From React2Shell to PHP2Shell and GitLab: October 2026's Wave of Critical RCE Attacks

In October 2026, PHP, Node.js and GitLab all shipped emergency patches for critical remote code execution bugs. Public exploit code appeared within about a day for several of them, and PHP2Shell and a GitLab file-read flaw are already confirmed exploited in the wild. If you run PHP, Node.js, Python services or self-managed GitLab in production, patch this week.

The “2Shell” naming started with React2Shell in December 2025. The pattern has repeated since: a bug deep in a runtime, library or platform, reachable from the network, ending in a shell on your server. Here is what happened, how to tell if you are exposed, and what to do today.

What happened

Four families of bugs, one pattern. Each is critical, reachable over the network, and rated 9.2 or higher. Here is where each stands as of 27 October 2026.

PHP2Shell — CVE-2026-109618, CVE-2026-109619

• Affects: PHP request handling in mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed
• Severity: CVSS 9.2 (v4)
• Fixed in: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35
• Status: Exploited in the wild; RCE confirmed on honeypots (Qualys)

Node2Shell / HTTP2Shell — CVE-2026-111497

• Affects: Google’s Brotli decoder (1.0.3 to 1.2.0), bundled in Node.js, Bun and Python’s Brotli packages
• Severity: CVSS 9.2 (v4)
• Fixed in: Node.js 22.23.4, 24.22.1, 26.12.1; Bun 1.4.4; Python Brotli 1.2.1 and brotlicffi 1.2.1.0
• Status: Public PoCs; no confirmed in-the-wild RCE yet (Akamai, Strobes)

GitLab — four critical flaws in six weeks

• CVE-2026-85706 (CVSS 10.0): Unauthenticated path traversal in the repository commits API lets attackers read any file on the server, including secrets. Fixed in 19.3.2, 19.2.6 and 19.1.8. Exploited in the wild and in CISA’s KEV catalog (InfoQ).
• CVE-2026-90970 (CVSS 9.9): Command execution in the self-hosted AI Gateway via crafted Duo Agent Platform flows. Fixed in 19.2.4, 19.3.2 and 19.4.1 (The Hacker News).
• CVE-2026-97229 (CVSS 10.0): A crafted regex in .gitlab-ci.yml triggers an integer overflow and code execution. Fixed in 19.2.8, 19.3.5 and 19.4.2 (Help Net Security).
• CVE-2026-110264 (CVSS 10.0): An integer overflow in GitLab’s regular expression compiler, present back to GitLab 7.0, allows unauthenticated RCE. Fixed in 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1 (GBHackers).

GitLab.com and GitLab Dedicated are already patched. Self-managed instances are the ones at risk.

React2Shell — CVE-2025-55182

• Affects: React Server Components (Next.js, React Router, Waku and others)
• Severity: CVSS 10.0
• Fixed in: React 19.0.1, 19.1.2, 19.2.1
• Status: In CISA’s Known Exploited Vulnerabilities catalog since 5 Dec 2025 (Rapid7)

The timeline moved fast:

• 11 Sep: GitLab patched CVE-2026-85706; watchTowr saw in-the-wild probes within hours of disclosure.
• 2 Oct: GitLab disclosed the AI Gateway flaw, CVE-2026-90970.
• 12 Oct: GitLab patched the CI/CD regex flaw, CVE-2026-97229.
• 17 Oct: Amazon Threat Intelligence saw attackers probing the PHP flaws, about four days before patches shipped (BleepingComputer).
• 21 Oct: PHP, Node.js and GitLab all shipped critical fixes on the same day. The first public Node2Shell repo appeared about five hours after the Node.js release (Sysdig).
• 22–23 Oct: Bun and Python’s Brotli packages shipped fixes, and the bug was renamed HTTP2Shell. The PHP Foundation warned of a third PHP RCE, CVE-2026-115560 (The Hacker News).
• 24 Oct: A researcher’s honeypot recorded what appears to be the first successful in-the-wild PHP2Shell RCE, on Apache mod_php running PHP 8.4.26.

How the attacks work

In most cases, the server processes attacker-controlled input before your application code ever runs. No bug in your code, no misconfiguration needed.

• PHP2Shell abuses request lifecycle bugs. In CVE-2026-109618, an out-of-memory bailout leaves request data half-initialized, and shutdown treats it as valid. In CVE-2026-109619, request state survives after its memory is freed, so the next request on the same worker reads it. That leak can expose passwords, tokens and API keys, and gives attackers the addresses they need for code execution.
• Node2Shell / HTTP2Shell is an out-of-bounds write in the Brotli decoder. Malformed Brotli data makes it write past an 8-byte buffer. You are exposed if you decompress untrusted Brotli: Express 5 and body-parser 2 decode Content-Encoding: br request bodies by default, and fetch(), Python’s urllib3, requests, aiohttp and httpx auto-decompress responses from servers you call.
• GitLab flaws hit the platform itself. One reads arbitrary files through the commits API with no login. Two turn a crafted regular expression into an integer overflow and code execution. One abuses AI Gateway prompt templates. A compromised GitLab hands attackers your source code, CI/CD variables, deploy tokens and SSH keys.
• React2Shell is unsafe deserialization in the React Server Components protocol. A crafted request to any app that supports Server Components can execute code, even without explicit Server Function endpoints.

