AI Hacking Is Reality: What PHP2Shell and Node2Shell Mean for Your IT Security

“We're well positioned: the firewall is running, the backups are up to date, and we install updates regularly.” Managing directors and IT managers hear this sentence a lot. For a long time, it was a solid answer. October 21, 2026 showed where its limits lie.

On that day, two critical vulnerabilities buried deep in the foundations of the web became public: PHP2Shell in the PHP programming language and Node2Shell in the Brotli compression library. Germany's Federal Office for Information Security (BSI) issued warning level 3 (orange) for PHP2Shell. Around the world, government agencies, hospitals and companies took their websites offline as a precaution.

In Germany, the affected sites included those of the Thuringian State Chancellery and state police, as well as the city portal bremen.de and mainz.de. Internationally, government websites in the Netherlands and Finland, among others, went offline temporarily.

For decision-makers, one detail matters most: security researchers found both vulnerabilities with the help of AI models. That changes how quickly an inconspicuous bug turns into a real risk.

What Happened?

The suffix “2Shell” now stands for a particularly dangerous type of vulnerability: an attacker sends a crafted request to the server from outside and can use it to run their own code. No password or login is needed. At the end of 2025, React2Shell caused a stir in React and Next.js applications; in early 2026, security firms recorded 300,000 to 400,000 attack attempts against it every day.

Two more followed in October 2026:

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) sits in the core of PHP. Around 70 percent of all websites run on this language, including WordPress, TYPO3, Drupal, Joomla and many online shops and customer portals. With a manipulated upload request, an attacker can read the server's memory, such as passwords, tokens and API keys, and in some cases run their own code. All versions from PHP 5.4 onwards are affected.

Node2Shell (CVE-2026-111497, also called HTTP2Shell or Broccoli2Shell) sits in the Brotli decoder. Developed by Google, this compression technology makes data transfers on the web smaller and faster. The bug was discovered in Node.js, but any software that unpacks Brotli data from untrusted sources is affected: Python packages, Bun, .NET applications with Brotli decompression enabled, and HTTP servers, clients and proxies that embed Brotli.

So Node2Shell becomes dangerous wherever an application processes compressed data from outside. That can be incoming requests or responses from third-party servers that are unpacked automatically.

What both vulnerabilities have in common is that the bug sits one level below the code your developers write. With PHP2Shell, the attack takes effect before your application even runs. Even cleanly written software offers no protection as long as the runtime underneath is outdated.

The Turning Point: AI Makes Old Bugs Exploitable

The backstory of PHP2Shell shows what has changed. The bug sat in the code for 14 years. In 2024, a PHP core developer noticed the underlying weakness while fixing findings from an external security audit. Because nobody could prove it was exploitable, it was left as it was.

At the end of July 2026, the security firm Calif examined PHP's code as part of OpenAI's “Patch the Planet” initiative, using the AI model GPT-5.6 Sol as an assistant. Two days in, the researchers found the first trigger; just over two weeks after the start, they had a working attack as proof. Independently, the Wiz team found the same vulnerabilities, also using AI tools. The Brotli vulnerability was reported by researchers from OpenAI's Codex Security.

The division of roles matters: no AI went bug hunting on its own here. Experienced researchers searched in a targeted way, while the AI took tedious groundwork off their hands and sharply accelerated the proof of exploitability. According to the researchers, work that used to take months now shrinks to a few days.

That has consequences for everyone who runs software. Bugs that were previously considered theoretical but practically unexploitable have to be reassessed.

One detail of the Brotli vulnerability underlines this. The actual root cause had already been fixed in the public source code in February 2026. But nobody had realized it was a security vulnerability, and an official update only appeared in October.

Anyone who systematically searches older code changes with AI tools can find such silent fixes long before a warning is published. This time, the defenders got there first. That is not something to rely on.

How Fast Attackers React Today

With PHP2Shell, the coordinated disclosure did not go to plan. Details leaked on October 20, and PHP had to bring the updates forward. Amazon even observed the first attack attempt on October 17, four days before the patch.

Within hours of the release, more attack tools appeared and were immediately used widely against servers on the internet. Most of these early attempts failed, however, because the vulnerability is technically demanding to exploit.

On October 24, attackers achieved the first verifiably successful break-ins on test systems (honeypots). The US cybersecurity agency CISA now lists both PHP2Shell and Node2Shell as actively exploited vulnerabilities.

For companies, this means the time between a vulnerability becoming known and the first attacks is now hours rather than weeks. Sometimes the attacks even start earlier.

Three Assumptions That No Longer Hold

“Our firewall takes care of it.” A classic network firewall sees nothing but an ordinary upload request in PHP2Shell. Web application firewalls and CDN providers did quickly ship filter rules for known attack patterns. That bridges the time until the update, but does not replace it.

“We install updates once a quarter.” When attacks start a few hours after a disclosure, a rigid maintenance cycle is too slow. You need a process that gets critical security updates live within hours to a few days, without waiting for the next maintenance window.

“We take care of our own software.” Modern applications consist of many layers: operating system, runtime, libraries, container images. A library like Brotli often sits unseen inside other software that ships its own copy, and an operating system update does not reach those copies. If you don't know what is inside your systems, you can't tell in an emergency whether you are affected.

What You Should Do Now

If you haven't done so yet, these are the most important steps:

Take inventory. Where do PHP and Node.js run in your organization? Don't forget online shops, the intranet, old internal tools and systems that service providers manage for you.
Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. There is no official update for PHP 8.1 and older; the only fix is moving to a supported version. Updating WordPress, TYPO3 and the like is not enough on its own.
Update Node.js and Brotli: Node.js to 22.23.4, 24.22.1 or 26.12.1, Brotli to 1.0.10, 1.1.1 or 1.2.1, and the Python packages to Brotli 1.2.1 and brotlicffi 1.2.1.0. Microsoft has released an emergency update for .NET. Then rebuild and redeploy your container images.
Renew credentials. If servers were vulnerable before the update, replace the passwords, tokens and API keys that were held in their memory.
Look for traces, including in logs from before October 21. Warning signs include unusual upload requests followed by memory errors, clusters of HTTP 500 errors and web server processes that unexpectedly launch programs.
Check with your hosting provider. Get confirmation that the updates are installed, not just scheduled.

How q23 Supports You

PHP2Shell and Node2Shell show that security is increasingly decided below your own application. Here is how we support you:

Exposure check: We check which PHP, Node.js and library versions actually run in your applications and containers, and whether you are affected by PHP2Shell or Node2Shell.
Modernizing legacy systems: If your application still runs on PHP 8.1 or older, we move it to a supported version so that it receives security updates again.
Fast security updates: For systems we manage, we install critical security updates as soon as they are available instead of waiting for the next maintenance window.
Security from day one: In new projects, we rely on maintained versions, automated dependency checks and an architecture in which a single vulnerability does not open up the whole system.

Conclusion

PHP2Shell and Node2Shell won't be the last vulnerabilities of this kind. OpenAI President Greg Brockman expects many more such findings in the coming months. Companies should therefore know what runs in their systems and be able to install critical updates in hours rather than quarters.

Not sure whether your systems are affected? Get in touch. We'll tell you where you stand and what needs to be done.