This brief covers the trailing ~48 hours (October 28–30, 2026). Every item below was traced to a primary source — vendor advisory, CISA KEV entry, or the original research — and the dates were confirmed on those pages.

Cisco patches actively exploited ASA/FTD SSL VPN zero-day (CVE-2026-76418); CISA adds it to KEV

Cisco PSIRT · October 28, 2026

Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 for CVE-2026-76418 (CVSS 8.6, High), a denial-of-service flaw in the Remote Access SSL VPN service of Secure Firewall ASA and FTD software. An unauthenticated remote attacker can send a crafted request during an SSL VPN connection to force the device to reload; the bug is triggered only when SSL remote access VPN is enabled and secondary authentication is configured on a tunnel group (including DefaultWEBVPNGroup). Fixed releases span ASA 9.16.4.104 through 9.24.10.1 and FTD 7.0.11 through 10.1.1; there is no workaround, though disabling secondary authentication on affected tunnel groups is listed as a mitigation. CISA added the CVE to the Known Exploited Vulnerabilities catalog on October 29.

“In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” — Cisco Security Advisory

Source: Cisco advisory · CISA KEV alert (Oct 29) · The Hacker News

GitLab CVSS 10.0 RCE (CVE-2026-97229) lands in KEV after attacker targets Alpine Linux’s GitLab

CISA / Alpine Linux · October 29, 2026

CISA’s October 29 KEV update also added CVE-2026-97229 (CVSS 10.0, Critical), a GitLab CE/EE flaw in which insufficient regular-expression validation in CI/CD configuration lets an unauthenticated user execute arbitrary code on the server. GitLab patched it on October 13 in 19.4.2, 19.3.5 and 19.2.8; self-compiled installs must also move to Ruby 3.3.13, 3.4.12 or 4.0.9+, and Ruby 3.2 will not be fixed. Alpine Linux disclosed on October 28 that an attacker began probing gitlab.alpinelinux.org on October 20, crashing worker processes repeatedly, and that its October 22 upgrade to 19.3.6 did not close the hole because the image used standard Ruby. Alpine rebuilt the server, rotated all passwords and secret keys, and is treating the system as compromised even though it found no proof the exploit succeeded.

“A successful exploit would leave no crash and no trace in the web logs.” — Alpine Linux incident post

Source: GitLab patch release · Alpine Linux incident post · CISA KEV alert (Oct 29) · The Hacker News

CISA adds Fragnesia Linux kernel LPE (CVE-2026-46300) to KEV; Palo Alto confirms PHP2Shell exploitation against exposed PAN-OS management interfaces

CISA / Palo Alto Networks / Dream · October 28–29, 2026

CISA added CVE-2026-46300 “Fragnesia” (CVSS 7.8, High), a Linux kernel local privilege-escalation bug in the IPsec ESP modules disclosed in May 2026, to the KEV catalog on October 28 with an unusually short federal remediation deadline of October 31. CISA notes it is being chained with the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2, patched October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35) to drop PHP web shells and run commands as root. Palo Alto Networks updated its advisory on October 29 to confirm active exploitation against internet-exposed PAN-OS management interfaces, with fixes across the 10.2, 11.1, 11.2, 12.1 and 12.2 branches (some hotfixes still pending). Israeli firm Dream, whose findings Unit 42 independently verified, reported that a suspected China-nexus actor used a custom PHP2Shell exploit plus Fragnesia to root 25 systems across the US, Japan, Taiwan and South Korea, including firewalls tied to a US government-affiliated organization, then tunneled toward its Active Directory.

“Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet.” — Palo Alto Networks security advisory

Source: Palo Alto Networks advisory · CISA KEV alert (Oct 28) · Ubuntu on Fragnesia · Dream research · The Hacker News

CrowdStrike: China-nexus Warp Panda used low-severity VMware ESXi logging bypass (CVE-2026-41709) as a zero-day; CISA adds it to KEV

CrowdStrike / CISA · October 28, 2026

CrowdStrike’s 2026 Legal Threat Landscape Report, published October 28, disclosed that Warp Panda (also tracked as Clay Typhoon) exploited CVE-2026-41709 as a zero-day in intrusions against US law firms and other organizations as late as early 2026, using it to run ESXi operations without leaving audit-log entries. Broadcom scores the insufficient-logging flaw just 2.7 (Low) and fixed it in July 2026 under VMSA-2026-0006 (ESXi 8.0 U3j, ESXi 9.0.2.0100, ESXi 9.1.0.0, VCF 5.2.4). Despite the low score, CISA added it to the KEV catalog on October 28 with a November 11 federal due date — a reminder that an attacker who already holds admin access values anti-forensics bugs highly.