The lesson for engineering teams: your attack surface includes the runtime, the compression library, the framework’s wire protocol and your CI/CD platform, not just the routes you wrote.

What attackers are doing

Scanning started before some patches, and the first stage is quiet reconnaissance. The second stage is credential theft and lateral movement.

• Fingerprinting at scale. Cloudflare reported millions of PHP2Shell attempts after disclosure. CYFIRMA tracked a paced, low-volume campaign across 21 compromised nodes, assessed with moderate confidence as linked to the Lazarus Group ecosystem. It found 216 exposed hosts across sectors, including targets in India.
• Secret harvesting from GitLab. Attackers probed CVE-2026-85706 within hours. Reading server files gives them configuration and secrets that lead to CI/CD pipeline compromise.
• Callback payloads. Honeypot commands used php -r, curl or wget to fetch /pwn-<host> URLs, sometimes appending $(id -un) to confirm the running user.
• Remote access tools. React2Shell payloads deployed MeshAgent remote-control software within days of disclosure.
• Fast escalation. In one European government incident, attackers reached password hashes, MFA secrets and an NTLM relay into Active Directory within two hours. Unit 42 later said it could not confirm PHP2Shell was the entry point, but the speed is the point.

For Node.js, Sysdig expects the usual post-exploit signals: interactive shells, malware downloads, cryptominers and theft of cloud tokens.

Are you affected?

You are exposed if any of these is true. Check every image and host, not just your main app.

• PHP: Any internet-facing PHP below 8.5.12, 8.4.27, 8.3.36 or 8.2.35, served through mod_php, PHP-FPM, php-cgi, FrankenPHP or LiteSpeed.
• Old PHP: Any PHP 7.4, 8.0 or 8.1. Upstream only offers limited backports, so check your distro or vendor build.
• Node.js: Any version below 22.23.4, 24.22.1 or 26.12.1, or any end-of-life line (25.x, 23.x, 20.x and older). These get no fix.
• Bun and Python: Bun 1.4.3 or older, Python Brotli 1.2.0 or older, or brotlicffi before 1.2.1.0.
• Express: Express 5 or body-parser 2 accepting compressed request bodies.
• Outbound calls: Services that call third-party URLs with fetch(), requests, aiohttp or httpx.
• GitLab: Any self-managed GitLab CE/EE below 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 or 19.5.1, or any self-hosted AI Gateway below 19.4.1.
• React / Next.js: Apps still on React 19.0, 19.1.0, 19.1.1 or 19.2.0.

Quick check in Kubernetes: list every image with kubectl get pods -A -o jsonpath='{..image}', then run php -v, node -v or pip show brotli against each base image. Distro packages may backport fixes under an older version number, so confirm against the vendor advisory.

Fix and harden

Patching is the only complete fix. Everything else buys time.

1. Patch first. Rebuild images on fixed PHP, Node.js, Bun, Python Brotli and React versions, upgrade GitLab, redeploy, and confirm the running version, not just the Dockerfile.
2. Rotate secrets. PHP2Shell leaks process memory, and the GitLab file-read flaw exposes server secrets. Rotate database passwords, API keys, session secrets, GitLab deploy tokens, CI/CD variables and SSH keys on any host that was exposed.
3. Watch runtime behaviour. Alert on web processes spawning shells, curl or wget calls from PHP or Node workers, a Node crash followed by new program execution, and unexpected outbound connections. On GitLab, review logs for unusual requests to the repository commits API.
4. Shrink the blast radius. Run workers as non-root with read-only filesystems, cap container memory with cgroups, apply Kubernetes NetworkPolicies for egress, and keep pod service-account tokens unmounted unless needed.

Can’t patch PHP today? Apply these interim settings in php.ini, then restart workers:

• session.upload_progress.enabled = 0
• post_max_size = 8M (use 32M if you need uploads)
• upload_max_filesize = 6M (keep it below post_max_size)
• For PHP-FPM, consider pm.max_requests = 1
• Enforce body-size limits at your proxy and restrict public access where you can

Can’t patch Node.js today? In Express 5 / body-parser 2, turn off decompression where you don’t need it:

• app.use(express.json({ inflate: false }));
• app.use(express.urlencoded({ extended: true, inflate: false }));
• Limit which external hosts your services can fetch() from

Can’t patch GitLab today? Reduce exposure until you can:

• Take the instance off the public internet or put it behind a VPN
• Turn off public projects and open sign-ups
• Disable the self-hosted AI Gateway if you don’t use it

The last step matters most for the next “2Shell”. You can’t patch a bug before it’s disclosed, but you can make sure a shell in one pod doesn’t become your whole cluster.

How Turf Dev can help

Patching one CVE is a fire drill. Knowing within an hour which workloads run which runtime, and how far a shell could travel from each, is a security posture.

Turf Dev runs Kubernetes and cloud security audits for teams shipping to production: image and runtime inventory, CIS Benchmark checks, network policy and RBAC review, and runtime detection for exactly the behaviour these exploits produce. If you want a second pair of eyes on your exposure to PHP2Shell, HTTP2Shell, GitLab or whatever comes next, reach out at turfdev.in.