Overview
- Brotli
- github.com/google/brotli
Description
Statistics
- 45 Posts
- 101 Interactions
Fediverse
📣 Updated PHP Windows builds are now available:
- PHP 8.2.35-1
- PHP 8.3.36-1
- PHP 8.4.27-1
- PHP 8.5.12-1
‼️ These builds include Brotli 1.2.1 to fix CVE-2026-111497, an out-of-bounds write in Brotli decompression. This vulnerability is in the bundled Brotli library, not PHP code.
📝 Read more: https://www.php.net/archive/2026.php#2026-10-26-1
PHP has rebuilt official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a memory corruption vulnerability in the Brotli compression library.
The issue can be reached via the cURL extension when automatic HTTP response decompression is enabled.
Affected packages include versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, incorporating Brotli 1.2.1.
Windows users are advised to update from the official downloads page.
https://en.hacks.gr/nea-paketa-php-gia-ta-windows-diorthonoyn-sovaro-provlima-asfaleias/
🔒 FrankenPHP 1.13.4 is out, a security release. Upgrade now!
7 vulnerabilities fixed, mostly in worker mode: a crash any client could trigger (1.13.2 and 1.13.3), cross-request env and header leaks, and use-after-free bugs.
Docker and Windows builds also ship Brotli 1.2.1 (CVE-2026-111497), and binaries are built with Go 1.27.3.
Oh, interesting:
git https remote (git-remote-https) may be vulnerable to the #brotli RCE (CVE-2026-111497), if built with brotli-enabled libcurl. I'm guessing updating libbrotli would fix that, but that seems like a neat, little attack vector that flies under the radar.
Palo finally published an advisory outlining impact from CVE-2026-111497 in brotli.
https://security.paloaltonetworks.com/CVE-2026-111497
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. Brotli is commonly used by many HTTP-based applications including Node.js.
Most importantly:
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls that have inspection of Brotli compressed traffic and TLS/SSL decryption enabled on the dataplane. There is no impact on the Management interface (web or API) of the PAN-OS devices.
Node2Shell (CVE-2026-111497): la RCE nel decoder Brotli di Node.js e Bun, e come proteggersi
#tech
https://spcnet.it/node2shell-cve-2026-111497-la-rce-nel-decoder-brotli-di-node-js-e-bun-e-come-proteggersi/
@informatica
The ZAP Network add-on has been updated to use the latest Brotli library.
We do not believe that Java is affected by CVE-2026-111497 but we still recommend that you update this add-on from the ZAP Marketplace ASAP.
We have also regenerated the stable Docker image.
All ZAP versions from 2.14 use the old Brotli library, but as usual only the latest version of ZAP will receive the patch.
We strongly advise those of you running old versions of ZAP to update to 2.17.0
#zaproxy #appsec
🚨 PHP releases new Windows builds to fix critical HTTP2Shell vulnerability
The PHP team has rebuilt its supported Windows packages with Brotli 1.2.1, addressing CVE-2026-111497, an out-of-bounds write flaw that can potentially lead to remote code execution.
⠀
In PHP’s Windows builds, the vulnerable Brotli decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled.
This cURL feature is disabled by default, but applications and HTTP client libraries can turn it on.
⠀
Updated builds:
• PHP 8.5.12-1
• PHP 8.4.27-1
• PHP 8.3.36-1
• PHP 8.2.35-1
⠀
The “-1” suffix indicates that the Windows packages were rebuilt with updated dependencies. The PHP source and runtime version numbers remain unchanged.
This is separate from the PHP2Shell flaws patched on October 21.
UGH, I haven't even finished writing up our #PSIRT assessment to last week's #php2shell #cve and I start Monday morning with #cve2026111497 #node2shell oh yay.
(yes, we have products that are affected. Yay for #CyberResilienceAct #cra compliance.)
Too much coffee, too may CVEs, not enough sleep? Same, tbh. 👉 To bring you this free #Node2Shell scanner, our team worked through the weekend too.
While you scan your target for CVE-2026-111497 (also called #HTTP2Shell), you can also dig into:
☑️ how our active detection works
☑️ what each scan result tells you
☑️ why version-based detection is not enough
☑️ what attackers can do with this vulnerability
☑️ why we're offering this free scanner (and others).
And, before you can scroll twice, you'll have a report like this one ready to share.
Know a colleague, friend, or fellow #infosec or IT who could use this free scanner? Share the URL with them: https://pentest-tools.com/network-vulnerability-scanning/node2shell-scanner
🔥 Node2Shell vulnerability scanner 'NodeGuard' unveiled
We are releasing NodeGuard, a free inspection service for Node2Shell (CVE-2026-111497). By simply entering the service URL, you can quickly check the likelihood of exposure and immediately see the results and recommended actions.
