Blog
weltpixel.com/blog

Is HTML2Shell Real? No, but PHP2Shell Is: What Magento Stores Should Patch

|Dan Giura
Is HTML2Shell Real? No, but PHP2Shell Is: What Magento Stores Should Patch

TL;DR

The bug doesn't exist. A post on X on October 24 shared an image dressed up as a CVE.org record, scored 10.0, using CVE-2026-42069, a real and unrelated Kirby CMS issue [1] [2]. It worked because it landed in a week of real "2Shell" names. Two of those matter for a Magento store. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 [21]. HTTP2Shell (CVE-2026-111497) is an out-of-bounds write in Google's Brotli decoder, fixed on October 21 [6] [7].

Key Takeaways

  • The joke has no CVE, no vendor advisory and no fix, because there's no bug [1] [4].
  • CVE-2026-42069 is a real Kirby issue, fixed in Kirby 4.9.0 and 5.4.0, and has nothing to do with HTML or Magento [2] [3].
  • PHP2Shell is real and fixed by a PHP update. PHP says every installation serving web requests is at risk [21].
  • HTTP2Shell, also called Node2Shell, is CVE-2026-111497: fixed in Brotli 1.0.10, 1.1.1 and 1.2.1, and in Node.js 22.23.4, 24.22.1 and 26.12.1 [7] [8].
  • On a Linux Magento server the Brotli fix is the distribution's patched library, and Debian's keeps an older-looking number, 1.0.9-2+deb12u1, so ask for the build string [11] [12].
  • As of October 26, CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-111497 [10].

Three names, three answers

Name Real? What a Magento store does
HTML2Shell No. A joke image posted on X on October 24, 2026 [1] Nothing
PHP2Shell (CVE-2026-109618, CVE-2026-109619) Yes. Two critical bugs in PHP, fixed October 21 [21] Update PHP, or confirm the host's patched build. Our PHP2Shell guide for Magento 2 has the checks
HTTP2Shell, also called Node2Shell (CVE-2026-111497) Yes. A Brotli decoder bug, fixed October 21 [6] [7] Ask the host about the server's Brotli library; developers update Node.js [8]

What to tell a client who forwarded it

If you run an agency, at least one client has probably forwarded you the image this week. Here's a reply you can paste back:

HTML2Shell isn't a real vulnerability. It's a joke image that reused the number of an unrelated bug in another CMS, so there's nothing to patch for it. The real issues from the same week are in PHP and in the Brotli compression library, and those are the ones we're checking on your server.

Why there's nothing to patch for HTML2Shell

Read the image's own description and the joke gives itself away: "A critical vulnerability in HTML allows unauthenticated remote attackers to execute arbitrary commands by persuading a browser to interpret a specially crafted <div>. Successful exploitation grants root access regardless of whether HTML is considered a programming language" [1].

Whether HTML counts as a programming language is a long-running programmer joke, usually at the expense of web designers [1]. And browsers interpret <div> elements on every web page ever made.

HTML is markup: it describes a page, your server sends it, and the visitor's browser draws it. The HTML your Magento store serves never runs on your server, so it has no way to hand anyone a shell there. A browser flaw would be the browser maker's to fix, not yours.

Where the joke came from

Lead Stories, a fact-checking site, traced the image to a post on X published on October 24, 2026, with the text "Ugh now we have html2shell?" [1]. Asked how many people would believe it, the poster replied "Too many lol" [1].

The number on the image is real. CVE-2026-42069 belongs to Kirby, an open-source content management system: logged-in Panel users could read site, user and role information that their permissions should have kept from them [2] [3]. Kirby published its advisory on April 23, 2026, and the CVE record followed on May 9, rated 7.1 High, with fixes in Kirby 4.9.0 and 5.4.0 [2] [3]. The record doesn't mention HTML or code execution.

The calendar did the rest. PHP2Shell and Node2Shell arrived on October 21, then Python2Shell and HTTP2Shell on October 23, as the same Brotli bug turned up in more software [21] [8] [4] [5]. A fifth "2Shell" name didn't look strange, and HTTP2Shell is two letters away from the joke's name.

PHP2Shell: the real one to patch first

PHP2Shell is the nickname for two critical bugs in PHP itself, CVE-2026-109618 and CVE-2026-109619, which PHP says "can allow unauthenticated remote code execution" [21]. PHP fixed them on October 21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It says every PHP installation serving web requests is at risk, and rates Apache with mod_php the highest risk [21]. PHP 8.1 and older get no update from the PHP project, though some Linux distributions and long-term-support vendors provide backported fixes [21]. On October 23, PHP added one more step: set session.upload_progress.enabled=0, or keep it in place if you already did, until its next regular bugfix release, to close off an unlikely further issue, CVE-2026-115560 [24].

