Critical PHP2Shell and Node2Shell Vulnerabilities Trigger Widespread Patching Efforts

Two critical security vulnerabilities, collectively known as PHP2Shell (CVE-2026-109619 and CVE-2026-109618), impacting PHP versions 5.4 to 8.5, and a new Node2Shell RCE vulnerability (CVE-2026-111497) in Google's Brotli decompression library, have led to urgent patching efforts globally. Both sets of flaws carry high CVSS scores (9.2 for PHP2Shell, 9.2 for Node2Shell) and allow unauthenticated attackers to execute arbitrary code and steal data. Governments and companies are rushing to apply patches, with cloud firms reporting a surge in hacking attempts following their disclosure.