October 2026 security update: PHP2Shell and HTTP2Shell

Last updated: October 27, 2026

This page provides VergeSense’s current assessment of PHP2Shell and HTTP2Shell (also referred to as Node2Shell), the measures we have taken, and any actions required from customers. We will update this page as our assessment or remediation status changes.

Current assessment

Our engineering and security teams have assessed these two attack vectors and have identified no exposure in VergeSense services. Their October 27 assessment also confirms no Rigado or Xovis exposure to these attack vectors.

The findings below apply specifically to PHP2Shell and HTTP2Shell. They do not constitute an assessment of unrelated vulnerabilities or certificate trust issues.

PHP2Shell: CVE-2026-109618 and CVE-2026-109619

Exposure status

VergeSense hosted services, APIs, and software platforms do not use PHP and are not directly affected by either vulnerability.

Our engineering team’s October 27 assessment also confirms no PHP2Shell exposure through Rigado or Xovis.

Patch and remediation status

No direct VergeSense components have been identified as affected by these two PHP vulnerabilities. There are therefore no applicable PHP versions, PHP patches, or PHP remediation dates to report for those components.

Required customer action

No customer action is required for these two PHP vulnerabilities. Customers do not need to install updates, change configurations, schedule maintenance, or validate fixes in response to PHP2Shell.

HTTP2Shell / Node2Shell

Exposure status

Our engineering and security teams’ October 27 assessment identifies no exposure to this attack vector, including through Rigado or Xovis.

Defensive measures and patching

We have disabled Brotli compression through Cloudflare as a defensive measure while Node.js patching is completed.

Node.js projects and libraries have either been patched or are being patched. This work remains in progress; we will update this page when completion is confirmed.

VergeSense is managing these platform changes. If our review identifies any action required for your deployment, we will contact you directly.

Further updates

Use this page for the latest published status. We will add dated updates when there are material changes to our assessment, patching progress, or customer action requirements.

If we identify an affected component that requires remediation, we will provide the relevant component and version, mitigation, and expected remediation timeline. We will notify affected customers directly if their involvement is required.

For questions about your deployment or a written response to a security questionnaire, email support@vergesense.com. Please include the vulnerability identifier and the services or devices your question concerns.

Update history

October 27, 2026: Updated the assessment to reflect no PHP2Shell or HTTP2Shell exposure, including Rigado and Xovis. Added the Brotli defensive measure and confirmed that Node.js patching is complete for some projects and remains in progress for others.