👉 Go to NodeGuard: https://nodejsguard.io
📌 How to use NodeGuard
• After entering the service URL to be inspected, check the assessment results and recommended actions displayed on the screen
• Domains, subdomains: If there are multiple API endpoints, check each one
• After patching, check again using the same URL to see if the action addressed the vulnerability
*Please use only for services you own and manage directly.
If you need to inspect internal network services or deployment/worker environments that cannot be accessed from outside, please leave a message on the NodeGuard page.
Palo Alto confirms PAN-OS Brotli vulnerability CVE-2026-111497, a CVSS 9.2 buffer overflow in PAN-OS 12.2, 12.1 and 11.2. Install the hotfixes now.
#PaloAltoNetworks #PANOS #Brotli #CVE2026111497 #BufferOverflow #Firewall #PrismaCloud #CyberSecurity
🚨 Microsoft issues emergency .NET updates after earlier patches failed to fully fix two vulnerabilities
Microsoft says its October 13 updates did not completely address CVE-2026-102870 and CVE-2026-70197, prompting new out-of-band security releases for .NET 8, 9, 10 and 11.
⠀
CVE-2026-102870 is a high-severity remote code execution flaw in the Blazor WebAssembly debugger.
Attacker-controlled data from a debugged application could escape a generated C# string and execute code on a developer’s computer when they evaluate an expression. The vulnerability has a CVSS score of 8.8 and requires user interaction.
⠀
The emergency updates also address:
• CVE-2026-70197, a SocketAsyncEventArgs memory corruption flaw
• CVE-2026-111497, a Brotli decoder out-of-bounds write
• CVE-2026-114148, a Linux source-build tarball ownership issue
⠀
Microsoft warns that updating the shared .NET runtime alone is not enough to fix the Blazor vulnerability when affected NuGet packages are referenced directly.
Developers should update Microsoft.AspNetCore.Components.WebAssembly.Server and DevServer to patched releases, including version 10.0.14 for .NET 10 projects.
Source: https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates
Bluesky
Overview
Description
Statistics
- 36 Posts
- 141 Interactions
Fediverse
Palo-Alto moved their patch dates for PHP2Shell up after that toot, patches available now. https://security.paloaltonetworks.com/CVE-2026-109618
"no public exploit works reliably on a default PHP setup yet"
PHP2Shell in the Wild: 1,187 IPs, No Mass Exploitation Yet
https://www.crowdsec.net/vulntracking-report/cve-2026-109618-php2shell-no-mass-exploitation-yet
18 IP addresses had already been blocked by CrowdSec's virtual patch for PHP2Shell by the time PHP released its fix on October 21.
Five days later, there's still no mass exploitation. Half of the 1,187 IPs we saw sent a single request, and new sources have held at about 130 a day since Friday. Quiet doesn't mean safe: upgrade PHP, restart every worker, and keep the virtual patch on until the last server is done.
4/4 This is a stopgap. Patch to 8.5.12 / 8.4.27 as soon as possible. Stay safe.
#CVE2026109618 #Security
Sieh da, doch noch ein (ausphasendes) Produkt gefunden mit CVE-2026-109618. Hab die Techniker mal informiert #php2shell
Confirmed exploitation of CVE-2026-109618? It might only be a honeypot but I would be cautious of 15.204.59[.]70 and 162.35.99[.]94
https://github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-24-confirmed-rce.md
🚨 NEW on CISA KEV — exploited in the wild
🛡 PHP Group PHP
PHP Memory Corruption Vulnerability
CVE: CVE-2026-109618 · patch by 2026-10-29
📈 EPSS 100.0% exploitation probability
PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
🔗 https://ninjasignal.ninja/intel/cve/CVE-2026-109618
#cybersecurity #KEV #CVE #infosec
Wieso wundert es mich genau null, dass bestimmte Produkte ein PHP Webinterface haben und jetzt so langsam mal auf den Gedanken kommen, einen Patch zu stellen? https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/
🔎 NEXUS8 WEEKLY DIGEST · 👤 THREAT ACTOR
PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
On October 21, 2026, the PHP project released emergency fixes for two critical remote code execution (RCE) vulnerabilities in the PHP core runtime, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively named…
Also tracked this week: Stolen UpdraftCentral keys used to backdoor WordPress sites · GitLab warns of new max severity…
https://nexus8.8bitsecurity.com/entity/signal_event-12861123
⚠️ Mise à jour : alerte CERT-FR ⚠️
Le CERT-FR constate des tentatives d'exploitation des vulnérabilités CVE-2026-109618 et CVE-2026-109619 ciblant des déploiements spécifiques de PHP.
https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014/
CISA has confirmed active exploitation of two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both carrying a CVSS score of 9.2 and allowing unauthenticated remote code execution.
