The internet is on fire. 🔥 PHP2Shell, Node2Shell, LiteLLM, Shai-Hulud. October (or should I call it Hacktober?) has been generous with incident names. So, let's celebrate the supply chain security awareness month.

These incidents showed that CVEs are around the corner and language-independent. We need to prepare ourselves for the next Java2Shell or Rust4Shell.

What the Hell Happened?

On October 21, PHP2Shell brought two critical PHP runtime vulnerabilities: CVE-2026-109618 , involving out-of-memory corruption, and CVE-2026-109619 , involving stale state between requests. Both can lead to remote code execution (RCE).

The same day's Node.js fixes included Node2Shell , the informal name used for the Brotli decoder issue, CVE-2026-111497 . Crafted compressed input can trigger an out-of-bounds write and potentially remote code execution when decoded. Node.js rates it High .…