“the adversary exploited ESXi command logging bypass vulnerability CVE-2026-41709 as a zero-day” — CrowdStrike, 2026 Legal Threat Landscape Report

Source: Broadcom VMSA-2026-0006 · CrowdStrike report · CISA KEV alert (Oct 28) · SecurityWeek

Cisco Talos details KeyDrift, a key-stealing implant planted on SD-WAN controllers via CVE-2026-20127, tied to Volt Typhoon’s “Silent Train” network

Cisco Talos / Lumen Black Lotus Labs · October 28, 2026

Talos published an analysis of KeyDrift, a malware framework deployed by the APT it tracks as UAT-11473 after exploiting CVE-2026-20127 (CVSS 10.0), the Catalyst SD-WAN Controller/Manager/Validator authentication bypass Cisco patched earlier this year and that CISA covered under Emergency Directive 26-03. KeyDrift runs inside control-plane processes, hooks SSL_read to harvest keying material and session metadata, and stages the data encrypted for exfiltration; victims include satellite and space operators, military-aerospace firms and policy research organizations. Talos assesses with high confidence that the infrastructure overlaps with Volt Typhoon’s Silent Train covert access network, which Lumen’s Black Lotus Labs described the same day as a rotating chain of compromised SOHO, IoT and enterprise devices used in at least four zero-day exploitation campaigns. Cisco warns that upgrading does not remove implants already in place.

“Talos assesses with high confidence that the framework is designed to provide long-term persistent access.” — Cisco Talos

Source: Cisco Talos research · Cisco advisory (CVE-2026-20127) · Lumen Black Lotus Labs · The Hacker News

Binance suspends withdrawals after security incident; on-chain estimates of outflows run into the billions

Binance (via TechCrunch) · October 29, 2026

Binance confirmed a security incident on October 29 and temporarily suspended withdrawals on multiple networks after users reported funds draining from its hot wallets. The exchange has not confirmed a hack or a loss figure. Independent on-chain trackers put the outflows at a minimum of roughly $2 billion, with some estimates as high as $5.7–5.8 billion, which would make it the largest crypto theft on record (the 2025 Bybit hack was $1.4 billion). Tether reported freezing about $1.56 billion and Circle about $800 million of funds connected to the movement. The attacker is unidentified and the incident may still be developing.

Binance “temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure.” — Binance spokesperson Ross O’Leary, to TechCrunch

Source: TechCrunch · BleepingComputer

Still developing

Linux kernel MPTCP use-after-free (CVE-2026-98432, CVSS 9.8) — remote root exploit demonstrated, distro patches uneven

Anthropic / kernel.org · October 27, 2026

Anthropic disclosed CVE-2026-98432, a race-condition use-after-free in the Linux kernel’s multipath TCP handling that an unauthenticated remote attacker can use to leak kernel addresses and ultimately run commands as root on hosts with an MPTCP listener. The kernel CNA scores it 9.8; Red Hat, SUSE and Oracle rate it 8.1 and Amazon 7.0. The bug dates to Linux 4.4 and is fixed upstream in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. Oracle Linux, Debian and parts of SUSE and Amazon Linux have shipped fixes; several Ubuntu releases were still in progress and Red Hat had deferred as of October 29. No in-the-wild exploitation has been reported, exploit code has not been published, and the CVE is not in KEV.

“The underlying vulnerability is a race condition-induced UAF bug in the kernel networking stack.” — Anthropic

Source: Anthropic disclosure · CVE record · Ubuntu · Red Hat · The Hacker News

Sony’s So-net ISP discloses breach of ~2.58 million member records, including email passwords and some bank details

Sony Network Communications · October 27, 2026

Sony Network Communications reported that an outside party accessed the So-net membership database starting October 19; the intrusion was detected October 23 and the server was shut down. Exposed data covers 2,141,986 So-net and 443,495 plala (S Course) members — names, phone numbers, email addresses, user IDs, dates of birth, gender and connection IDs — plus 54,401 email-service passwords and 16 bank account records. Sony says membership passwords and credit card data were not involved.

