PHP2Shell and Node2Shell: Find, Fix, and Verify Across Your Web Apps and APIs
Key Takeaways Neither flaw is in your application code. Every app and API on a vulnerable runtime inherits the risk. PHP2Shell (CVE-2026-109618, CVE-2026-109619) is fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Node2Shell (CVE-2026-111497) is fixed in Node.js 22.23.4, 24.22.1, and 26.12.1. Both are on the CISA KEV list. PHP2Shell was added on October 26. […]
Read at Qualys Threat Research Unit
- Vendor
- Node.js, PHP
- Product
- Node.js, PHP
- EPSS
- 0.83 (p100)
- Fix
- available
- Exposure class
- Developer platform, Web platform
Why it ranks 54 (High)
- EPSS 0.83 (high probability of exploitation)
- Product class: developer platform, web platform
- Covered by 42 independent sources
- Fix available
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Qualys Threat Research Unit (blog.qualys.com)
- CVE-2026-109618 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-109619 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-111497 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.