So the fix for a Magento store is a PHP update, or your host's patched build of the PHP you run. Distributions received the patches in advance, and PHP tells their users to check with the vendor for updated packages [21]. The guide linked in the table above walks through finding which PHP your website actually runs and the five questions to send your host.

HTTP2Shell, the Brotli bug with the similar name

CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, the code that unpacks Brotli-compressed data [6]. A specially built compressed stream can corrupt the decoder's memory, leak memory contents, crash the program, or potentially run an attacker's code [6]. The CVE record rates it 9.2 Critical; Node.js rates it high [6] [8].

Affected versions are Brotli 1.0.3 up to 1.0.10, 1.1.0 up to 1.1.1, and 1.2.0 up to 1.2.1, and Google released the fixed versions on October 21, 2026 [6] [7]. Node.js bundles its own copy of the decoder and fixed it in 22.23.4, 24.22.1 and 26.12.1 the same day [8]. As of October 26, CISA's catalog of exploited vulnerabilities, version 2026.10.23, doesn't list it [10].

What a Magento store should check for HTTP2Shell

PHP announced updated Windows builds on October 26: 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, carrying Brotli 1.2.1, with the PHP version itself unchanged [9]. Adobe supports Magento on Linux only [11], so those builds aren't your store's fix. Here's where Brotli can sit on a Linux Magento setup:

Where Does it matter? What fixes it
The server's system Brotli library (libbrotli1 on Debian) Yes. On Debian, PHP's cURL extension depends on the system cURL library, which depends on Brotli [14] The distribution's patched package, then a PHP restart [12] [22]
The optional PHP Brotli extension (ext-brotli) Only if someone installed it; Magento doesn't require it [15] Version 0.21.1 or later, released October 24 [17]
Node.js on developer machines and build servers Yes, where Node runs. It isn't part of the storefront [18] Node 22.23.4, 24.22.1 or 26.12.1 [8]
The web server's Brotli module (Apache mod_brotli, nginx ngx_brotli) Not where the risk is described: both compress what the server sends [19] [20] Your host's normal updates

PHP says the vulnerable decoder can be reached through its cURL extension when automatic response decompression is turned on; it's off by default in cURL, but HTTP client libraries can turn it on [9]. Magento requires the Guzzle HTTP client [15], and Guzzle switches decompression on unless told otherwise [16]. So the patched library matters on a Magento server. None of the sources behind this article describes an attack on a Magento store through this bug.

Then the version-number trap from PHP2Shell, again. Debian's fixed builds are 1.0.9-2+deb12u1 on Debian 12 and 1.1.0-2+deb13u1 on Debian 13 [12]. Next to Google's 1.0.10, the Debian 12 build looks one release behind, and it carries the fix. On October 26, Ubuntu's tracker still showed its brotli package as "Needs evaluation" on every release it lists [13]. Debian's security FAQ adds that after an update "it may also be necessary to restart a service or a running process" [22].

Three questions for your host:

  1. Which build of the Brotli library is the server on, and does it include the fix for CVE-2026-111497? Ask for the build string [12] [13].
  2. Were PHP and the web server restarted after the library update [22]?
  3. Is the PHP Brotli extension installed, and if so, which version [17]?

Ask your developer one more: which Node.js version do your build servers and laptops run [8] [18]? Magento's own patch level is a separate check, covered in our Magento security update for September 2026.

FAQ

Is HTML2Shell real?

No. No CVE record or vendor advisory describes it, and Lead Stories traced it to a joke image posted on X on October 24, 2026 [1] [4].

What is CVE-2026-42069?

A missing-authorization issue in Kirby CMS, fixed in Kirby 4.9.0 and 5.4.0. It has nothing to do with HTML, code execution or Magento [2] [3].

Which PHP versions are vulnerable?

For PHP2Shell, any PHP installation serving web requests until it's on 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor's patched build. PHP 8.1 and older got no release from the PHP project [21]. Our PHP2Shell checks for Magento 2 show how to confirm your store's PHP and what to ask your host.

Is HTTP2Shell the same as Node2Shell?

Yes. Both names refer to CVE-2026-111497 in the Brotli decoder; it was called Node2Shell first and HTTP2Shell once it was found outside Node.js [4] [5] [6].

If either fix turns into a PHP or Magento upgrade, check your extensions' PHP support before the move. Our Magento 2 Google Analytics 4 extension added PHP 8.4 in v1.15.0 (April 22, 2025) and PHP 8.5 in v1.17.0 (May 18, 2026) [23].

