PHP2Shell and Node.js Brotli: How to Patch Your cPanel Server (Step by Step)

Short version: on 21 October 2026, PHP and Node.js each released emergency security fixes. If you run PHP or Node.js on a server you manage, update it now and restart it. Your website code does not need to change, but the server does. If your site is on shared hosting, ask your host whether they have patched.

What happened

• PHP, "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619). Two flaws in the PHP runtime itself, both rated 9.2 out of 10. They can let an unauthenticated attacker run code on the server or read memory from PHP worker processes, which may hold passwords, tokens and API keys. They affect nearly every PHP version back to 5.4, whether you use PHP-FPM, mod_php, php-cgi or LiteSpeed. Attack attempts were reported before and after the patch.
• Node.js, Brotli decoder (CVE-2026-111497). A high-severity memory-write flaw in the Brotli code bundled with Node.js 22, 24 and 26. It is triggered by malformed Brotli data that your app decompresses, for example a request body or a response fetched from another server. The same release fixed nine other CVEs.
• A third PHP advisory (CVE-2026-115560), 23 October. A narrow remote-code-execution risk in session upload progress. No emergency fix is planned yet. Turning upload progress off covers it, and step 4 below does that.

Patching is the only complete fix. These are the fixed upstream versions:

Patching PHP on a cPanel/WHM server

These are the steps we followed on our own servers. They assume root SSH access to a server running cPanel on AlmaLinux, Rocky Linux or CloudLinux. Commands use dnf; on CloudLinux 7 use yum. Run them in a quiet period and keep a second SSH session open in case you lock yourself out.

Step 1. Log in

In PuTTY (or any SSH client), enter the server IP, port 22, and log in as root. Right-click pastes in PuTTY.

Step 2. See what is installed

cat /etc/redhat-release
/usr/local/cpanel/cpanel -V
whmapi1 php_get_installed_versions | grep php
whmapi1 php_get_vhost_versions | grep -E 'version: (ea|alt)-php' | sort | uniq -c

Note which PHP versions actually have sites on them. You need this list for step 7.

Step 3. Back up the PHP settings

tar czf /root/php-config-backup-$(date +%Y%m%d).tar.gz /opt/cpanel/ea-php*/root/etc /opt/alt/php*/etc /etc/cpanel/ea4 2>/dev/null; ls -lh /root/php-config-backup-*

Step 4. Switch on temporary protection

This turns off session upload progress in every PHP version, which closes the path behind CVE-2026-109619 and CVE-2026-115560 until the real patch is installed. It does not replace the patch. It backs up each php.ini first.

for f in /opt/cpanel/ea-php*/root/etc/php.ini /opt/alt/php*/etc/php.ini; do
  [ -f "$f" ] || continue
  cp -a "$f" "$f.bak-$(date +%Y%m%d)"
  if grep -q '^session.upload_progress.enabled' "$f"; then
    sed -i 's/^session.upload_progress.enabled.*/session.upload_progress.enabled = Off/' "$f"
  else
    echo 'session.upload_progress.enabled = Off' >> "$f"
  fi
done
echo DONE

If cp asks to overwrite an older backup, press Enter. This setting cannot be changed from ini_set() or .user.ini, so it has to be set in php.ini or the FPM pool.

Step 5. Make sure PHP can update

First find the PHP repository:

dnf repolist all 2>/dev/null | grep -i ea4

If the main line (cl-ea4 or EA4) ends in disabled, enable it. On CloudLinux use cl-ea4 in place of EA4:

dnf config-manager --set-enabled EA4

Then keep PHP updating automatically from now on:

sed -i 's/^RPMUP=.*/RPMUP=daily/' /etc/cpupdate.conf; cat /etc/cpupdate.conf

Step 6. See what updates are waiting

dnf clean metadata
dnf check-update 'ea-php*' 2>/dev/null | grep php-cli

Step 7. Remove old versions nobody uses

Only remove a version that had zero sites in step 2. Unused old versions are attack surface you no longer need. Example, for PHP 7.2 and 7.3:

dnf remove 'ea-php72*' 'ea-php73*'

Edit the list to match your server, read what dnf says it will remove, then type y.

Step 8. Install the patched PHP

dnf update 'ea-php*' 'alt-php*'

Type y. If one version errors (for example ea-php84), update the rest first and come back to it:

dnf update 'ea-php*' 'alt-php*' --exclude='ea-php84*'

If dnf finds nothing and you are on CloudLinux, update cloudlinux-release first, then try again.

