Urgent Patch Alert: PHP2Shell, GitLab RCE, and Node.js Brotli RCE

Updated October 24, 2026. Security fixes for the three original issues were released on October 21; subsequent guidance is summarized below.

Three code-execution risks deserve prompt attention: PHP2Shell, GitLab CVE-2026-110264, and Node.js CVE-2026-111497. Check your deployed versions, identify exposed services, and apply the relevant updates.

Fixed versions at a glance

Use the fixed release for your branch, or a later release containing the fix. For distribution packages, check the vendor's advisory and package revision: backported fixes may retain older upstream version numbers.

PHP2Shell: two critical PHP vulnerabilities

PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619:

• CVE-2026-109618: memory corruption associated with out-of-memory handling.
• CVE-2026-109619: stale request-related global state leading to use-after-free.

Both can allow unauthenticated remote code execution. PHP's warning covers web-serving installations, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.

PHP identifies mod_php as the highest-risk deployment, with an exploit demonstrated before application code runs. Exploitability differs by deployment: for the OOM flaw, the advisory describes FPM as susceptible based on source analysis, while noting that a complete FPM exploit had not been demonstrated.

Attack activity has been reported. Cloudflare states that it observed attack traffic targeting customers, including payload changes intended to bypass protections. That observation should not be presented as proof of successful compromise of every targeted server.

In its October 23 update, Unit 42 describes a European government intrusion involving credential access and Active Directory relay activity. The brief does not publish the initial-access CVE attribution evidence or establish widespread successful exploitation. CrowdStrike's October 23 assessment reports no successful exploitation within its own visibility and identifies barriers to reliable exploitation across different deployments. Treat these as dated, source-specific observations.

Update PHP itself and restart affected workers. Updating application code or plugins alone does not fix these runtime flaws. PHP says configuration changes do not provide a complete mitigation; WAF protection is an additional layer while patching.

For PHP 8.1 and older, obtain a confirmed vendor backport or move to a supported release.

Separate follow-up: PHP's October 23 notice identifies CVE-2026-115560, an unusual session-serializer configuration/runtime-switching path. PHP recommends keeping session.upload_progress.enabled=0 until the next regular bugfix release where applicable. This is separate from the two fixed PHP2Shell CVEs; see the detailed analysis below for the exact conditions.

For exploitation conditions, source-specific intrusion reports, and SOC investigation guidance, see my detailed PHP2Shell analysis.

Sources: PHP security announcement · OOM advisory · Stale-state advisory

GitLab: CVE-2026-110264

An integer overflow in regular-expression compilation can, under certain conditions, allow an unauthenticated attacker to execute arbitrary code on the GitLab server. GitLab rates it CVSS 3.1 10.0.

Affected GitLab CE/EE ranges extend back to 7.0; the advisory lists the exact boundaries. In addition to 19.5.1, 19.4.3, and 19.3.6, this critical fix is available in 19.2.9, 19.1.9, 19.0.10, and 18.11.13.

Prioritize self-managed instances. GitLab.com is already patched, and GitLab states that its managed infrastructure, including GitLab Dedicated, is patched.

Check upgrade-path and migration requirements before deployment. The older-branch backports listed here address this critical issue; they should not be treated as fixing every other vulnerability in the release announcement.

Official GitLab advisory

Node.js: CVE-2026-111497

An out-of-bounds write in the Brotli decoder can permit remote code execution. Node.js rates this issue High, and identifies 26.x, 24.x, and 22.x as affected release lines.

Update to 26.12.1, 24.22.1, or 22.23.4, as appropriate for your branch.

For exposure assessment, identify where your application or its dependencies decompress attacker-controlled Brotli data. This includes incoming request bodies, responses fetched from external servers, and files. Reachability depends on the application's processing paths; the advisory does not establish that every Node.js service is directly exploitable.

Fetched responses matter too. A backend that fetches an attacker-controlled response may decompress it automatically. Vercel's advisory explains that inbound WAF coverage does not protect this response path.

The underlying library is used beyond Node.js. Patch the Planet lists these additional fixes:

For Envoy and Istio, assess whether Brotli decompression is enabled. Check embedded runtimes and native bindings as well. Using Brotli only to compress outgoing data does not by itself establish exposure to the decoder flaw.

Until patched, disable Brotli decoding of untrusted data on every affected path. Reject inbound Content-Encoding: br before decompression, and prevent automatic Brotli decoding of fetched responses. Removing br from Accept-Encoding alone does not enforce rejection. Preserve other supported compression where possible; WAF rules and request-size limits do not replace the runtime fix.

Upgrade the Node.js runtime. An npm dependency update alone does not replace the runtime fix. Include container base images, background workers, and CI environments.

This release also fixes high-severity TLS hostname-verification and DNS issues, so review and apply the relevant security update even if your application does not use Brotli.

Official Node.js advisory and downloads

What to do now

1. Inventory and prioritize. Identify affected services and owners, starting with internet-facing GitLab and PHP, and affected services or clients that decode untrusted Brotli data.
2. Patch and restart. Upgrade the server software or runtime, rebuild and redeploy containers, and restart affected processes.
3. Verify every running instance. Check the actual service runtime or vendor package revision, including all replicas. A shell's version may differ from the application's.
4. Review evidence of prior activity. Preserve logs and investigate anomalies. Patching closes the vulnerability but does not establish whether an earlier compromise occurred.

This alert focuses on the three RCE topics above. Follow the linked advisories for full affected-version ranges, upgrade guidance, and subsequent updates.