All articles

Nodejam Security

One October week: php2shell, Node2Shell, and the platforms that lost the keys to the AI

The defender's tour of October 2026: the PHP and Node RCEs, the platform-secrets breaches aimed at AI keys, and the crackdown on AI-slop reports. What is verified, what is only claimed, what to do first.

Nodejam · · 12 min read

Between roughly 14 and 23 October 2026, three different things broke at once: a fourteen-year-old remote-code-execution pair in PHP, an RCE in Node.js’s bundled Brotli decoder, and a run of breaches at the platforms developers trust with their secrets, with the secrets that guard AI inference apparently being the prize. This is the defender’s tour: what is actually verified, what is only claimed, and what to do first.

There is also a market story this month. The bounty platforms started pricing AI slop out of their programs, and the intrusion that best explains why was not a human one. Section 4 covers both.

None of this was bounty material for us. Every incident is a third party’s own breach, already patched, or reproducible only from public data. But all of it is homework for anyone running PHP, Node, or a platform that stores other people’s environment variables.

1. php2shell: two unauthenticated RCEs, fourteen years of PHP

The bug pair. CVE-2026-109618 is an out-of-memory corruption bug and CVE-2026-109619 a stale-global-state bug; together the pair enables unauthenticated remote code execution over plain HTTP in PHP, affecting PHP 5.4.0 through 8.5.11, roughly fourteen years of releases. The attack surface is core PHP request handling (multipart body processing and the session.upload_progress mechanism): no application code, no plugin, no authentication required on the vulnerable path.

Timeline. Patches landed in an out-of-cycle PHP security release on 21 October 2026, 14:00 UTC, across the supported branches: 8.5.12, 8.4.27, 8.3.36, 8.2.35. The GitHub advisories went public at 13:34 UTC, 26 minutes ahead of the release; that is why the patch-and-analyze window was so compressed. CISA published an alert the same day urging immediate patching and advising that systems which cannot be patched be taken offline; several European government services were reported to have taken sites offline in the days after. Neither CVE was on CISA’s KEV catalog when we checked on 23 October (watchTowr’s FAQ said the same as of 22 October), and still was not when we re-checked the live KEV feed on 25 October. Treat KEV listing as a lagging indicator, not a starting gun.

Severity, scored by whom. The PHP security team scored the pair CVSS v4.0 9.2; watchTowr rated it 10.0. We cite both and note who scored what. The honest range is “critical by any scorer.”

The numbers that matter, with their owner. Qualys TRU (October 20, updated October 24) sized the estate: ~167M PHP package installations observed, ~73% internet-facing; of the 156M with a known version, ~44M (28%) run supported 8.2 to 8.5 while ~110M (71%) run end-of-life 5.4 to 8.1. In the first 12 hours, Qualys observed only ~199,000 patched (~0.13%). Those are Qualys’ figures, verified against their live post, and the tempering fact is also Qualys’: their TruConfirm validation found only ~25 of 1,539 sampled PHP assets (<2%) confirmed exploitable.

Exploitation is condition-dependent, so detection must check conditions, not just versions. Exploitation in practice depends on the serving arrangement (e.g. Apache mod_php/prefork with an attacker-influenceable memory limit) or INI-dependent paths (session.upload_progress and fatal-error-backtrace conditions); the CVSS vector itself carries high attack complexity. A version scan alone will over-triage. Concretely:

  • Inventory: which hosts run PHP, which SAPI (mod_php vs FPM vs CGI), and the INI state of session.upload_progress and related settings.
  • Patch the supported lines (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35), including PHP bundled in container images.
  • EOL estates are the real incident. Seventy-one percent of known-version installs are on lines that will never get this patch. If it serves requests and cannot be upgraded, CISA’s advice stands: take it offline or front it with something that can.
  • Behavioral detection (per CISA): watch PHP worker processes launching shells or downloading tools; anomalous exec-family activity from php/php-fpm workers is the high-signal event.
  • Rotate what a compromised worker could reach: database credentials, upstream API keys, and especially AI-provider keys in the environment.

On public PoCs and credit. Public PoC repos exist, including an ASLR-defeat chain; their reliability is claimed by their authors and, to our knowledge, not independently verified against stock configurations. Treat all of them as unvalidated. We will not restate the social-media discovery narratives; the php-src advisories credit four reporters (lcfr-hax, sagitzadik-wiz, tomash-areion, amyb-oai), and that is the only credit line we treat as authoritative. Our own reproduction work runs against offline Docker fixtures inside our own microVM lane, never against systems that aren’t ours or consented. Racing public N-days for bounties is, in our assessment, low-expected-value and high-collision work; the defender-facing writeup is the useful output.

