--- title: What are shell vulnerabilities? | daily.dev description: Shell vulnerabilities are remote code execution flaws that sit below application code, in runtimes, logging libraries, UI frameworks or compression decoders.... canonical: https://daily.dev/posts/what-are-shell-vulnerabilities--v4cnozp3n twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: What are shell vulnerabilities? | daily.dev og:description: Shell vulnerabilities are remote code execution flaws that sit below application code, in runtimes, logging libraries, UI frameworks or compression decoders.... og:url: https://daily.dev/posts/what-are-shell-vulnerabilities--v4cnozp3n og:image: https://api.daily.dev/og/posts/v4CNOzP3N.png og:image:alt: What are shell vulnerabilities? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What are shell vulnerabilities? **[Aikido Security](https://daily.dev/sources/aikido-security)** · 8 min read · 0 upvotes · 0 comments ## Summary Shell vulnerabilities are remote code execution flaws that sit below application code, in runtimes, logging libraries, UI frameworks or compression decoders. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a memory corruption bug in PHP's engine dating back to PHP 5.4 from 2012, disclosed October 21, 2026. Node2Shell (CVE-2026-111497) is a buffer overflow in the Brotli decoder bundled into Node.js, Bun, Envoy, .NET and other runtimes, patched the same day. Log4Shell and React2Shell are logic flaws rather than memory bugs, both scoring a perfect CVSS 10.0. Brotli's maintainers fixed the bug in source back in February but it took eight months to reach a release. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) and why is it dangerous? PHP2Shell refers to two memory corruption bugs in PHP's own engine, CVE-2026-109618 and CVE-2026-109619, that force PHP to run out of memory at a precise moment so a request leaves a dangling pointer. A subsequent attacker request fills that freed memory with crafted data that PHP then reads as an internal object, enabling remote code execution without authentication. The vulnerable code dates back to PHP 5.4 from 2012. _Teams patching PHP production servers can track CVE advisories like this one on daily.dev._ ### What is Node2Shell CVE-2026-111497 and which runtimes does it affect? Node2Shell is a buffer overflow in Brotli's decompression decoder, a C library bundled into Node.js and other platforms, where crafted compressed data writes past the end of a memory buffer. It affects any software that includes Brotli, including Node.js, Bun, Envoy, Istio, .NET, Python HTTP clients like requests and httpx, and Java's brotli4j. Express 5 and body-parser 2.x decode Brotli bodies automatically, often before authentication runs. _Developers auditing dependency trees for Brotli exposure can follow patch rollouts on daily.dev._ ### How is React2Shell CVE-2025-55182 different from a typical React vulnerability? React2Shell is a deserialization flaw in how React Server Components process the 'Flight' format used to send data between server and browser, letting an attacker shape a request that reaches functions like child_process.execSync without authentication. Apps were vulnerable even if they never defined a server function, because the Flight decoding code runs whenever Server Components are supported. A follow-up bug, CVE-2025-67779, bypassed the original patch. _Teams running React Server Components can track Flight-related CVEs and patch cycles on daily.dev._ ## Similar posts on daily.dev - [PHP2Shell: Prepare for the Next Vulnerability](https://daily.dev/posts/php2shell-prepare-for-the-next-vulnerability-lewhmq4u1) · Snyk · 0 upvotes · 0 comments - [A 14-Year-Old PHP Bug Lets Strangers Run Code on Your Server. Here's How to Stop It](https://daily.dev/posts/a-14-year-old-php-bug-lets-strangers-run-code-on-your-server-here-s-how-to-stop-it-vd0nya50m) · Medium · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#nodejs](https://daily.dev/tags/nodejs), [#php](https://daily.dev/tags/php) [View this post on daily.dev](https://daily.dev/posts/what-are-shell-vulnerabilities--v4cnozp3n) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"What are shell vulnerabilities?","url":"https://daily.dev/posts/what-are-shell-vulnerabilities--v4cnozp3n","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-are-shell-vulnerabilities--v4cnozp3n"},"datePublished":"2026-10-30T02:02:52.956Z","dateModified":"2026-10-30T02:03:31.604Z","description":"Shell vulnerabilities are remote code execution flaws that sit below application code, in runtimes, logging libraries, UI frameworks or compression decoders....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/05b1710de754af4a58fba3f8e6099e2d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/05b1710de754af4a58fba3f8e6099e2d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Aikido Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Aikido Security","logo":"https://media.daily.dev/image/upload/s--vJDqDYv_--/f_auto,q_auto/v1774959928/logos/aikido-security?_a=BAMAMiWQ0","url":"https://daily.dev/sources/aikido-security"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/what-are-shell-vulnerabilities--v4cnozp3n","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,nodejs,php","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Aikido Security","item":"https://daily.dev/sources/aikido-security"},{"@type":"ListItem","position":3,"name":"What are shell vulnerabilities?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/what-are-shell-vulnerabilities--v4cnozp3n#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) and why is it dangerous?","acceptedAnswer":{"@type":"Answer","text":"PHP2Shell refers to two memory corruption bugs in PHP's own engine, CVE-2026-109618 and CVE-2026-109619, that force PHP to run out of memory at a precise moment so a request leaves a dangling pointer. A subsequent attacker request fills that freed memory with crafted data that PHP then reads as an internal object, enabling remote code execution without authentication. The vulnerable code dates back to PHP 5.4 from 2012. Teams patching PHP production servers can track CVE advisories like this one on daily.dev."}},{"@type":"Question","name":"What is Node2Shell CVE-2026-111497 and which runtimes does it affect?","acceptedAnswer":{"@type":"Answer","text":"Node2Shell is a buffer overflow in Brotli's decompression decoder, a C library bundled into Node.js and other platforms, where crafted compressed data writes past the end of a memory buffer. It affects any software that includes Brotli, including Node.js, Bun, Envoy, Istio, .NET, Python HTTP clients like requests and httpx, and Java's brotli4j. Express 5 and body-parser 2.x decode Brotli bodies automatically, often before authentication runs. Developers auditing dependency trees for Brotli exposure can follow patch rollouts on daily.dev."}},{"@type":"Question","name":"How is React2Shell CVE-2025-55182 different from a typical React vulnerability?","acceptedAnswer":{"@type":"Answer","text":"React2Shell is a deserialization flaw in how React Server Components process the 'Flight' format used to send data between server and browser, letting an attacker shape a request that reaches functions like child_process.execSync without authentication. Apps were vulnerable even if they never defined a server function, because the Flight decoding code runs whenever Server Components are supported. A follow-up bug, CVE-2025-67779, bypassed the original patch. Teams running React Server Components can track Flight-related CVEs and patch cycles on daily.dev."}}]} ```