PHP2Shell Remote Code Execution Vulnerabilities

Update: October 26, 2026 (HTTP2Shell)

Since our October 22 update on PHP2Shell, a separate remote code execution vulnerability called HTTP2Shell (CVE-2026-111497) has been disclosed.

We reviewed the internet-facing endpoints on Andromeda’s services and customer clusters and found none that decode Brotli-compressed requests. We also now reject Brotli-compressed requests at the public entry points we manage.

If you run Node.js, Python or other software that decodes Brotli in your environment, we recommend updating now. The Node.js security release lists the fixed versions.

HTTP2Shell is a vulnerability in the Brotli decoder used by Node.js and some Python packages. It allows an unauthenticated party to run arbitrary code on systems that decode crafted Brotli-compressed data.

Original update: October 22, 2026

Andromeda does not use PHP in any of its environments, so these vulnerabilities do not affect Andromeda’s infrastructure.

Two critical remote code execution vulnerabilities in core PHP, known together as “PHP2Shell,” were disclosed this week. Both allow an unauthenticated party to run arbitrary system commands. If you run PHP in your environment, we recommend patching now. The PHP advisory lists the fixed versions and describes the vulnerabilities in detail.