4.4x). Among live apps: 98% vulnerable, 29% high/critical, 16% allowed unauthenticated data deletion/modification.
Tenzai Benchmark (Dec 2025)	5 leading tools (Claude Code, Codex, Cursor, Replit, Devin) across 15 apps	69 vulnerabilities found (most serious in API authorization & business logic). 0 of 15 apps implemented CSRF protection or security headers.
Georgia Tech Vibe Security Radar (2026)	Public CVEs traced to AI introduced code	Climbing monthly (6 in Jan, 15 in Feb, 35 in March 2026); true count estimated 5x to 10x higher.

Why does AI fail this way? Because it optimizes for "the feature works," not for "the feature is safe." It writes the happy path and skips the hostile path: missing authorization checks, unvalidated input, no rate limits, hardcoded secrets, weak crypto. And it lacks the context a human developer has; what a user should be allowed to do in a specific business workflow. That is why business logic and authorization flaws dominate AI built apps while generic SQLi/XSS are actually handled reasonably well.

Android is where this bites users hardest

An APK is not a secret: anyone who downloads it can unpack it. OWASP's mobile guidance (MASWE-0004) is explicit; sensitive data hardcoded in the app package, from API keys to private keys, is recoverable by anyone with the package. The recurring findings in real Android pentests are:

Hardcoded secrets: API keys, Firebase/Stripe/Map keys, cloud credentials baked into the app. Attackers extract them and abuse the service, steal data, or run up the developer's bill.
Insecure storage: Tokens, personal data, and full API responses cached unencrypted in SharedPreferences, SQLite, or external storage.
Exported components: Activities, content providers, and receivers that any other app on the device can invoke to bypass login or read data.
Cleartext traffic and broken TLS: Sensitive data crossing hostile networks unprotected.
Trusting the client: Price checks, "premium" gating, and business rules enforced only in the app, which the attacker fully controls.

The Android secure development checklist:

Never ship secrets in the app. Sensitive operations go through your backend; the app holds short lived tokens only.
Store sensitive data with the Android Keystore and encrypted storage (EncryptedSharedPreferences), preferring hardware backed keys (TEE/StrongBox) where available.
Keep permissions minimal, export no component you do not have to, and validate every incoming intent.
Enforce HTTPS with certificate pinning for sensitive APIs; never accept invalid certificates.
Strip logs from production builds; logcat leaks tokens and internal details.
Treat the client as untrusted: every rule that matters is enforced on the server.

A note for users, not just developers: install apps only from the official Play Store, check what permissions an app asks for against what it actually does, and be suspicious of sideloaded apps promising premium features for free; an untrusted app with broad permissions and an insecure backend is exactly how personal data, photos, messages, and tokens leak.

Frequently Asked Questions

Q: So did PHP take down all government and university websites?

No. Many sites went offline as a precaution while patching (government portals, a national school platform, hospitals, Wikimedia systems) following official advice to take unpatchable systems offline. That is very different from hackers taking them down, and no named public website has been confirmed breached through PHP2Shell.

Q: Can an AI agent really hack any website in minutes?

No. AI agents have genuinely compressed multi week team operations into hours, but they still need a way in: an unpatched flaw, a stolen credential, an exposed service. A patched, MFA protected, well configured system still stops them. Speed is real; magic is not.

Q: Is Node.js unsafe now?

No, but unpatched Node.js is. Update the runtime (Node2Shell), never feed user input to a shell, validate everything, and audit dependencies. Node.js's risk in 2026 is mostly supply chain and defaults, both fixable.

Q: Is it safe to ship an app built entirely with AI tools?

Not without review. The data says AI built apps carry several times more vulnerabilities, especially authorization and business logic flaws. Use AI to write faster, then apply the Part 4 terms: review, test, scan, and pentest before real users and real data.

Q: Can my data leak from an Android app I installed?

Yes, if the app is insecure or untrusted: hardcoded keys, unencrypted storage, excessive permissions, and weak backends all leak data. Stick to the official store, check permissions, and avoid sideloaded "free premium" apps.

Q: What is the single most important thing to do on Monday morning?

Inventory your runtimes. Run php -v and node -v everywhere, including appliances and containers. Patch what is below the fixed versions, restart the workers, and then hunt for signs someone got in before you patched. Everything else follows from knowing what you actually run.