Sources

  1. Fact Check: JOKE CVE-2026-42069 'HTML2Shell' Issue NOT A Real Internet Security Vulnerability, Lead Stories (Maarten Schenk), October 2026, retrieved October 26, 2026, https://leadstories.com/hoax-alert/2026/10/fact-check-cve-2026-42069-html2shell-vulnerability.html
  2. CVE-2026-42069, Kirby: Read access to site, user and role information is not gated by permissions, CVE.org, published May 9, 2026, retrieved October 26, 2026, https://www.cve.org/CVERecord?id=CVE-2026-42069
  3. GHSA-2h7v-4372-f6x2, Kirby security advisory, April 23, 2026, retrieved October 26, 2026, https://github.com/getkirby/kirby/security/advisories/GHSA-2h7v-4372-f6x2
  4. Article 27064 on the joke name and the real Brotli flaw, CVE-2026-111497, pasqualepillitteri.it, October 25, 2026, retrieved October 26, 2026, https://pasqualepillitteri.it/en/news/27064/html2shell-does-not-exist-real-flaw-brotli-cve-2026-111497
  5. Node2Shell: Node.js Brotli RCE, CVE-2026-111497, Aikido Security blog, retrieved October 26, 2026, https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497
  6. CVE-2026-111497, Out-of-Bounds Write in Google Brotli Decoder, CVE.org, published October 22, 2026, retrieved October 26, 2026, https://www.cve.org/CVERecord?id=CVE-2026-111497
  7. Brotli v1.2.1 release (with v1.1.1 and v1.0.10), google/brotli on GitHub, October 21, 2026, retrieved October 26, 2026, https://github.com/google/brotli/releases/tag/v1.2.1
  8. Wednesday, October 21, 2026 Security Releases, Node.js, retrieved October 26, 2026, https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
  9. Updated PHP Windows builds for Brotli security fix, PHP News Archive 2026, October 26, 2026, retrieved October 26, 2026, https://www.php.net/archive/2026.php#2026-10-26-1
  10. Known Exploited Vulnerabilities Catalog, CISA, catalog version 2026.10.23, checked October 26, 2026, https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  11. System requirements, Adobe Commerce installation guide (Experience League), retrieved October 26, 2026, https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/system-requirements
  12. CVE-2026-111497, Debian security tracker, retrieved October 26, 2026, https://security-tracker.debian.org/tracker/CVE-2026-111497
  13. CVE-2026-111497, Ubuntu security, retrieved October 26, 2026, https://ubuntu.com/security/CVE-2026-111497
  14. php8.2-curl and libcurl4 packages (bookworm), Debian packages, retrieved October 26, 2026, https://packages.debian.org/bookworm/php8.2-curl and https://packages.debian.org/bookworm/libcurl4
  15. composer.json, magento/magento2 repository (2.4-develop branch), retrieved October 26, 2026, https://github.com/magento/magento2/blob/2.4-develop/composer.json
  16. CurlFactory.php, guzzle/guzzle repository (7.10 branch), retrieved October 26, 2026, https://github.com/guzzle/guzzle/blob/7.10/src/Handler/CurlFactory.php
  17. php-ext-brotli 0.21.1 release, kjdev/php-ext-brotli on GitHub, October 24, 2026, retrieved October 26, 2026, https://github.com/kjdev/php-ext-brotli/releases/tag/0.21.1
  18. Grunt, Adobe Commerce frontend developer guide, retrieved October 26, 2026, https://developer.adobe.com/commerce/frontend-core/guide/tools/grunt
  19. Apache Module mod_brotli, Apache HTTP Server 2.4 documentation, retrieved October 26, 2026, https://httpd.apache.org/docs/2.4/mod/mod_brotli.html
  20. ngx_brotli, google/ngx_brotli on GitHub, retrieved October 26, 2026, https://github.com/google/ngx_brotli
  21. Security advisory: Critical remote code execution vulnerabilities, update now, PHP News Archive 2026, October 21, 2026, retrieved October 26, 2026, https://www.php.net/archive/2026.php#2026-10-21-5
  22. Debian security FAQ, Debian, retrieved October 26, 2026, https://www.debian.org/security/faq
  23. WeltPixel Google Analytics 4 User Guide and Change Log (v1.15.0 and v1.17.0 entries), retrieved October 26, 2026, https://docs.weltpixel.com/GA4/User-Guide-WeltPixel-Google-Analytics-4.html
  24. Informational advisory: Session upload progress, PHP News Archive 2026, October 23, 2026, retrieved October 26, 2026, https://www.php.net/archive/2026.php#2026-10-23-1

Ready to upgrade your tracking?

Server-side tracking for Magento and Shopify — accurate data, better attribution, full privacy compliance.

Shopify App Magento Extension