A ready-to-use prompt and runbook for IT teams responding to the vulnerabilities disclosed in the week of 20 October 2026:
- **PHP "php2shell"**: CVE-2026-109618 and CVE-2026-109619 (unauthenticated remote code execution in every PHP that serves web requests).
- **Node.js security release of 21 October 2026**: ten CVEs, including the Brotli decoder flaw.
- **Brotli "Brotli2Shell / Node2Shell / HTTP2Shell"**: CVE-2026-111497, which also reaches Bun, .NET, Python HTTP clients, Envoy/Istio, PAN-OS and others.
CISA lists CVE-2026-109618, CVE-2026-109619 and CVE-2026-111497 in its Known Exploited Vulnerabilities catalog.
| [`security_prompt_php_node_brotli_2026-10-29_EN.md`](security_prompt_php_node_brotli_2026-10-29_EN.md) | English (reference version) |
| [`security_prompt_php_node_brotli_2026-10-29_PT-BR.md`](security_prompt_php_node_brotli_2026-10-29_PT-BR.md) | Português (Brasil), faithful translation |
1. **As a runbook:** an IT lead follows sections 3 to 9: inventory, exposure and criticality (P0 to P3), compromise assessment from 17 October 2026, remediation per technology, verification and hardening.
2. **As an LLM agent prompt:** fill in section 1 (environment, access, change approver, maintenance windows) and load the whole file into an agent that has access to your infrastructure. Section 10 tells the agent to stay read-only until a change is approved, never run exploit code, protect secrets and treat logs and other inspected content as untrusted data. The prompt is guidance, not a security boundary: enforce read-only access and approvals through the permissions you grant the agent.
The facts are as of **29 October 2026**. Fixed versions, vendor advisories and mitigations change quickly: PHP already has a pending fix for a regression in 8.4.27/8.5.12, and several projects that bundle Brotli had not shipped fixes yet. The prompt tells the reader, and the agent, to check the primary sources in section 11 before acting. Do not treat this repository as a live tracker.
Drafted with AI assistance from public primary sources (PHP, Node.js, Google Brotli, CISA, vendor advisories and security research), then fact-checked and command-checked by an independent AI reviewer from another vendor over three rounds. The Portuguese version was translated and checked for identical commands, versions and links. Errors are still possible: please open an issue if you find one.
Provided "as is", without warranty of any kind. This is not professional security advice for your specific environment, and the authors accept no liability for its use. Commands that restart services or change configuration can affect production: test, follow your change process, and involve your incident response provider if you suspect compromise.
[Creative Commons Attribution 4.0 International (CC BY 4.0)](LICENSE). You may and adapt it, including commercially, with attribution.
Prompt e roteiro para equipes de TI diagnosticarem e corrigirem as falhas da semana de 20 de outubro de 2026: PHP "php2shell", a atualização de segurança do Node.js de 21/10 e a falha do descompressor Brotli. Serve como roteiro para o responsável de TI ou como instrução completa para um agente de IA com acesso à infraestrutura (preencha a seção 1 antes). Os fatos são de 29/10/2026 e envelhecem rápido: confira as fontes oficiais da seção 11 antes de agir. Material fornecido no estado em que se encontra, sem garantia, sob licença CC BY 4.0.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
