> status: mostly fine. patch anyway.practical AI security · est. 2026

Brief · Builders

The *2shell Domain Wave Keeps Growing, and the Real Patches Are Still the Point

By alkizz ·

First, the chill part: nginx2shell, apache2shell and nodejs2shell are domain names, not vulnerabilities, and none of the projects involved uses them. It's a naming fad, and honestly it's a pretty funny one, because the names keep arriving faster than the bugs.

The useful part is that each of these jokes sits next to a real patch. nginx shipped one on Oct 14, Apache httpd shipped 2.4.69 on Oct 1, and Node.js says it has security releases coming on or shortly after Nov 11. None of the October nginx bugs are in CISA's KEV catalog, and I found no primary source reporting exploitation in the wild.

The domains

nginx2shell.com was registered on Oct 21, 2026, per RDAP. The page is a domain-bounty gag from Previdian, an exploitation-intel company, and it opens with "No vulnerability is being announced here." The offer is that if you find "a genuine unauthenticated remote code execution vulnerability in nginx," you get the domain, which is a joke with a prize and not an advisory.

apache2shell.com came three days later, on Oct 24, per RDAP. The registrant is redacted, so I don't know who owns it, and the page just says it's under construction. There's no CVE, no advisory and no patch claim on it.

Now there's nodejs2shell.com too, and that one's mine, because I registered it tonight to join in on the fun. RDAP shows it registered on Nov 5, 2026 at 8:37 PM ET through Cloudflare, with the registrant redacted. It's live now as a short parody page that says up front that no vulnerability is being announced, points readers to the real Node.js security release and the real nginx fix, and says it isn't affiliated with Node.js. If a real nodejs2shell ever shows up, they can have it. It's the same joke, told politely.

All of these sit in the October wave of *2shell registrations that followed PHP2Shell, which star2shell.com tracks if you want the timeline. The link between them is naming fashion, not code.

php2shell.com is registered too, back on Oct 14, 2026 at 1:02 PM ET through MarkMonitor, per RDAP, but it isn't a joke. It's Wiz's real disclosure site for the two PHP bugs fixed on Oct 21, it's the name the rest copied, and I covered it in the PHP brief.

The patches that actually matter

nginx. On Oct 14, nginx released 1.30.6 (stable) and 1.31.7 (mainline) with fixes for five CVEs. The one I'd look at first is CVE-2026-97205, a use-after-free when you use ngx_http_ssi_module with AIO. Per F5, which is the CNA for nginx, when asynchronous file I/O is enabled in certain configurations, an SSI page with "include virtual" commands can trigger a use-after-free in the worker process. That can crash the worker or corrupt memory, and F5 says attackers can execute code on systems where ASLR is disabled or can be bypassed. It's a data plane issue, with no control plane exposure.

Here's where it gets confusing, and I think it's part of why this one slid by while everyone was looking at the joke domains. nginx.org's advisory list labels all five CVEs "medium." F5 scores CVE-2026-97205 at CVSS v3.1 8.1 High and v4.0 9.2 Critical, and it gives the same scores to CVE-2026-15176 (buffer overflow with alias and rewrite) and CVE-2026-93479 (buffer overflow in script evaluation). Both labels are real. They're just measuring differently, and the 9.2 still depends on a config (AIO plus an SSI include virtual path) and a high attack complexity, so it isn't a drive-by against every nginx box.

The vulnerable range for CVE-2026-97205 is 0.8.11 through 1.31.6, which is basically every nginx you've ever run, and the fix is 1.30.6+ or 1.31.7+. nginx didn't publish a config-only workaround in what was checked, so the fix is upgrading.

Apache httpd. 2.4.69 came out on Oct 1 and fixed 20 CVEs, which Apache rates 5 moderate and 15 low, per the httpd vulnerabilities page, and the name "apache2shell" doesn't appear anywhere on it. The 2.4.70 announcement from Nov 3 calls itself "a feature and bug fix release," so it isn't a security release and has nothing to do with apache2shell.com.

Node.js. The Node.js project says it will release new versions of the 26.x, 24.x and 22.x lines on or shortly after, Wednesday, November 11, 2026, and the highest severity issue in each line is HIGH. The details aren't out yet, so there's nothing to patch today, but there's a date to plan around. The page also notes that End-of-Life versions are always affected when a security release happens.

What to do

Sources

Related

More briefs

← All briefs