PHP and Node.js runtime flaws put every app at risk
Qualys says CISA added PHP2Shell’s two PHP flaws and Node2Shell’s Node.js flaw to its Known Exploited Vulnerabilities catalog on October 26 and 27, five and six days after fixes shipped on October 21. Qualys also says attackers probed PHP2Shell four days before the patches appeared. Fixed versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and Node.js 22.23.4, 24.22.1, and 26.12.1.
These are runtime flaws, not bugs in individual applications: each app or API running an affected PHP or Node.js version inherits the exposure. Code-focused scans may miss them, and upgrading a host does not by itself prove every deployed service now uses a fixed runtime.
For teams operating multiple applications and APIs, the exposure follows each actual runtime deployment—not just the application inventory. A host-level patch record can leave uncertainty about services still running vulnerable instances.
CVSS 9.8 CRITICAL: pHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. EPSS 100% (100th percentile).
CISA federal remediation date Oct 29 · date passed
CVSS 9.8 CRITICAL: a buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0… EPSS 83% (100th percentile). Microsoft patch: 5133964.