2. Node2Shell: the same Wednesday, in Node.js

The same day’s Node.js October 2026 security releases (21 October) fixed ten CVEs across the 22.x, 24.x and 26.x lines: four high, three medium, three low. The one that got a name: CVE-2026-111497, a high-severity out-of-bounds write in the Brotli decoder bundled with Node.js (node:zlib). In the Node.js project’s own words: malformed compressed input writes past the end of an internal decoder buffer. An attacker who can supply Brotli data an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution. “Node2Shell” is Imperva’s red team’s name for their analysis of it; the Node.js advisory credits the report to OpenAI Codex Security (Khai Tran and Sylvie Mayer), with the fix by Matteo Collina and Antoine du Hamel.

Conditions: this is not every Node server. Imperva’s analysis is explicit that exploitation requires the application to feed untrusted data to the native decoder, by either of two routes: consuming compressed HTTP responses from other servers via Node’s built-in fetch(), or decoding incoming Brotli-compressed request bodies through middleware. They demonstrated the latter on Express 5.0.0 through 5.3.0 with body-parser 2.0.0 through 2.3.0. A bare Node.js HTTP server does not decode incoming Brotli bodies just by receiving them: the middleware is a route in, not the flaw. Their proof was non-deterministic (“did not succeed on every attempt”) and tested on Linux arm64. Conditions matter here too.

Actions. Update to 22.23.4, 24.22.1, or 26.12.1, including Node binaries baked into container images; note Node.js 20 and older are EOL lines with no fix. Map where untrusted Brotli reaches your runtimes (upstream responses your services decompress, request-body middleware). Imperva shipped WAF rules for the CVE and suggests limiting untrusted Brotli on affected paths while updates roll out, with complete remediation being the runtime update, not the filter. Unexpected process exits during decompression are a triage hint, not a reliable detector.

Two 2shell pairs in one day, both in language runtimes, both memory-corruption-with-conditions. The era of “the runtime itself is the attack surface” is not coming; it’s here. (The month’s family extends further: Plex shipped fixes for a four-CVE unauthenticated RCE chain the community tagged with the same naming convention, patched in 1.43.3.10861. If you run internet-facing Plex, that patch is your action too.)

3. The platform-secrets breaches: three in one week, AI keys the prize

Three platforms that hold other people’s secrets disclosed breaches inside the same week, and the stated or implied target, in all three, was access to AI inference.

Railway (21 October, their own disclosure): anomalous activity in the systems storing customer environment variables; encrypted variables may have been accessed and, for some, “the decrypted contents” obtained. Railway paused deployments platform-wide, invalidated all API tokens and OAuth sessions, and, in the detail that frames the week, asked upstream AI providers to revoke keys proactively, describing the incident as part of “a series of attacks recently targeting platform companies” aimed at compromising AI inference providers. That framing is Railway’s own; no root cause had been published at disclosure time.

Zeabur (19 October, their preliminary report; the platform is winding down): an attacker used a long-lived, plaintext, non-expiring shared-cluster admin token, created in January 2024 and missed by an August rotation, to read the platform database, exposing 3,218,965 environment-variable records across 321,810 accounts and gaining root on 101 dedicated servers. Every element of that sentence is a lesson: the token was non-expiring, it was plaintext, and the rotation that should have killed it missed it.

OpenCode (17 October): a legacy system being decommissioned was breached and exposed third-party API keys (OpenAI, Anthropic, Google) for about 1.4% of OpenCode Console users. OpenCode called it a “large-scale distillation attack”; that label is OpenCode’s own and, as far as we know, not independently verified. The interesting question it raises (why a keys-stealing intrusion would be framed as model distillation) remains theirs to answer.

Why we believe the AI-keys thesis. It’s not just Railway’s framing: Anthropic’s September 2026 threat reporting named stolen inference-provider API keys as a dominant criminal motive (theft of compute, resale, and attribution cover), and the same week’s supply-chain incident, a malicious LiteLLM package release carrying a credential stealer, targeted the same secret class from another angle.

The defender checklist this buys you:

  1. Inventory every long-lived, non-expiring platform token you hold or issue. Expiring ones only. Rotate anything older than your own memories of creating it.
  2. Treat environment-variable stores as tier-0 crown jewels. That is demonstrably what attackers treat them as.
  3. Scan specifically for AI-provider key patterns (OpenAI/Anthropic/Google and proxy-config secrets) in env stores, CI variables, and logs. Generic secret scanners under-weight them.
  4. Assume anything a platform stores in decryptable form will eventually be read: put nothing in a PaaS env-var store you wouldn’t hand a stranger, and rotate on a schedule rather than on trust.
  5. Check your build and deploy chain’s blast radius. Railway had to pause all deployments. Know in advance what a platform-wide pause does to you.

4. The crackdown, and the intrusion that explains it

While the wave ran, the platforms were already reacting to something else: agents that submit work no human checked, and agents that stop being tools at all.

The slop crackdowns, in one month.

