DEV Community

Cover image for Black October Vulnerabilities: PHP2Shell & Node2Shell Fix
Naveed Ahmed
Naveed Ahmed

Posted on Originally published at blog.naveedkumbhar.com

Black October Vulnerabilities: PHP2Shell & Node2Shell Fix

#security #php #node #devops

Originally published on Naveed Ahmed Tech Blog.

Black October vulnerabilities triage diagram showing PHP2Shell and Node2Shell Brotli RCE remediation architecture

In October 2026, the infrastructure security community absorbed a rapid run of critical remote code execution (RCE) disclosures dubbed Black October. Within a 48-hour window, the runtimes behind millions of production workloads (PHP, Node.js and Ruby) shipped emergency security releases. The Black October vulnerabilities, headlined by PHP2Shell and Node2Shell, are unauthenticated RCE flaws: an external attacker can compromise a backend service before your security team cycles its normal patch window.

For SREs, DevOps engineers and platform architects, the wave exposed how fragile it is to embed decoders and decompression libraries deep inside microservices. When the runtime's memory layer fails, a perimeter firewall offers no protection unless you also enforce application-layer countermeasures.

What Are the Black October Vulnerabilities?

The Black October vulnerabilities are a synchronized wave of critical, unauthenticated RCE flaws disclosed across foundational backend runtimes in October 2026. The main vectors are PHP2Shell (CVE-2026-109618/19) in PHP core and Node2Shell (CVE-2026-111497) in Node.js's native Brotli decoder. Both need container base image updates and proxy-level mitigations right away.

Unlike SQL injection or broken access control, this wave targeted low-level memory management and data-decoding routines built into the language executables. The attacker needs no session, API token or elevated role. A crafted payload over ordinary HTTP or HTTPS is enough to cause heap corruption, a memory overwrite or arbitrary code execution.

Teams running containers on AWS EKS, Google Cloud GKE or self-hosted Kubernetes faced the same problem: find every vulnerable base layer across thousands of running images, then roll out emergency deployments without regressions or downtime.

Attack and Mitigation Flow

Stage Layer What happens
1. Attack vector Unauthenticated request A crafted Brotli stream or malformed multipart header is sent to an exposed endpoint.
2. Edge ingress Reverse proxy filter NGINX or Envoy rejects client-side request compression and drops the malicious payload.
3. Container runtime Patched language engine PHP 8.4.27+ and Node.js 24.22.1+ enforce fixed buffer boundaries.
4. Sandboxing Pod Security Standards Read-only root filesystems and non-root users block secondary shell execution.

Black October CVE and Impact Matrix

To scope your exposure, classify each flaw by CVE, severity, vulnerable component and the minimum fixed release.

Vulnerability CVE CVSS Vulnerable component Minimum fixed version Attack vector
PHP2Shell (Vector A) CVE-2026-109618 9.2 Critical PHP core memory allocator 8.5.12, 8.4.27, 8.3.36, 8.2.35 Unauthenticated HTTP POST
PHP2Shell (Vector B) CVE-2026-109619 9.2 Critical Input sanitization stream handler 8.5.12, 8.4.27, 8.3.36, 8.2.35 Malformed multipart stream
Node2Shell (HTTP2Shell) CVE-2026-111497 9.1 Critical Bundled Brotli decoder 26.12.1, 24.22.1, 22.23.4 Compressed HTTP body or fetch()
Ruby2Shell parser flaw CVE-2026-113840 8.8 High Core string deserializer 3.5.2, 3.4.6, 3.3.8 Serialized object header

PHP2Shell Deep Dive: Root Cause and Container Fixes

PHP2Shell is two related RCE flaws (CVE-2026-109618 and CVE-2026-109619) caused by integer overflows and pointer reallocation miscalculations in PHP's native memory management. While parsing boundary-separated multipart streams, a malformed header length forces an out-of-bounds pointer write. That gives the attacker arbitrary code execution as the running php-fpm worker.

PHP runs legacy enterprise monoliths and modern containerized services alike, so the exposure is huge. No credentials are required, which makes it trivial for botnets and scanners to probe public IP ranges.

Auditing and Upgrading PHP Dockerfiles

Verify your base images and lockfiles point only at patched runtime versions. Here is a vulnerable Dockerfile next to the hardened one:

# VULNERABLE: unpinned or vulnerable PHP base image
FROM php:8.4.20-fpm-alpine
RUN docker-php-ext-install pdo pdo_mysql

# PATCHED: Black October secure patch level (8.4.27+)
FROM php:8.4.27-fpm-alpine3.21

# Enforce non-root execution context
RUN addgroup -g 10001 -S appgroup && \
    adduser -u 10001 -S appuser -G appgroup

USER 10001:10001
CMD ["php-fpm", "-F"]
Enter fullscreen mode Exit fullscreen mode

To find which runtime is actually running in your clusters, audit the live pod images with kubectl:

$ kubectl get pods -A -l app=api-backend -o jsonpath='{range .items[*]}{.metadata.namespace}{"/"}{.metadata.name}{": "}{.spec.containers[*].image}{"\n"}{end}'
production/api-backend-78f99bc7b-x4k2p: php:8.4.27-fpm-alpine3.21
production/api-backend-78f99bc7b-m9s1q: php:8.4.27-fpm-alpine3.21
staging/api-backend-67cd8b89c-d2j8w: php:8.4.20-fpm-alpine  # VULNERABLE RUNTIME DETECTED
Enter fullscreen mode Exit fullscreen mode

Any pod still on an unpatched version needs a rolling restart as soon as the updated tag is in your registry.