Security researchers observed attacks in honeypots.
The issues were addressed in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 released in October 2026.
CISA adds PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 to the CISA KEV catalog after confirmed RCE and suspected DPRK-linked scanning.
#PHP2Shell #CISAKEV #PHP #CVE2026109618 #CVE2026109619 #Lazarus #ExploitedInTheWild #CyberSecurity
PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts
Rad Web Hosting Completes Critical #Security Updates Across All Managed #cPanel Servers
October 23, 2026 — Rad Web Hosting is pleased to announce the successful deployment of critical security patches addressing CVE-2026-109618 and CVE-2026-109619 across its entire fleet of managed cPanel & WHM servers.
Following the disclosure of two critical vulnerabilities affecting the PHP scripting engine on October 21, 2026, Rad Web Hosting ...
Continued 👉 https://blog.radwebhosting.com/rad-web-hosting-completes-critical-security-updates-across-all-managed-cpanel-servers/?utm_source=mastodon&utm_medium=social&utm_campaign=mastodon.social #managedserver
PHP2Shell security flaws now successfully exploited in the wild
Two critical remote code execution vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, have now been confirmed as successfully exploited in the wild....
https://itnerd.blog/2026/10/26/php2shell-security-flaws-now-successfully-exploited-in-the-wild/
The PHP Foundation released patches for two vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, codenamed PHP2Shell.
Cloudflare detected millions of exploitation attempts targeting the flaws after public disclosure, though no successful exploitation has been observed to date.
Bluesky
Overview
Description
Statistics
- 25 Posts
- 56 Interactions
Fediverse
🚨 NEW on CISA KEV — exploited in the wild
🛡 PHP Group PHP
PHP Stale Internal Request-State Vulnerability
CVE: CVE-2026-109619 · patch by 2026-10-29
📈 EPSS 100.0% exploitation probability
PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
🔗 https://ninjasignal.ninja/intel/cve/CVE-2026-109619
#cybersecurity #KEV #CVE #infosec
Wieso wundert es mich genau null, dass bestimmte Produkte ein PHP Webinterface haben und jetzt so langsam mal auf den Gedanken kommen, einen Patch zu stellen? https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/
🔎 NEXUS8 WEEKLY DIGEST · 👤 THREAT ACTOR
PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
On October 21, 2026, the PHP project released emergency fixes for two critical remote code execution (RCE) vulnerabilities in the PHP core runtime, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively named…
Also tracked this week: Stolen UpdraftCentral keys used to backdoor WordPress sites · GitLab warns of new max severity…
https://nexus8.8bitsecurity.com/entity/signal_event-12861123
⚠️ Mise à jour : alerte CERT-FR ⚠️
Le CERT-FR constate des tentatives d'exploitation des vulnérabilités CVE-2026-109618 et CVE-2026-109619 ciblant des déploiements spécifiques de PHP.
https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014/
CISA has confirmed active exploitation of two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both carrying a CVSS score of 9.2 and allowing unauthenticated remote code execution.
Security researchers observed attacks in honeypots.
The issues were addressed in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 released in October 2026.
CISA adds PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 to the CISA KEV catalog after confirmed RCE and suspected DPRK-linked scanning.
#PHP2Shell #CISAKEV #PHP #CVE2026109618 #CVE2026109619 #Lazarus #ExploitedInTheWild #CyberSecurity
PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts
Rad Web Hosting Completes Critical #Security Updates Across All Managed #cPanel Servers
October 23, 2026 — Rad Web Hosting is pleased to announce the successful deployment of critical security patches addressing CVE-2026-109618 and CVE-2026-109619 across its entire fleet of managed cPanel & WHM servers.
Following the disclosure of two critical vulnerabilities affecting the PHP scripting engine on October 21, 2026, Rad Web Hosting ...
Continued 👉 https://blog.radwebhosting.com/rad-web-hosting-completes-critical-security-updates-across-all-managed-cpanel-servers/?utm_source=mastodon&utm_medium=social&utm_campaign=mastodon.social #managedserver
PHP2Shell security flaws now successfully exploited in the wild
Two critical remote code execution vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, have now been confirmed as successfully exploited in the wild....
https://itnerd.blog/2026/10/26/php2shell-security-flaws-now-successfully-exploited-in-the-wild/
The PHP Foundation released patches for two vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, codenamed PHP2Shell.