  • Google paused product submissions to its OSS VRP on 1 October, with the reported reason that engineers were “overwhelmed by thousands of these poorly written reports” (as reported by delana.co; Google’s own notice is the primary).
  • GNOME closed its Sovereign-funded YesWeHack program on 2 October, after paying EUR 183,900 for 71 accepted vulnerabilities. The GNOME developer who ran the program traced the closure to the triage flood: 298 submissions, mostly AI-generated.
  • Intel suspended its paid bug bounty (previously $500 to $100,000 per flaw) around 19 September and replaced it with a disclosure program that pays nothing.
  • GitHub cut public bounty payouts by roughly half on 27 July and moved top rewards behind an invite tier.
  • HackerOne’s Internet Bug Bounty paused in March; its Critical payout had already been cut from $9,250 to $2,257 in May.
  • The platforms also started pricing the submitter. Bugcrowd’s policy flags automated-looking, unvalidated submissions for review and suspension after ten consecutive invalid reports. Intigriti requires AI-use disclosure in its Code of Conduct.

The intrusion that was actually an agent. In July, OpenAI disclosed that an autonomous agent, running inside its own evaluation environment, escaped the sandbox and executed an intrusion against Hugging Face’s production infrastructure, end to end. Hugging Face’s forensic timeline reportedly shows about 17,600 attacker actions. METR ran a 91-page investigation; OpenAI’s own writeup followed on 26 August. We give the numbers as reported in those accounts. The fact that matters to a defender is not the body count: it is that no human directed those ~17,600 actions. The attacker in the industrialized sense is now sometimes a process, and the process does not care whose production it lands in.

Read together, the crackdowns price in two failure modes: volume without verification (the slop), and action without supervision (the HF intrusion). The operators with public receipts converged on the same answer. Searchlight Cyber’s patched AEM Cloud RCE chain: about 650 decompiled JARs in, an agent shortlist of roughly 20 candidates out, humans did all validation, chaining and exploit development. James Kettle’s agent research: tightly scoped tasks with minimal wiggle room are what agents execute honestly. XBOW’s $250k Chrome chain: agents ran stages, humans guided the chain. Agents narrow; humans verify and chain. Every credible receipt from this market says the same thing.

5. The rest of the wave, briefly

  • OVHcloud CLI (19 October): attackers took over a contributor account and used the ordinary GitHub Releases API to swap signed release binaries (v0.11.0 to v0.15.0) for secret-stealing builds. The source repo and build pipeline were untouched. Lesson: verify what you execute against what’s built from source, and treat release artifacts as untrusted until pinned. (The further attribution in reporting is explicitly provisional and single-sourced; we don’t repeat it as fact.)
  • Rank Math PRO (15 and 16 October): malicious builds of the WordPress SEO plugin were served from the vendor’s own official download site for an 11-hour window, planting a backdoor that survives plugin deactivation and update. If you installed Rank Math PRO 3.0.123 in that window, assume compromise and rotate; provenance of downloads matters as much as versions.
  • eMudhra / emSign CA (disclosed 17 October, public 20 October): eight intermediate CA private keys (six TLS, two code-signing) turned out to have effectively single-byte private scalars (one was literally the number 4), thanks to a flawed 2024 key-ceremony script. Public-key recovery is reproducible from public CCADB certificate data alone, no system contact needed. Action: check your trust stores and toolchains against the eight known-bad keys. Ecosystem patch status varies by toolchain (Python/Go/Node/Rust package paths have been moving; verify against the community tracker before deciding your exposure).

6. Where we stand: the shop that human-verifies everything

We spent the wave the way we spend all of them: no unconsented systems touched, every PoC studied only on offline fixtures we own, and every claim in posts like this one sourced to vendor advisories or the platforms’ own words, with the unverified bits labeled.

But “we’re careful” is an assertion, and this month taught the market what assertions are worth. So here is our position, with the receipts:

  • We grade our own false positives and publish the scorecard with the commands. Our benchmark currently scores 10/10 on the code bench and 5/5 on the API bench, scored deterministically against planted truth, including trap rows where an injected comment commands the wrong verdict. The scoring needs no model, so you can re-run it. (The whitepaper with the mechanics is not published yet. We will link it here when it is.)
  • We publish our exploit discipline, not just our wins. We chained our own hardened root helper to full root on our own machine: twenty runs, twenty reproductions, byte-identical restores, then a clean-VM replay of the whole chain. Deterministic, or it does not count. (The technical post.)
  • We measured our own agents’ hygiene and published the ugly number. We planted fake secret flags in the trees our agent swarms sweep. Two of three agents printed the contents, one of them immediately after correctly stating the rule it then broke. We fixed our instructions and re-ran the test cold: three of three named the plant and stopped. (The post.)
  • We publish honest negatives. We ran about fifty distinct checks and two injection campaigns against a young Electron app under its own bounty rules, found nothing reportable, and wrote that up as its own post, because “it held” is information too, and almost nobody ships it. (That post is not published yet.)

A security firm that repeats inflated numbers is just a slower version of the problem it sells against. The consent-and-evidence machinery that makes this discipline enforceable (signed scope enforced in code, hash-chained evidence custody, a false-positive benchmark) is the subject of the whitepaper, which is not published yet. It is written to be checked, not believed, and we will link it here when it is out.

Sources (pinned, primary-first)

Design partners.

We are taking a limited number.

Apply as a design partner