CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities ( KEV ) catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities ( KEV ) catalog.
The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, enable unauthenticated remote code execution on affected deployments - The addition of the two flaws to the KEV catalog comes after Adel Karimi, detection and response lead at Perplexity, confirmed successful instances of remote code execution against honeypot systems on October 24, 2026.
The issues have been addressed in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 released on October 21, 2026.
The severity of the vulnerabilities has prompted numerous advisories from software and security vendors and government agencies across the world, including - As of October 26, 2026, the PHP Foundation also released Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 to address CVE-2026-111497 , an out-of-bounds write vulnerability in the Brotli decoder library that could also result in privilege escalation and unauthenticated remote code execution.
It has been patched in versions 1.0.10, 1.1.1, and 1.2.1, along with other projects that include the C library, including Node.js, Bun, Envoy Proxy, Istio, .NET, and Python.
PHP, short for PHP: Hypertext Preprocessor, is a server-side scripting language used in roughly 70% of all websites on the internet; according to estimates shared by Censys, more than 32.51 million PHP services are still running an affected version.
The flaw can let an attacker corrupt memory and potentially run code; pHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically.
The vulnerability , also known as Broccoli2Shell, HTTP2Shell, and Node2Shell, affects Brotli versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0.
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497 , a flaw in the Brotli compression library that the packages include.
The rebuilt packages, numbered 8.5.12-1 , 8.4.27-1 , 8.3.36-1 and 8.2.35-1 , come five days after the October 21 releases that fixed the two PHP2Shell remote code execution flaws .
Federal agencies have time until October 29, 2026, to apply the necessary fixes; they use the same PHP source, so those fixes stay in place, and they now include Brotli 1.2.1 , the fixed version.
An attack would come as a crafted compressed response from a server that the PHP application contacts.
CISA's assessment of October 23 recorded no exploitation, and the flaw was not in its Known Exploited Vulnerabilities catalog as of that day's update.
What happened
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities ( KEV ) catalog.
The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, enable unauthenticated remote code execution on affected deployments - The addition of the two flaws to the KEV catalog comes after Adel Karimi, detection and response lead at Perplexity, confirmed successful instances of remote code execution against honeypot systems on October 24, 2026.
The issues have been addressed in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 released on October 21, 2026.
What changed
The severity of the vulnerabilities has prompted numerous advisories from software and security vendors and government agencies across the world, including - As of October 26, 2026, the PHP Foundation also released Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 to address CVE-2026-111497 , an out-of-bounds write vulnerability in the Brotli decoder library that could also result in privilege escalation and unauthenticated remote code execution.
It has been patched in versions 1.0.10, 1.1.1, and 1.2.1, along with other projects that include the C library, including Node.js, Bun, Envoy Proxy, Istio, .NET, and Python.
Who is affected
PHP, short for PHP: Hypertext Preprocessor, is a server-side scripting language used in roughly 70% of all websites on the internet; according to estimates shared by Censys, more than 32.51 million PHP services are still running an affected version.
Why it matters
The flaw can let an attacker corrupt memory and potentially run code; pHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically.
Technical details
The vulnerability , also known as Broccoli2Shell, HTTP2Shell, and Node2Shell, affects Brotli versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0.
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497 , a flaw in the Brotli compression library that the packages include.
The rebuilt packages, numbered 8.5.12-1 , 8.4.27-1 , 8.3.36-1 and 8.2.35-1 , come five days after the October 21 releases that fixed the two PHP2Shell remote code execution flaws .
Response
Federal agencies have time until October 29, 2026, to apply the necessary fixes; they use the same PHP source, so those fixes stay in place, and they now include Brotli 1.2.1 , the fixed version.
What security teams should do
An attack would come as a crafted compressed response from a server that the PHP application contacts.
CISA's assessment of October 23 recorded no exploitation, and the flaw was not in its Known Exploited Vulnerabilities catalog as of that day's update.
What remains unknown
OpenAI said it also kicked off a high-compute red-teaming campaign to test the resilience of its research and evaluation environments in the face of increasingly powerful models, leading to the discovery of previously unknown software vulnerabilities, including a critical unauthenticated remote code execution in Google Brotli ( CVE-2026-111497 , CVSS score: 9.2), a widely used compression library.
Attribution
The Hacker News: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities ( KEV ) catalog.
The Hacker News: PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497 , a flaw in the Brotli compression library that the packages include.
Rapid7: CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder On October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497 , an out-of-bounds write in the Brotli decoder bundled with Node.js.
BleepingComputer: A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.