Node2Shell
Review the Node.js runtime and Brotli decoder versions against the official vendor security release. Response headers cannot confirm exposure. Node.js security releases ↗
DEFENSIVE SECURITY INTELLIGENCE
Know your exposure.
Across every stack.
Review public technology signals across PHP, Node.js, Brotli-enabled proxies and React / Next.js, then get clear steps to verify your actual server safely.
PASSIVE CHECKS ONLYNO EXPLOIT PAYLOADSBUILT FOR DEFENDERS
PHP2SHELL
SECURITY ADVISORY
4THREAT
FAMILIES
FAMILIES
01Understand the risk
02Check public signals
03Verify the actual runtime
04Apply vendor fixes
LIVE WEBSITE ASSESSMENT
Check your website
One standard homepage request to assess public signals for PHP2Shell, Node2Shell, HTTP2Shell and React2Shell. No login, uploads, exploit attempts or intrusive probes.
01 / TARGET
4 THREAT FAMILIES · 1 REQUESTEnter the website you manage
CHECK SCOPE
PHP version disclosure · Node.js / Bun hints · Brotli response metadata · NGINX / Envoy / Istio hints · Next.js hints · HTTP status and security headers
UNDERSTAND THE THREAT
Threat intelligence
Four vulnerability families are represented in this passive assessment. The checker reports technology hints only; it cannot confirm affected packages, vulnerable code paths or patch status.
HTTP2Shell
Check the exact Brotli library and proxy build used by your service. A visible NGINX, Envoy or Istio banner is not proof that a vulnerable decoder is present. Envoy compression docs ↗
React2Shell
Public headers cannot determine whether React Server Components are enabled or whether affected package versions are deployed. Review the official React advisory. React advisory ↗
PHP SECURITY / 2026Security starts
Security starts
with the runtime.
Web applications can depend on PHP packages maintained by operating-system vendors, hosting companies, container images, or managed platforms. The visible version string alone may not tell the whole story.
PHP security releases ↗PHP CORECVE-2026-109618
Remote code execution via out-of-memory corruption
An interrupted allocation can leave request state incomplete; later request cleanup may access invalid memory. Unauthenticated remote exploitation can lead to code execution.
PHP CORECVE-2026-109619
Remote code execution via stale global state
PHP global state can retain references to freed request memory and be reused by a later request in the same worker, potentially leading to remote code execution.
CONFIGURATIONCVE-2026-115560
Session upload-progress serializer mismatch
A separate issue involving session upload-progress and runtime serializer changes. It has distinct prerequisites and is not covered by the original PHP2Shell fixes. Follow the current PHP advisory for mitigation.
UPSTREAM FIXED RELEASES
Compare the PHP branch
For PHP2Shell CVE-2026-109618 and CVE-2026-109619, verify the upstream release and your vendor's package advisory.
PHP branchFirst fixed release
8.58.5.12
8.48.4.27
8.38.3.36
8.28.2.35
Release comparisons are upstream references, not a substitute for distribution or hosting-provider advisories. Older branches and vendor-maintained builds require package-specific verification. Check PHP's official security information.
FROM AWARENESS TO ACTION
What should you do?
A practical checklist for website owners, developers and hosting teams.
Inventory every runtime
List PHP versions across production, staging, containers, background workers and managed hosting accounts.
Verify vendor packages
Check the exact package build and security notice from your OS, hosting provider or platform vendor. Backports may change the security status without changing the upstream version string.
Patch and restart
Apply the vendor-recommended fixed package, then restart the relevant PHP-FPM and web-worker processes as instructed.
Review configuration
Check current PHP project and vendor guidance for session upload-progress settings and other applicable mitigations.
Monitor your environment
Review web, PHP-FPM and system logs for unusual errors, worker crashes or unexpected activity around the disclosure period.
Keep evidence
Record package versions, vendor advisory links, patch dates, restarts and the person responsible for verification.
IMPORTANT TO KNOW
What this checker can—and cannot—tell you
What it can show
Public response headers, server/framework hints, HTTP status, redirect destination, HTTPS usage and explicitly disclosed runtime versions.
What it cannot prove
Whether a hidden PHP runtime is present, whether a vendor backport is installed, whether configuration-dependent conditions apply, or whether the site is exploitable.
Why no exploit test?
Exploit-shaped requests can affect server resources or availability. This public checker deliberately avoids them and does not perform penetration testing.