How Log4Shell, React2Shell, PHP2Shell and Node2Shell Enable Remote Code Execution
Summary
An explainer compares Log4Shell, React2Shell, PHP2Shell and Node2Shell, detailing their code-execution flaws, exposure paths, affected components, fixes and risks from bundled dependencies.
Key points
- Log4Shell exploited Log4j JNDI lookups, while React2Shell used insecure deserialization of React Flight payloads to reach Node.js functions; neither required attacker authentication.
- PHP2Shell (CVE-2026-109618 and CVE-2026-109619) involves use-after-free bugs in PHP request handling. The article identifies session upload progress, enabled by default, as one confirmed path.
- Node2Shell (CVE-2026-111497) is an out-of-bounds write in Brotli. Researchers reported code execution in both client and server directions, but their exploit did not work on every attempt; crashes or memory leaks were described as more likely in practice.
- Brotli is bundled in multiple runtimes and platforms, and some frameworks decode compressed request bodies automatically, potentially exposing systems through dependencies teams did not select directly.
- The article lists fixes for PHP, Node.js, Bun, React and other Brotli-using projects, while noting that SUSE and standard Red Hat Enterprise Linux repositories did not yet have a fix at the time of writing.
- The article says AI-assisted research helped turn a long-standing PHP bug into working code execution and argues that automated analysis may accelerate vulnerability discovery.
Article Details
- Vulnerability Types
- Remote code execution
- Use-after-free
- Out-of-bounds write
- Insecure deserialization
- JNDI lookup injection
- Severity
- CVSS 9.2 for PHP2Shell and Node2Shell; CVSS 10.0 for Log4Shell and React2Shell.
- Affected Versions
- Node.js 24.22.0 (researchers achieved code execution)
- React 19 default setups
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Use Aikido’s patched PHP images when an upstream PHP fix is unavailable.
- Use Aikido’s patched Node.js or Ubuntu images for the Brotli flaw when a vendor fix is unavailable.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterReact2Shell requests could reach Node.js child_process.execSync and run shell commands.T1105 · Ingress Tool TransferA Log4Shell JNDI lookup could make Log4j fetch a Java class from an attacker-controlled server.T1190 · Exploit Public-Facing ApplicationThe vulnerabilities can be triggered by crafted requests sent to vulnerable servers, including PHP, Node.js, and React applications.T1203 · Exploitation for Client ExecutionA malicious server response containing crafted compressed data could exploit Node2Shell in an unpatched client that accepts the response.
CVE
CVE-2021-44228is a remote code execution (RCE) flaw in software. The -Shell suffix took off with Log4Shell (CVE-2021-44228) in December 2021. React2Shell switched the 4 out for a 2 in December 2025, and the researchCVE-2025-55182React2Shell (CVE-2025-55182)CVE-2025-67779Security Agency, added it to its list of vulnerabilities exploited in real attacks. A follow-up bug, CVE-2025-67779, got around the original patch, so teams had to upgrade a second time.CVE-2026-109618CVE-2026-109618 and CVE-2026-109619CVE-2026-109619CVE-2026-109618 and CVE-2026-109619CVE-2026-111497Node2Shell (CVE-2026-111497)
People
Products
Brotliobjects from Flight payloads without checking their structure. Express 5 and body-parser 2.x decode Brotli request bodies from any client that sends one, often before any authentication check runs.Log4jIn all of these shell vulnerabilities, attacker-controlled input reached code that treated it as safe. Log4j interpreted text it was only meant to write down, and React rebuilt objects from Flight payloads withoutNode.jsthe naming convention when dubbing October's bugs. PHP disclosed PHP2Shell on October 21, 2026, and Node.js shipped its Node2Shell fixes the same day. Either one would have been the security story of the year onPHP2 in December 2025, and the research community followed the naming convention when dubbing October's bugs. PHP disclosed PHP2Shell on October 21, 2026, and Node.js shipped its Node2Shell fixes the same day. Either oneReactIf your stack runs PHP, Node.js, React, or Java, at least one of these was probably sitting in it if you were running it a few years ago.