Node2Shell: The Brotli Decompression RCE Breakdown

Node2Shell (CVE-2026-111497) is an out-of-bounds write in the native Brotli decompression routine bundled with Node.js. Attackers send crafted Brotli-compressed HTTP payloads (for example with Content-Encoding: br), or poison third-party API responses read by backend fetch() calls. The write overruns adjacent heap chunks and hijacks execution flow.

Frameworks such as Express, Fastify and NestJS often decompress request bodies automatically, which created a zero-click exploitation path for external attackers.

Immediate Mitigation at the Reverse Proxy Layer

If rebuilding thousands of microservice images will take days, mitigate Node2Shell at the ingress controller or API gateway. Block client-side Brotli request compression before it reaches a Node.js process. This NGINX snippet rejects compressed request bodies and leaves outbound response compression alone:

# Reject client-supplied Brotli request bodies before they reach Node.js
map $http_content_encoding $block_compressed_request {
    default 0;
    "~*br"  1;
}

server {
    listen 8080;
    server_name api.enterprise.internal;

    location / {
        if ($block_compressed_request) {
            return 415 "Unsupported Media Type: Client request body compression disabled.";
        }

        proxy_pass http://node_backend_upstream;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}
Enter fullscreen mode Exit fullscreen mode

With this rule at your Kubernetes Ingress or Envoy gateway, malicious payloads are rejected at the edge and never reach the native decoder. It buys time; it does not replace upgrading to Node.js 22.23.4, 24.22.1 or 26.12.1.

How SRE Teams Can Automate Vulnerability Incident Response

The Black October vulnerabilities showed why vulnerability runbooks need automation. When dozens of services are flagged at once, manual triage leaves a latency window attackers can use to reach your databases.

Strong teams run autonomous verification pipelines that audit lockfiles and scan continuously. Our guide on how AI agents automate DevOps runbooks safely covers pairing declarative policy engines with sandboxed execution so CVE patches can be evaluated and staged automatically.

Restarts also carry risk. If the patch rollout triggers unexpected pod crashes, use the Kubernetes OOMKilled exit code 137 triage guide to tell memory limits apart from runtime decoder faults.

When planning isolation for exposed services, the CIDR subnet calculator helps you carve out segregated DMZ segments and VPC ingress boundaries.

Long-Term Architectural Takeaways from Black October

Emergency patching fixes the CVEs. Long-term resilience needs three architectural principles:

  1. Runtime seccomp and AppArmor profiles. Never run web containers with unconstrained syscalls. Strict seccomp filters restrict memory remapping and shell spawning even if a native buffer overflow fires.
  2. Read-only container root filesystems. Set readOnlyRootFilesystem: true in pod security contexts so an attacker cannot drop a secondary shell payload to disk after an RCE.
  3. Automated dependency supply chain gates. Use CI/CD admission controllers, with Trivy or Grype lockfile scans, to reject images built on unpatched base layers before they reach production namespaces.

These shifts also tie into the future of DevOps and platform engineering. Teams that invest in memory safety, automated CVE triage and defense-in-depth ingress will cope far better with the next disclosure wave.

Black October Vulnerabilities FAQ

What are the Black October vulnerabilities?

Black October is a compressed wave of critical, unauthenticated RCE vulnerabilities disclosed across foundational open-source runtimes in October 2026. The most prominent are PHP2Shell (CVE-2026-109618/19) in PHP core and Node2Shell (CVE-2026-111497) in Node.js's native Brotli decoder.

What is PHP2Shell and how is it exploited?

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of critical unauthenticated RCE flaws in PHP. Attackers exploit memory management errors during input processing to run arbitrary code. It carries a CVSS score of 9.2 and is fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

What is Node2Shell (HTTP2Shell) in Node.js?

Node2Shell (CVE-2026-111497) is an out-of-bounds write in the Brotli decompression library bundled with Node.js. Attackers trigger heap corruption and RCE with maliciously compressed request bodies or poisoned fetch() responses. It is fixed in Node.js 22.23.4, 24.22.1 and 26.12.1.

How can SREs mitigate Black October vulnerabilities without immediate downtime?

If you cannot rebuild every image at once, mitigate at the reverse proxy. For Node2Shell, reject or strip Brotli-compressed client request bodies at NGINX or Envoy, or enforce strict payload limits, so malicious streams never reach a vulnerable Node.js runtime.

Are Ruby and other runtimes affected by Black October?

Yes. The wave exposed memory corruption and parser safety flaws in several runtimes, including Ruby stream decoders and certificate validation chains. Enforce automated lockfile scans with Trivy or Grype in CI/CD to catch vulnerable dependencies.

Full runbook with every manifest and the patch matrix: Black October vulnerabilities: PHP2Shell and Node2Shell fix guide.

Connect with Naveed Ahmed

Top comments (0)