PHP2Shell and Node2Shell: Find, Fix, and Verify Across Your Web Apps and APIs
Source: Qualys Blog
At a glance
Key Takeaways Neither flaw is in your application code. Every app and API on a vulnerable runtime inherits the risk. PHP2Shell (CVE-2026-109618, CVE-2026-109619) is fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Node2Shell (CVE-2026-111497) is fixed in Node.js 22.23.4, 24.22.1, and 26.12.1. Both are on the CISA KEV list. PHP2Shell was added on October 26. Node2Shell followed on October 27. Qualys TotalAppSec tests the application and the APIs with four non-intrusive QIDs for detection of vulnerabilities and two intrusive QIDs for verification of the fix. Patching fixes the runtime. A rescan…