---
id: 10337
title: "Vulnerability updates"
cve: null
cvss: null
severity: high
vendor: null
product: null
affected_versions: null
source_domain: hacktron.ai
source_url: "https://www.hacktron.ai/blog/vulnerability-updates"
published_at: "2026-10-26T00:00:00Z"
snapshot_at: "2026-10-26T10:30:55Z"
archived_by: "Phying News (https://phying.com/item/10337)"
lang: en
---

# Vulnerability updates

*Published by Hacktron Team · Updated October 26, 2026*

Short, sourced updates on critical vulnerabilities: who is affected, how to check, and which versions fix them. Kept up to date as things change.

---

## 2026 Vulnerability Advisories

### Node2Shell: Brotli Decoder RCE in Node.js (CVE-2026-111497)

> **Published:** October 26, 2026  
> **Tags:** vulnerability-updates, news  
> **Reference:** [/blog/node2shell](https://www.hacktron.ai/blog/node2shell)

Node2Shell (also tracked as HTTP2Shell) is an out-of-bounds write vulnerability in the Brotli decompression engine. 

- **Affected Ecosystems:** Node.js, Python (`brotli` package), Bun, Envoy Proxy, and .NET.
- **Impact:** Remote Code Execution (RCE) via malicious compressed HTTP responses or file payloads.
- **Remediation:** Check versions of Node.js and runtime dependencies against patched upstream Brotli releases.

---

### PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619)

> **Published:** October 22, 2026  
> **Tags:** vulnerability-updates, news  
> **Reference:** [/blog/php2shell](https://www.hacktron.ai/blog/php2shell)

Two unauthenticated Remote Code Execution (RCE) flaws in PHP core components, with active in-the-wild exploitation attempts reported.

- **Vulnerabilities:** CVE-2026-109618 and CVE-2026-109619.
- **Affected:** PHP environments accepting unauthenticated requests without input sanitization across core modules.
- **Fixed Versions:** 
  - PHP 8.5.12
  - PHP 8.4.27
  - PHP 8.3.36
  - PHP 8.2.35

---
> 📦 **Full-Text Markdown Snapshot** archived by [Phying News](https://phying.com/item/10337) · Original source: [hacktron.ai](https://www.hacktron.ai/blog/vulnerability-updates)