The Bigger Lesson

October 2026 did not prove that the internet is broken. It proved that the internet is shared: one interpreter, one decoder library, one maintainer account; each quietly becomes millions of organisations' problem overnight. And it proved that AI has changed the tempo on both sides: attacks now arrive in hours, and defences must move at the same speed. The teams that came through this month best were not the ones with the most tools. They were the ones who knew their inventory, patched the runtime instead of just the app, never trusted the client, and never shipped code (human or AI written) that nobody had reviewed.

Know your inventory. Patch the runtime. Review the code. Trust nothing the client tells you. That is how you stay safe when the machines on both sides are getting faster.

About the Author

Haroon Atieeq is a Penetration Tester specializing in black box and grey box web and network VAPT (OWASP WSTG, PTES, NIST SP 800-115), and the founder of HackThePlace, a multi domain, real world scenario training platform for cybersecurity, AI, networking, and cloud security. He writes about the vulnerabilities that actually get exploited, and the defenses that actually work.

Your turn: Are you researching PHP2Shell, Node2Shell, AI agent attacks, or vibe coding security? Publish your own analysis on HackThePlace, share your detection ideas in the discussion below, and help the community patch faster than the attackers move.

Sources & Further Reading

CISA confirms PHP2Shell under attack (The Register): https://www.theregister.com/cyber-crime/2026/10/27/cisa-confirms-php2shell-under-attack-as-researchers-clock-successful-exploits/5305681
PHP2Shell FAQ (Tenable): https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote
PHP2Shell timeline and exposure (SOCRadar): https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/?ref=metacurity.com
NCSC advice, Lords statement, and the "32 services" question: https://www.yeandel.co.uk/22-q3-2026-updates/four-days-before-the-advisory.html
Precautionary shutdowns | vulnerable vs offline vs breached: https://utilforge.org/learn/php2shell-what-website-owners-and-visitors-should-do
The vulnerable/offline/breached distinction: https://hls.today/news/php2shell-warning-critical-vulnerabilities-in-php/
WordPress exposure and the retracted attribution: https://jenisystems.com/news/php2shell-attacks-wordpress-websites/
Anthropic "vibe hacking" report coverage: https://gulfnews.com/technology/hackers-are-using-ai-agents-to-breach-companies-in-just-hours-anthropic-says-1.500683637
AI agents, scale, and the GLM-5.3 findings: https://www.straitstimes.com/tech/how-runaway-ai-agents-could-pose-an-existential-threat-to-humanity
Vibe coding tools and critical flaws (Tenzai study): https://www.infoworld.com/article/4116937/output-from-vibe-coding-tools-prone-to-critical-security-flaws-study-finds-2.html
Vibe coding vulnerability data (Veracode, CodeRabbit, Georgia Tech): https://policyascode.dev/blog/vibe-coding-security-risks-2026/
AI assisted code at scale (Symbiotic Security study): https://0e190a550a8c4c8c4b93-fcd009c875a5577fd4fe2f5b7e3bf4eb.ssl.cf2.rackcdn.com/EINPresswire-935728867-ai-assisted-code-introduces-4-4x-more-security-vulnerabilities-than-human-written-code-new-research-finds-2.pdf
Brotli flaw in Node.js, Bun, Python, Envoy (CVE-2026-111497): https://aviatrix.ai/threat-research-center/brotli-decoder-flaw-cve-2026-111497-nodejs-rce-bun-python-2026/
Inside the ChainDrop supply chain attack: https://innovatecybersecurity.com/news/inside-the-chaindrop-supply-chain-attack/
OWASP mobile guidance | hardcoded data in the app package: https://mas.owasp.org/MASWE/MASVS-STORAGE/MASWE-0004/
Android insecure API usage (official Android docs): https://developer.android.com/privacy-and-security/risks/insecure-api-usage?authuser=0000

Defensive analysis only; this article contains no exploit code. Facts verified **28 October 2026; always confirm against the vendor advisory for your exact version before acting.

Originally published on HackThePlace Threat Intel Blog.

Want to practice hands-on OWASP Top 10 web exploitation and defense in isolated, containerized sandboxes? Test your skills for free on HackThePlace — Enterprise CTF & Cyber Range Platform.

DEV Community: Haroon Atieeq