What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained

What it is

Aikido's explainer on the "-Shell" class of remote code execution bugs, centred on two disclosed on 21 October 2026: PHP2Shell (CVE-2026-109618 and CVE-2026-109619) in PHP's engine, and Node2Shell (CVE-2026-111497, also called HTTP2Shell or Broccoli2Shell) in the Brotli decoder. It sets them beside Log4Shell (CVE-2021-44228) and React2Shell (CVE-2025-55182).

How it works

PHP2Shell: both bugs force PHP to run out of memory at a precise moment. The request dies partway and leaves a pointer to freed memory. The attacker's next request fills that memory with crafted data, and PHP reads it as one of its own internal objects. CVE-2026-109618 hits while request data is being set up. CVE-2026-109619 abuses state the worker keeps between requests, and session upload progress, enabled by default, is one confirmed path. The page says the demonstrated exploit against Apache with mod_php fires before any application code runs.

Node2Shell: crafted compressed data makes Brotli's decoder write past the end of a buffer. It works in both directions, so a malicious client can attack a server, and a malicious server can attack a client that accepts compressed responses. Express 5 and body-parser 2.x decode Brotli request bodies automatically, often before authentication. fetch() decodes responses the same way.

flowchart LR
    A[Malicious client request] --> B[Express 5 / body-parser 2.x Brotli decode]
    C[Malicious server response] --> D[fetch / requests / httpx decode]
    B --> E[Buffer overflow in Brotli]
    D --> E

Preconditions / Affected

• No login is needed for any of these bugs. One crafted request is enough.
• The PHP code dates to PHP 5.4 (2012), so it sat unfixed for 14 years.
• Brotli's decoder is built into Node.js, Bun, .NET and Envoy. In Python, requests and httpx load Brotli automatically when it is installed, and Scrapy installs it as a dependency. An app can be exposed without importing Brotli itself.
• Brotli's maintainers fixed the bug in source on 27 February 2026 without flagging it as a security issue. No release carried the fix until 21 October, so bundled copies stayed vulnerable for eight months.
• React2Shell reached default React 19 setups, even apps with no server functions. CISA lists it as exploited in real attacks.

What to do

• Inventory repos and images for vulnerable runtimes and transitive Brotli packages. Aikido names SCA and container image scanning for this.
• Patch. Brotli fixes exist for Node.js, Bun, Envoy, Istio, .NET, Python, Java brotli4j, libbrotli, Ubuntu and several Linux distributions. SUSE and the standard Red Hat Enterprise Linux repositories have no fix yet. Aikido keeps a live patch-status table. Its Node2Shell advisory lists fixed Node.js versions per release line.
• If you cannot upgrade, Aikido's free patched images on its public Amazon ECR cover PHP 5.5 through 8.5, except 8.0 and 8.1 for now. Its patched Node.js and Ubuntu images backport the Brotli fix, including for Node.js 18 and 20.
• Aikido offers a free PHP2Shell checker that tests a public URL.
• For Log4Shell, upgrade to Log4j 2.17.1, because 2.15.0 and the next fix were both bypassed. For React2Shell, a second upgrade was needed because CVE-2025-67779 bypassed the first patch.

Caveats

• Cloudflare reported PHP2Shell exploitation on 21 October, after details leaked ahead of the planned disclosure and PHP shipped fixes a day early.
• Researchers got Node2Shell code execution on an unmodified Node.js 24.22.0 image, but not on every attempt. Aikido says a crash or memory leak is the likelier real outcome.
• The page links to separate advisories for affected PHP versions and mitigations, and does not repeat them. Several mitigation and image details come from the vendor, Aikido, which sells the tools it recommends.