Scan for PHP2Shell and Node2Shell

PHP2Shell is a set of remote code execution vulnerabilities in PHP. Node2Shell is an out-of-bounds write vulnerability in the Node.js Brotli decoder. TotalAppSec detects both with six QIDs, grouped into two option profiles. The intrusive profile can crash an unpatched application, so use it only on patched systems or outside production.

New QIDs to detect PHP2Shell and Node2Shell

Six new QIDs detect PHP2Shell and Node2Shell. All six apply to both web applications and APIs. Four of them are non-intrusive, and two are intrusive.

Non-intrusive QIDs

These QIDs detect the vulnerabilities from the responses of the application and can be run in production.

QID	Type	Detection Title	CVE IDs	How the WAS Detects It
520310	Potential	PHP Remote Code Execution (RCE) Vulnerabilities	CVE-2026-109618, CVE-2026-109619	Checks the PHP version in HTTP response headers, such as X-Powered-By and Server, and in application cookies.
533086	Confirmed	PHP Remote Code Execution Vulnerability	CVE-2026-109618, CVE-2026-109619	Sends a POST request with a session ID that contains an invalid character. A vulnerable PHP version uses the ID and returns an error; a patched version ignores it and generates its own.
520404	Potential	PHP Session Upload Progress Enabled Remote Code Execution Vulnerability	CVE-2026-115560	Checks the PHP version in HTTP response headers, such as X-Powered-By and Server, and in application cookies.
533203	Confirmed	Node.js Brotli Decoder Out-Of-Bounds Write Vulnerability	CVE-2026-111497	Sends an HTTP POST request with a crafted Brotli-compressed payload and determines from the response whether the target host is vulnerable.

Intrusive QIDs

These QIDs send payloads that can crash an unpatched application. Run them only on patched systems or outside production.

QID	Type	Detection Title	CVE IDs	How the WAS Detects It
533068	Confirmed	PHP2Shell Active Crash Detection	CVE-2026-109618, CVE-2026-109619	Sends large payloads to test for memory exhaustion.
533085	Confirmed	Node.js Brotli Decoder Out-Of-Bounds Write Vulnerability	CVE-2026-111497	Sends a binary payload under repeated stress and evaluates server stability. A vulnerable Node.js instance returns ERR_Z_BUF_ERROR and risks crashing; a patched version returns ERR_ERROR_FORMAT_BLOCK_SWITCH, which indicates a fixed system.

Before enabling intrusive QIDs in production, evaluate the potential operational impact, obtain the necessary approvals, and perform testing within an approved maintenance window. Avoid running intrusive QIDs against unpatched or unverified production systems.

Option Profiles

Two system-generated option profiles are available for scanning trending CVEs, such as PHP2Shell and Node2Shell. Select one of these profiles when launching a scan.

Option Profile	Description
Trending Vulnerability Options	The scan is launched with non-intrusive QIDs (520310, 533086, 520404, and 533203) to detect trending CVEs.
Trending Vulnerability Intrusive Options	The scan is launched with intrusive QIDs (533068 and 533085) to verify the fixes on patched systems.

How to Scan

Perform the following steps to scan the web applications and APIs for PHP2Shell and Node2Shell:

1. Start a new vulnerability scan. For details, see Launch Vulnerability Scan - Basic Information.

2. Select the applications by name or by tag. For details, see Tagging Web Applications.

3. Select the Option Profile, depending on the applications selected. For details, see Launch Vulnerability Scan - Scan Settings.
   

4. Click Launch Scan. For details, see Launch Vulnerability Scan - Review and Confirm.

Fix the Detected Vulnerabilities

Perform the following steps to fix the vulnerabilities reported by the scan:

1. Review the detections for QIDs 520310, 533086, 520404, and 533203. Start with your internet-facing assets, and then fix each affected runtime.

2. Upgrade each affected runtime to a fixed version.

   • PHP: 8.5.12, 8.4.27, 8.3.36, or 8.2.35. You can also use the backported build from your distribution.
   • Node.js: 22.23.4, 24.22.1, or 26.12.1. If you are running an end-of-life branch, such as 25.x, 23.x, 21.x, or 20.x or older, upgrade to one of the mentioned versions.

   If you cannot upgrade right away, apply an temporary mitigation and restrict access to the service until it is patched. For example, set session.upload_progress.enabled=0 or limit the Brotli payload size at the proxy.

   For the fixed versions and the temporary mitigation, see the vendor advisories, for example:

   • RCE via stale global state
   • RCE via OOM corruption

3. Restart the affected services, such as mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed, and any long-running Node.js services. Until you restart them, the running processes keep the vulnerable code in memory.

4. Scan the same applications again with the Trending Vulnerability Intrusive Options option profile to confirm the fix. Run this scan only on patched systems or outside production, with the necessary approvals and within an approved maintenance window.

5. If the QID is still reported, the fix is incomplete. Verify that the patched runtime is serving requests, then fix the application and rerun the scan.

FAQs

Which system generated option profiles include the new QIDs?Which system generated option profiles include the new QIDs?

Which detection scopes and categories cover the new QIDs?Which detection scopes and categories cover the new QIDs?

Does an AI-powered scan test for the new QIDs?Does an AI-powered scan test for the new QIDs?

When can a scan miss these vulnerabilities?When can a scan miss these vulnerabilities?

For the complete PHP2Shell workflow across your Qualys applications, refer to the Find and Fix PHP2Shell: Onboarding Guide.

Related Topics

• Launch Vulnerability Scan
• Option Profiles
• Discovered Web Applications
• Adding Web Applications
• Tagging Web Applications
• Launch Discovery Scan