PHP2Shell 與 Node2Shell：記憶體安全缺陷如何導致遠端程式執行

Two runtimes. Different memory-safety failures. One critical outcome: Remote Code Execution (RCE).

PHP2Shell and Node2Shell demonstrate how vulnerabilities in application runtimes can expose web servers to remote attacks. Both can lead to RCE, but their underlying weaknesses and exploitation paths are different.

Understanding these differences helps security teams assess exposure, prioritise remediation, and investigate potential exploitation.

1. PHP2Shell: When Error Handling Corrupts Memory

PHP2Shell refers to two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both carrying a CVSS v4.0 score of 9.2.

The vulnerabilities affect PHP’s internal request-processing and memory-management paths. They can allow unauthenticated attackers to trigger unsafe memory conditions through crafted HTTP requests.

CVE-2026-109618: Out-of-Memory Handling

PHP uses longjmp() in certain error-handling paths to transfer control when execution encounters a fatal condition.

An out-of-memory (OOM) condition can interrupt request processing while internal request data is only partially initialised. If subsequent cleanup code treats that data as valid, it can access an invalid memory state.

The security problem is not memory exhaustion alone. It is the failure to maintain memory safety when execution is interrupted.

Attack flow:Crafted HTTP Request | v PHP Request Processing | v Out-of-Memory Condition | v Partially Initialised State | v Unsafe Request Cleanup | v Memory Corruption | v Potential RCE

CVE-2026-109619: Stale Internal State

PHP maintains internal state associated with request processing. If a reference to request-owned memory survives after that memory has been freed, subsequent operations can encounter an invalid reference.

This is a use-after-free condition.Request A Allocates Memory | v Internal State References Memory | v Request A Completes | v Memory Is Freed | v Stale Reference Remains | v Later Access to Invalid Memory | v Potential Memory Corruption and RCE

The vulnerabilities affect different execution paths, but both demonstrate how incorrect memory-state management can expose the PHP runtime to remote exploitation.

2. Node2Shell: An Out-of-Bounds Write in Brotli

Node2Shell refers to CVE-2026-111497, a vulnerability in the Brotli decoder bundled with Node.js.

Brotli is a compression algorithm used to reduce data size. Node.js applications can process Brotli-compressed data through the node:zlib API, including data received from remote systems.

The vulnerability involves an out-of-bounds write in the decoder’s block-type switch handling.

An invalid block switch is incorrectly treated as a temporary request for more input rather than a permanent format error. The streaming decoder can consequently continue appending data to an internal eight-byte buffer.

When a vulnerable decoder processes specially crafted compressed input, it can write beyond the intended memory boundary and corrupt adjacent memory.

Attack flow:Attacker-Controlled Brotli Data | v Vulnerable Decoder | v Invalid Block Switch | v Out-of-Bounds Write | v Memory Corruption | +------+------+ | | | v v v Crash Memory Potential Exposure RCE

The Node.js security advisory confirms that the vulnerability can permit remote code execution.

Imperva also demonstrated RCE against a vulnerable official Node.js build. This establishes that successful exploitation is possible under demonstrated conditions, not that every application running a vulnerable version is automatically exploitable.

The relevant exposure is whether an application processes attacker-controlled Brotli data through the affected decoder.

3. PHP2Shell vs Node2Shell: Key Differences

PHP2Shell

• CVEs: CVE-2026-109618 and CVE-2026-109619.
• Affected component: PHP runtime.
• Root cause: Unsafe memory state during out-of-memory handling and request cleanup, including stale references.
• Trigger: Crafted HTTP requests reaching vulnerable PHP processing paths.
• Severity: CVSS v4.0 9.2 for each vulnerability.
• Potential impact: Remote code execution and sensitive memory disclosure.
• Primary remediation: Upgrade to a fixed PHP release.

Node2Shell

• CVE: CVE-2026-111497.
• Affected component: Brotli decoder bundled with Node.js.
• Root cause: Out-of-bounds write during decompression.
• Trigger: Malformed Brotli-compressed data processed by a vulnerable decoder.
• Severity: CVSS v3.1 9.8; the Node.js project classifies the issue as High.
• Potential impact: Remote code execution, memory disclosure, or process crashes.
• Primary remediation: Upgrade to a fixed Node.js release.

The key distinction: PHP2Shell involves unsafe memory states during request handling and cleanup. Node2Shell involves writing beyond an intended memory boundary in a decompression component.

Both can lead to RCE, but the underlying vulnerabilities and exploitation paths are different.

4. How Does Memory Corruption Become RCE?

A memory-safety flaw creates an opportunity for an attacker to influence how a program operates. Turning that opportunity into RCE requires additional exploitation conditions.

