Urgent Patch Alert: PHP2Shell, GitLab RCE, and Node.js Brotli RCE

Updated October 31, 2026. Fixes for the three original issues were released on October 21; follow-up guidance is included below.

Prioritize PHP2Shell, GitLab CVE-2026-110264, and Brotli CVE-2026-111497. Check exposure, update the affected software, and investigate prior activity.

Fixed versions at a glance

Use the fixed release for your branch or a later release containing the fix. Distribution backports may retain older upstream versions: verify the vendor advisory and package revision.

PHP2Shell: two critical PHP vulnerabilities

• CVE-2026-109618: memory corruption in out-of-memory handling.
• CVE-2026-109619: stale request-related global state causing use-after-free.

Both can allow unauthenticated RCE. PHP's warning covers PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. mod_php is the highest-risk deployment, with exploitation demonstrated before application code runs. For the OOM flaw, FPM susceptibility is based on source analysis; the advisory notes that a complete FPM exploit had not been demonstrated.

What has been observed

• Cloudflare: customer-targeted attack traffic, including payload changes to bypass protections; this does not establish successful compromise of every target.
• AWS MadPot: attempts on October 17, before disclosure, and October 21. AWS says real-world success is unclear. Include available logs from at least October 17 when investigating exposed PHP deployments.
• Unit 42, October 29: confirmed active PHP2Shell exploitation against internet-exposed PAN-OS management interfaces and independently verified the attacker tooling and results reported by Dream Research. Dream reports 25 firewall and management servers compromised through a chain with the Fragnesia Linux kernel privilege-escalation flaw (CVE-2026-46300). This is separate from the European-government incident in Unit 42’s retracted October 23 update, whose PHP2Shell initial-access attribution remains unconfirmed.
• CrowdStrike, October 23: no successful exploitation within its visibility; deployment differences constrain reliable exploitation. This is a dated, source-specific assessment.

CISA KEV: both CVEs were added October 26, with an October 29 deadline for covered US Federal Civilian Executive Branch (FCEB) agencies—not companies worldwide. IPA's October 27 update notes the listings. KEV confirms known exploitation, not a particular exploit path or shell access on every target.

Required action and separate session issue

PAN-OS operators: remove public internet access to management interfaces, restrict management access to trusted internal IPs, and apply the appropriate PAN-OS vendor hotfix from the Palo Alto Networks advisory. The generic PHP version table is not a PAN-OS upgrade guide. Investigate previously exposed devices; patching alone does not remove an existing compromise.

Update PHP itself and restart workers. Application/plugin updates, configuration changes, and WAF rules do not provide a complete substitute. For PHP 8.1 and older, use a confirmed vendor backport or a supported release. PHP offers minimal source backports for 7.4, 8.0, and 8.1 for source builders and users without LTS coverage; these do not restore ongoing support.

CVE-2026-115560 is separate and is not fixed by the PHP2Shell releases above. PHP's October 23 notice requires all three conditions:

1. session.serialize_handler initially uses php_binary or php_serialize.
2. Application code switches it to php via ini_set() before session_start().
3. Session upload progress remains enabled.

For affected configurations, keep session.upload_progress.enabled=0 until the regular bugfix release. PHP says applications that never switch serializers at runtime can leave it enabled.

Further reading: PHP2Shell analysis · Session-serializer analysis

Sources: PHP announcement · OOM advisory · Stale-state advisory

GitLab: CVE-2026-110264

An integer overflow in regular-expression compilation can, under certain conditions, allow unauthenticated code execution on GitLab CE/EE. Affected ranges extend back to 7.0; consult the official advisory for exact boundaries.

• Patch self-managed instances using the releases in the table and the supported upgrade/migration path. Older-branch backports address this critical issue, not necessarily every vulnerability in the release announcement. GitLab says GitLab.com and managed infrastructure, including Dedicated, are patched.
• Investigate anomalies: GitLab provides Onigmo native worker crash and Org mode render error burst detections. A crash or render error alone does not prove successful RCE.

Custom GitLab builds: confirm that the Ruby actually running GitLab contains the fixes. Alpine’s October 28 incident report describes attempts against the separate CVE-2026-97229: updating its custom image to GitLab 19.3.6 did not fix the unpatched Ruby. Alpine rebuilt the instance because successful code execution could not be ruled out, although it found no evidence of success. Users of alpinelinux/gitlab:19.3.6 must re-pull the image if obtained before October 27.

Other Ruby applications: Ruby's October 23 notice maps four GitLab CVEs, including this one, to three regexp-engine bugs. Ruby 4.0.9, 3.4.12, and 3.3.13 fix all three. Exposure requires compiling attacker-controlled patterns, not merely matching untrusted text against a fixed pattern. Regexp.timeout and pattern-length limits are unreliable mitigations: upgrade or stop compiling untrusted patterns. GitLab updates its bundled Ruby through its own releases. Ruby assigns no separate CVEs in this notice; track the GitLab IDs.

Node.js and other Brotli consumers: CVE-2026-111497

An out-of-bounds write in the Brotli decoder can permit RCE. Node.js identifies 26.x, 24.x, and 22.x as affected; fixed releases are in the first table.

Exposure requires decoding attacker-controlled Brotli data from requests, fetched responses, or files. Reachability depends on application processing; not every Node.js service is directly exploitable. As Vercel explains, inbound WAF coverage does not protect automatic decompression of fetched responses.

Other affected dependencies

Cross-project guidance, Google Brotli releases, and Python package releases identify these fixes:

• PHP Windows: the October 26 rebuilds bundle Brotli 1.2.1. The -1 changes the package build, not the PHP runtime version, and fixes Brotli separately from PHP2Shell. cURL exposes the decoder when automatic HTTP response decompression is enabled—off by default, but applications/libraries can enable it. Verify the package build as well as the runtime version.
• Python: urllib3 supports Brotli decoding when Brotli or brotlicffi is installed, so HTTP responses can reach the decoder without a direct Brotli API call. Check installed dependencies and untrusted-data paths, then update affected packages. This does not affect every Python installation.
• Envoy/Istio and embedded consumers: check whether Brotli decompression is enabled, including embedded runtimes and native bindings. Outgoing compression alone does not establish decoder exposure.

CISA KEV: CVE-2026-111497 was added October 27, with a November 10, 2026 deadline for covered FCEB agencies. This confirms exploitation of the library flaw, not successful attacks against every Node.js application or Brotli-consuming product.

Patch and temporary mitigation

Upgrade the Node.js runtime, including container base images, background workers, and CI environments; an npm update alone is insufficient. The Node.js security release also fixes high-severity TLS hostname-verification and DNS issues, so review it even without Brotli exposure.

Until patched, disable untrusted Brotli decoding on every affected path: reject inbound Content-Encoding: br before decompression and prevent automatic decoding of fetched responses. Removing br from Accept-Encoding alone does not enforce rejection. Preserve other supported compression where possible; WAF rules and request-size limits do not replace the fix.

What to do now

1. Inventory and prioritize: internet-facing PHP/GitLab, Ruby services compiling untrusted patterns, and services or clients decoding untrusted Brotli data. Assign owners.
2. Patch and restart: update software/runtimes, rebuild and redeploy containers, and restart affected processes.
3. Verify all replicas: inspect the running service's version and vendor package revision; the shell's runtime may differ.
4. Preserve logs and investigate: patching does not establish whether an earlier compromise occurred.

Follow the linked advisories for full affected-version ranges, upgrade requirements, and subsequent updates.