Step 9. Restart PHP and Apache

/scripts/restartsrv_apache_php_fpm; /scripts/restartsrv_httpd

Step 10. Confirm the patch is in

CloudLinux and cPanel ship these fixes as backports, so the version number can look old. Check the changelog for the CVE number instead of trusting the version.

for p in /opt/cpanel/ea-php*/root/usr/bin/php; do echo -n "$p: "; $p -v | head -1; done
for p in $(rpm -qa --qf '%{NAME}\n' | grep -E '^ea-php[0-9]+-php-common$' | sort); do echo -n "$p: "; rpm -q --changelog $p | grep -c 109618; done

Every line in the second part must show 1 or more. A 0 means that PHP version is still unpatched.

Step 11. Check for intruders

Attacks were being tried before the patch existed, so look for signs of a break-in on every server you patch.

find /home/*/public_html -name '*.php' -mtime -3 2>/dev/null | head -30
grep -HnE '(curl|wget).*\|\s*(ba)?sh|/tmp/|/dev/shm|base64' /var/spool/cron/* 2>/dev/null
last -n 10

The first command lists PHP files changed in the last 3 days (expect your own deployments, and nothing unfamiliar). The second looks for cron jobs that download and run code. The third shows the last logins. A hit is not proof of a break-in, but treat anything you cannot explain as one until you have checked.

Step 12. Test the sites

Open two or three sites on that server in a browser and make sure they load, log in, and upload a file.

After the patch

The fix adds a hard memory limit that stops a PHP process when it is reached. Review memory_limit and post_max_size for your busiest sites, and watch for large uploads that now fail. If you run Imunify360, check that its firewall rules are up to date. They are a stopgap, not a fix.

Updating Node.js

There is no setting that fixes CVE-2026-111497. You must update the Node.js binary and then restart every app that uses it. Updating the system brotli package does not help, because Node.js bundles its own copy.

Step 1. Find every Node.js you run

Node.js is often installed more than once: the system package, a version manager such as nvm, a container image, and the Node.js Selector in cPanel. Check each one.

node --version
which -a node
rpm -qa 'alt-nodejs*'

The fixed upstream versions are 22.23.4, 24.22.1 and 26.12.1. Anything on Node.js 20 or older is end-of-life and has no upstream fix, so plan a move to 22, 24 or 26.

Step 2. Update

On a cPanel server with CloudLinux Node.js Selector:

yum update 'alt-nodejs*'

Elsewhere, install the fixed version through your normal route: your package manager, nvm install 22 (or 24, 26), or a new base image for Docker, then rebuild and redeploy.

Step 3. Restart the apps

Running apps keep using the old binary until they restart. Restart them from Node.js Selector in cPanel, or per app:

cloudlinux-selector restart --json --interpreter nodejs --user <user> --app-root <app_root>

If you use PM2 or systemd, restart those processes too.

Step 4. Verify

On supported lines, node --version should show 22.23.4, 24.22.1 or 26.12.1 or later. On CloudLinux, end-of-life lines keep their old version number, so check the package release instead. The minimum fixed releases are:

Check one with rpm -q alt-nodejs22. As of CloudLinux's last update, a few builds were still being released. If your version is not available yet, check their notice again later.

Does my app even use Brotli?

You are exposed if your app decompresses Brotli data from outside, through node:zlib or fetch(). Libraries can use these calls without you writing any Brotli code, so update anyway. A firewall rule can help for incoming requests but does not cover responses your app fetches from other servers.

If you host websites for customers

Patch first, then send a short notice. Customers need to know what you did and whether they must act.

• What happened: two serious PHP flaws and one Node.js flaw were announced on 21 October 2026.
• What you did: the date and time you patched, and which PHP and Node.js versions are now on the server.
• What they must do: nothing for their site's code, unless they run their own Node.js outside the control panel, or an old PHP version you have removed.
• What to watch: if a large upload now fails, contact support with the time it happened.

The PHP flaws can expose memory from PHP worker processes, which may contain passwords, tokens and API keys. If step 11 showed anything you cannot explain, change database passwords, API keys and payment-gateway secrets used by the sites on that server.

Sources

As of 24 October 2026:

• PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws, The Hacker News
• PHP Warns of Another Unpatched RCE Risk, The Hacker News
• PHP CVE-2026-109618 and CVE-2026-109619: CloudLinux Package Status
• Node.js Brotli Decoder Bug Could Allow Remote Code Execution, The Hacker News
• Node.js October 2026 Security Releases: alt-nodejs Updates, CloudLinux

Back up before you change anything, and test on one server first. These commands run as root, and you use them at your own risk. Need help with your hosting or SMS setup? Contact us.