Cloudflare detected millions of exploitation attempts targeting the flaws after public disclosure, though no successful exploitation has been observed to date.
Bluesky
Overview
Description
Statistics
- 5 Posts
- 3 Interactions
Fediverse
Neues zum PHP-Sicherheitsproblem
Aller guten Dinge sind drei. In PHP wurde eine dritte Sicherheitslücke (CVE-2026-115560) gefunden. Die wird aber kein Notfall-Update nach sich ziehen. Erstens ist sie schwierig ausnutzbar, und zweitens kann man sich mit der Konfigurationseinstellung “session.upload_progress.enabled=0" vor Angriffen schützen. Apropos schwierig ausnutzbar: Die beiden anderen Sicherheitslücken, die zusammengefasst als PHP2Shell bezeichnet werden, haben sich ebenfalls als schwierig ausnutzbar erwiesen. Zwar wurden schnell reichlich Angriffs-VERSUCHE beobachtet, aber bisher ist kein einziger Fall eines erfolgreichen Angriffs bekannt.
https://www.pc-fluesterer.info/wordpress/2026/10/26/neues-zum-php-sicherheitsproblem/
I hadn't really tracked it before, but now that I'm paying closer attention, I'm surprised at how long it takes for a FreeBSD package bump to go from committed to available.
Sure, with normal updates it doesn't matter, but security updates that take multiple days for release are a different matter. brotli still isn't available to me after 4 days, the revocation of eMudhra took 6 days, I still don't have a patched version of php85 for CVE-2026-115560...
aarch64 doesn't seem to get updates? Not entirely sure, but a few packages I've spot checked on freshports are all quite old for that platform
Bluesky
Overview
Description
Statistics
- 4 Posts
- 1 Interaction
Fediverse
Popcorn Time : un processus oublié menaçait des millions de PC (CVE-2026-30612) https://www.it-connect.fr/popcorn-time-updater-cve-2026-30612/ #ActuCybersécurité #Cybersécurité #Vulnérabilité
A Popcorn Time updater flaw, CVE-2026-30612, exposed millions of PCs to SYSTEM-level code. Eye Security disabled it on 2M+ systems.
#PopcornTime #Time4Popcorn #CVE202630612 #EyeSecurity #Botnet #SupplyChain #RCE #Malware
https://meterpreter.org/popcorn-time-updater-flaw/?utm_source=mastodon&utm_medium=jetpack_social
Bluesky
Overview
Description
Statistics
- 3 Posts
- 8 Interactions
Fediverse
📣 EMERGENCY UPDATE 📣
Apple pushed additional updates for a zero-day that may have been actively exploited.
🐛 CVE-2026-86950 (CoreGraphics) additional patches:
- iOS and iPadOS 18.7.11
Apple's iOS 18.7.11 fixes CVE-2026-86950, a CoreGraphics zero-day exploited in the wild, on older iPhones and iPads. Update now.
#Apple #iOS #ZeroDay #CVE202686950 #CoreGraphics #ExploitedInTheWild #iPhone #CyberSecurity
Overview
- zip-rs
- zip2
Description
Statistics
- 2 Posts
- 3 Interactions
Fediverse
Details and PoC exploit code are out for CVE-2026-115905, a critical 10.0 CVSS Rust zip crate vulnerability. Upgrade to version 9.0.5 immediately.
#Rust #ZipCrate #CVE2026115905 #PoC #RCE #Cybersecurity #Vulnerability #InfoSec
Overview
- OpenHands
- OpenHands Software Agent SDK
Description
Statistics
- 1 Post
- 20 Interactions
Fediverse
JFC
https://nvd.nist.gov/vuln/detail/cve-2026-112346
OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.
Overview
Description
Statistics
- 2 Posts
Fediverse
Hackers Exploit Critical Arista VeloCloud Orchestrator Flaw https://www.esecurityplanet.com/threats/news-arista-velocloud-cve-2026-114625/
Critical Arista VeloCloud Vulnerability Under Active Exploitation
Arista has disclosed CVE-2026-114625, a critical SQL injection vulnerability (CVSS 9.9) affecting VeloCloud Orchestrator.
🔹 Request a product demo:
https://www.secpoint.com/contact-us.html
🔹 Become a SecPoint partner:
https://www.secpoint.com/partner-signup.html
🔹 Get a FREE vulnerability scan:
https://www.secpoint.com/free-vulnerability-scan.html
#SecPoint #Arista #VeloCloud #CyberSecurity #VulnerabilityManagement
Overview
- GitLab
- GitLab
Description
Statistics
- 2 Posts