[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTzvI6K_J-axrjcNtiaweN278Q44nrm3-Tv4bXA8ZUWQ":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":50},"e926ecf2-2acc-45f4-89e1-2dc98e107e54","zero-day-runtime-flaws-in-php-and-nodejs-demand-immediate-patching-across-web-apps-and-apis","9ef95446-f8ab-42c9-85da-3da8329deae4","Zero-Day Runtime Flaws in PHP and Node.js Demand Immediate Patching Across Web Apps and APIs","PHP2Shell and Node2Shell represent critical runtime vulnerabilities affecting PHP and Node.js respectively, enabling remote code execution across any application or API built on vulnerable versions. Crucially, exploitation was observed before patches were available, meaning organizations relying on reactive patch cycles were already exposed. This highlights the danger of running internet-facing applications on unvalidated runtime versions without compensating controls. The incidents underscore that web application runtimes are high-value attack surfaces requiring the same rigorous patch and vulnerability lifecycle management as operating systems and network devices.","**Immediate actions:**\n- Upgrade PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and Node.js to 22.23.4, 24.22.1, or 26.12.1 on all affected systems immediately.\n- Audit every web application and API endpoint to confirm which PHP and Node.js runtime versions are in use, prioritizing internet-facing assets.\n- Enable runtime-level web application firewall (WAF) rules to detect and block exploitation attempts while patching is in progress.\n\n**Long-term improvements:**\n- Maintain a complete, up-to-date software inventory (SBOM) that includes runtime versions for all web applications and APIs.\n- Establish an emergency patching SLA (e.g., 24–48 hours) for CISA KEV-listed vulnerabilities affecting production runtimes.\n- Integrate runtime version checks into CI\u002FCD pipelines so deployments using vulnerable runtimes are blocked automatically.\n\n**Detection measures:**\n- Subscribe to CISA KEV feed alerts and runtime vendor security advisories to receive zero-day notifications without delay.\n- Deploy runtime application self-protection (RASP) or behavioral anomaly detection to identify shell-execution attempts at the application layer.\n- Review web server and application logs for indicators of compromise consistent with remote code execution following public disclosure.",[12,13,14,15,16],"CIS Control 2: Inventory and Control of Software Assets (v8)","CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":18,"NIST SP 800-53 SI-2: Flaw Remediation":19,"CIS Control 7: Continuous Vulnerability Management (v8)":20,"CIS Control 2: Inventory and Control of Software Assets (v8)":21,"NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks":22},"NIS2 Article 21(2)(e) explicitly covers vulnerability handling and disclosure in acquisition, development, and maintenance, making it directly applicable to the obligation to track, respond to, and remediate critical runtime vulnerabilities like PHP2Shell and Node2Shell.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner, which would have driven the emergency patching process needed to address these actively exploited runtime vulnerabilities.","CIS Control 7 mandates continuous scanning and prioritized remediation of vulnerabilities, which directly addresses the need to detect and patch PHP2Shell and Node2Shell flaws—especially given their CISA KEV status and active exploitation.","CIS Control 2 requires organizations to maintain an inventory of authorized software including versions, which would have enabled rapid identification of all systems running vulnerable PHP and Node.js runtimes for prioritized remediation.","This category directly applies because PHP2Shell and Node2Shell were exploited before patches existed, requiring organizations to either apply mitigations (WAF rules, runtime isolation) or formally accept and document the residual risk during the zero-day window.","published","2026-11-12T10:21:50.387495+00:00","2026-11-12T10:21:50.373+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fblog.qualys.com\u002Fproduct-tech\u002F2026\u002F11\u002F12\u002Fphp2shell-node2shell-totalappsec-web-apps-apis","php2shell-and-node2shell-find-fix-and-verify-across-your-web-apps-and-apis-e28ac0","PHP2Shell and Node2Shell: Find, Fix, and Verify Across Your Web Apps and APIs",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[44],{"id":45,"date":46,"edition":47,"title":48,"audio_url":49},"636c0875-eb3c-4df8-b0a8-59b022d18a1e","2026-11-12","afternoon","ThreatNoir Afternoon Brief — November 12","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-11-12\u002Fthreatnoir-afternoon-brief-2026-11-12.mp3",[51,54,57],{"slug":34,"name":52,"problem":53},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":40,"name":55,"problem":56},"Automated patch management","Known holes get closed in days, not months.",{"slug":58,"name":59,"problem":60},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have."]