PHP2Shell and Node2Shell: Find, Fix, and Verify Across Your Web Apps and APIs

Key Takeaways Neither flaw is in your application code. Every app and API on a vulnerable runtime inherits the risk.  PHP2Shell (CVE-2026-109618, CVE-2026-109619) is fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.  Node2Shell (CVE-2026-111497) is fixed in Node.js 22.23.4, 24.22.1, and 26.12.1.  Both are on the CISA KEV list. PHP2Shell was added October 26. Node2Shell […]