The process has three stages:

1. Trigger the vulnerability: Supply input that reaches the affected code path.
2. Corrupt memory: Cause an invalid memory access or write, or access memory after its lifetime has ended.
3. Influence execution: Exploit the resulting memory state to alter program behaviour and potentially execute attacker-controlled code.

Mitigations such as address-space layout randomisation (ASLR), non-executable memory, control-flow protections, and process isolation can make exploitation harder or reduce its impact.

However, their effectiveness depends on the vulnerability, runtime, operating system, and deployment configuration.

A crash alone does not prove RCE. Equally, the absence of a crash does not prove that exploitation failed.

5. Detection and Remediation

PHP2Shell: What to Investigate

• Unusual multipart HTTP requests and repeated malformed requests.
• PHP worker crashes, segmentation faults, or unexpected memory-exhaustion errors.
• Unexpected child processes launched by PHP or web-server workers.
• Suspicious outbound connections or unauthorised file changes.
• Evidence of unexpected command execution or access to sensitive application data.

Node2Shell: What to Investigate

• Unexpected errors or crashes during Brotli decompression.
• Abnormal Node.js process restarts.
• Unexpected child processes and outbound connections.
• Unauthorised changes to application files.
• Suspicious access to environment variables, credentials, or other sensitive data.

Correlate application logs with process telemetry, endpoint detection, and network records. Individual errors are indicators for investigation, not proof of successful exploitation.

PHP2Shell: Fixed Versions

The following releases contain fixes for CVE-2026-109618 and CVE-2026-109619:

• PHP 8.5: Upgrade to 8.5.12 or later.
• PHP 8.4: Upgrade to 8.4.27 or later.
• PHP 8.3: Upgrade to 8.3.36 or later.
• PHP 8.2: Upgrade to 8.2.35 or later.

The upstream PHP project has not released fixes for PHP 8.1 and older branches, which are end-of-life. Organisations using these versions should migrate to a supported release or follow their vendor’s security guidance.

Prioritise internet-facing PHP installations, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed deployments.

Node2Shell: Fixed Versions

The following Node.js releases contain the fix for CVE-2026-111497:

• Node.js 22.x: Upgrade to 22.23.4 or later.
• Node.js 24.x: Upgrade to 24.22.1 or later.
• Node.js 26.x: Upgrade to 26.12.1 or later.

Use the latest applicable security release rather than treating the minimum fixed version as the long-term target.

Applications using Node.js should also be assessed for paths that decompress attacker-controlled Brotli data, including responses retrieved from external services.

Additional PHP Alert: CVE-2026-115560

On 23 October 2026, the PHP security team disclosed another RCE issue, CVE-2026-115560.

This is separate from the two PHP2Shell vulnerabilities and is not fixed by the PHP releases listed above.

The issue requires an unusual combination of configuration and application behaviour involving the session serialization handler and session upload progress.

Until a security update is available, the PHP team recommends disabling session upload progress:session.upload_progress.enabled=0

The reported attack path requires the application to configure session.serialize_handler as php_binary or php_serialize, change it to php at runtime before calling session_start(), and leave session upload progress enabled.

Applications that never change the serialization handler at runtime are not exposed to this particular attack path.

Organisations should follow the PHP team’s advisory for further updates and retain the mitigation until an appropriate fix is available.

6. Defence in Depth

Patching is the primary remediation. Additional controls can reduce exposure and limit the impact of a successful compromise.

For PHP deployments:

• Inventory PHP versions across web servers, containers, and third-party products.
• Upgrade to the appropriate fixed release and restart affected services.
• Apply the session upload progress mitigation for CVE-2026-115560.
• Run PHP workers with the minimum privileges required.
• Restrict unnecessary outbound network access from application servers.

For Node.js deployments:

• Upgrade to a fixed Node.js release.
• Identify applications that decompress untrusted Brotli data.
• Apply sensible request-size and resource limits.
• Run application processes with least privilege and appropriate isolation.
• Monitor unexpected process creation, outbound connections, and changes to application files.

A web application firewall may provide additional protection against known attack patterns, but it is not a substitute for patching the underlying runtime.

After remediation, verify the runtime actually used by the application. Updating a package does not necessarily mean that an existing worker or container has started running the patched version.

If exploitation is suspected, preserve logs, investigate potential compromise, and rotate credentials that may have been exposed.

Conclusion

PHP2Shell and Node2Shell demonstrate two different routes from memory-safety failures to potential remote code execution.

PHP2Shell exposes weaknesses in PHP’s handling of interrupted request processing and stale internal state. Node2Shell exposes an out-of-bounds write in Node.js’s Brotli decoder.

The additional PHP vulnerability, CVE-2026-115560, reinforces the importance of following security advisories beyond the initial patch announcement.

The central lesson is straightforward: application security depends on the integrity of the runtime and native components underneath it.

Identify affected deployments, apply the appropriate fixes, verify the running versions, and investigate evidence of prior exploitation.