When PHP2Shell and Node2Shell were disclosed, Radware AI Xploit Shield had targeted protection ready within minutes. That matters because official patches, even when released quickly, take organizations days or weeks to roll out.
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of critical flaws in the PHP engine. Node2Shell (CVE-2026-111497) is a critical flaw in the Brotli decompression code built into Node.js.
Why patches take time to reach production
A released patch is only the start. Even a one-line fix has to be tested, approved and deployed. A PHP or Node.js upgrade means retesting every application that runs on it and restarting or redeploying each service. Legacy systems and third-party applications may have to wait for a vendor, or may have no fix at all. Large organizations roll changes out region by region across hundreds of servers. Until the last server is updated, attackers still have a way in.
How AI Xploit Shield got ahead of the patch
AI Xploit Shield doesn’t apply one generic fix. It builds protection to fit each exploit.
- Three custom AI Xploit Shield signatures: PHP2Shell gave defenders almost no head start. Details leaked on the evening of October 20, before PHP released its fix the next day, and proof-of-concept exploits began circulating shortly after. AI Xploit Shield first replayed the exploit against existing Radware protection, then generated three custom signatures to add a targeted layer for the vulnerable multipart upload-progress request pattern and the exploit payload families identified in public research. The signatures were ready to deploy into customer security policies.
- An AI Xploit Shield signature in minutes: Node2Shell called for a different approach. Its exploit is a malformed compressed stream with no stable payload marker, so there was no pattern for a signature to match. Within minutes, AI Xploit Shield created a signature that closed the request path. Customers could run it in report mode first to confirm that legitimate traffic doesn’t rely on Brotli-compressed requests, then they switched to blocking.
With AI Xploit Shield protecting your applications, your teams still patch, but on their own schedule instead of the attacker’s.
The window keeps getting shorter
In July 2026, 2,500 critical and high-severity CVEs were disclosed, roughly five times the earlier monthly record (Epoch AI). On average, exploitation now begins 1.1 days before a CVE is officially published (Zero Day Clock, August 2026). The flaws behind PHP2Shell went unnoticed in PHP for over a decade until AI-assisted research chained them together.
More vulnerabilities like these are coming. Some will be global, like PHP2Shell and Node2Shell. Many more will be specific to your own applications. When they arrive, the question isn’t only how fast you can patch, but how fast you can make the vulnerability unexploitable. With AI Xploit Shield, the answer is minutes.
Protect first. Patch safely.
Talk to Radware about AI Xploit Shield