PSA: Update PHP and NodeJS on your servers NOW!

[NotATether]

There is a critical vulnerability inside PHP which allows someone to abuse multipart/form-data uploads to run remote code execution on your server, and there is no configuration option to disable which prevents this. The only patch is to upgrade. Actually, somebody may have even tried to hack Bitcointalk (but theymos stopped them).

8.2.35
8.3.36
8.4.27
8.5.12

There is NO official patch for older versions, so you must upgrade those or use unofficial patches.

Separately, there is another RCE discovered inside NodeJS: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

It also allows remote code execution from a decoded brotili stream.

Patch to v22.23.4, v24.22.1, or v26.12.1 ASAP. There's no patch for older versions.


If anyone affected does not know how to patch their services, I can do this for free. Just send me a PM or message.

[NotFuzzyWarm]

https://calif.io/php2shell/ is a good breakdown of the PHP flaws. All versions of PHP since v5.xx from over 10 years ago have the bugs. For folks running Ubuntu they already have a new version with the patches in it and of course the official PHP website has the updated version as well. https://www.php.net

[satscraper]

There is a critical vulnerability inside PHP which allows someone to abuse multipart/form-data uploads to run remote code execution on your server, and there is no configuration option to disable which prevents this. The only patch is to upgrade. Actually, somebody may have even tried to hack Bitcointalk (but theymos stopped them).

8.2.35
8.3.36
8.4.27
8.5.12

There is NO official patch for older versions, so you must upgrade those or use unofficial patches.

Separately, there is another RCE discovered inside NodeJS: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

It also allows remote code execution from a decoded brotili stream.

Patch to v22.23.4, v24.22.1, or v26.12.1 ASAP. There's no patch for older versions.


If anyone affected does not know how to patch their services, I can do this for free. Just send me a PM or message.

It seems this flaw pipeline is endless. Another day, another potential flaw. Not severe as the previous ones, but still flaw.

As the precaution measure  I’ve restricted  myself from accessing any site that requires php session until the dust is settled.

 Bitcointalk doesn't count. In theymos I trust.

[Danish Ali]

As the precaution measure  I’ve restricted  myself from accessing any site that requires php session until the dust is settled.

An alternative is to only use websites that do not require PHP sessions.

This is unfortunately not really an option since bug affects request handling by PHP, which happens before any website specific code is run. Disabling session upload progress is only mitigation for some attack scenarios of one of the vulnerabilities, and not all of them. Best solution is to update PHP.

[NotATether]

Unfortunately the above compression bug doesn't only affect NodeJS, it also affects the underlying C library meaning every single language wrapper around Brotili is vulnerable until patched.

Node2Shell evolves to HTTP2Shell. Brotli flaw (CVE-2026-111497) blast radius affects many libraries & apps using HTTPs.

How to patch HTTP2Shell CVE-2026-111497
For CVE-2026-111497, update the affected runtime or Brotli library:

Node.js: upgrade to 22.23.4, 24.22.1, or 26.12.1, or a newer supported release in the corresponding release line.
Native Brotli / libbrotli: upgrade to 1.2.1 or later. For older release lines, use patched 1.0.10 or 1.1.1.
Python packages: upgrade Brotli to 1.2.1 or later and brotlicffi to 1.2.1.0 or later, wherever installed.
curl / libcurl: update its Brotli dependency to 1.2.1, a patched older release, or the vendor’s security-fixed package. Bundled or statically linked copies require an updated application build.
Bun: upgrade to 1.4.4 or later. Rebuild compiled executables that bundle Bun.
Envoy: upgrade to 1.40.0, 1.39.3, 1.38.6, or 1.37.8, or a newer release in a supported branch. 1.36.12 also includes the fix, but the 1.36 branch is unsupported.
Istio: the fix is included in 1.29.9, 1.30.6, and 1.31.2. Use a newer supported release in the corresponding line; the 1.29 branch is end of life.
Operating-system packages: install the vendor’s security update. Vendors may backport the fix without changing the upstream version number.
Other HTTP servers, reverse proxies, API gateways, and HTTP clients: update the affected runtime or Brotli library they use. Where Brotli is bundled into the product, install the product vendor’s release that explicitly addresses this CVE. For managed services, confirm remediation with the provider.