Source: Sony Network Communications notice (PDF) · SecurityWeek

This brief covers the trailing ~48 hours (October 28–30, 2026).

Primary sources:

• Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 (CVE-2026-76418)
• CISA: Adds Two KEVs (Oct 29, 2026)
• CISA: Adds Two KEVs (Oct 28, 2026)
• CISA Known Exploited Vulnerabilities Catalog
• GitLab 19.4.2 patch release (CVE-2026-97229)
• Alpine Linux GitLab security incident
• Palo Alto Networks advisory (CVE-2026-109618 / CVE-2026-109619)
• Dream: Chained PHP2Shell exploit roots 25 servers
• Broadcom VMSA-2026-0006 (CVE-2026-41709)
• CrowdStrike 2026 Legal Threat Landscape Report
• Cisco Talos: Inside KeyDrift
• Lumen Black Lotus Labs: Silent Train
• TechCrunch: Binance pauses withdrawals
• Anthropic: CVE-2026-98432 disclosure
• Sony Network Communications breach notice

This brief covers the trailing ~48 hours (October 25–27, 2026). Every item below was traced to its primary source — the CISA alert, the vendor advisory, or the original research — and the disclosure date was confirmed on that page before inclusion.

CISA adds both PHP2Shell flaws to KEV as honeypots record the first confirmed shells

CISA · October 26, 2026

CISA added CVE-2026-109618 (PHP Memory Corruption) and CVE-2026-109619 (PHP Stale Internal Request-State) to the Known Exploited Vulnerabilities catalog on October 26 and updated its October 21 PHP alert to match; under BOD 26-04, federal civilian agencies now have to remediate on the accelerated KEV timeline. Both bugs are rated CVSS 9.2 (v4.0, Critical) by the PHP project and allow unauthenticated remote code execution against any PHP installation serving web requests (Apache mod_php is considered highest risk, but PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are all in scope). Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and earlier get no fix and should be taken offline until upgraded. The KEV addition follows honeypot evidence published October 24 by researcher Adel Karimi showing 35 Apache-parent shell spawns across three sensors — the first confirmed in-the-wild code execution, as opposed to the millions of failed probes vendors had been logging since the October 21 patches.

“These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.” — CISA, KEV catalog alert, October 26, 2026

Source: CISA KEV alert · CISA PHP alert (revised Oct 26) · PHP advisory (CVE-2026-109619) · Karimi honeypot report · SecurityWeek · BleepingComputer

Apple backports the exploited CoreGraphics zero-day fix to iOS 18 alongside iOS/macOS 27.2

Apple · October 26, 2026

Apple shipped iOS 18.7.11 and iPadOS 18.7.11 on October 26 to carry the fix for CVE-2026-86950, an out-of-bounds write in CoreGraphics discovered by Meta Product Security, to older hardware: iPhone XS, XS Max and XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later. Apple says the bug may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27; it was first patched in late September in iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Apple does not publish CVSS scores, and the CVE is not currently in CISA’s KEV catalog. The same day Apple released iOS/iPadOS 27.2, macOS 27.2, iOS/iPadOS 26.7.2, macOS 26.7.2 and 15.8.2, tvOS, watchOS, visionOS and Safari 27.2 — SecurityWeek counts 286 fixes across the two flagship 27.2 releases — with no additional flaws flagged as exploited.

“Processing a maliciously crafted file may lead to arbitrary code execution.” — Apple, security content of iOS 18.7.11 and iPadOS 18.7.11

Source: Apple security content — iOS 18.7.11 · Apple security content — iOS 27.2 · SecurityWeek · BleepingComputer

Microsoft ships out-of-band .NET fixes and Palo Alto confirms PAN-OS exposure to the Brotli “HTTP2Shell” bug

Microsoft · October 25, 2026 — Palo Alto Networks · October 26, 2026

The Brotli decoder out-of-bounds write CVE-2026-111497 (variously branded Broccoli2Shell, Node2Shell and HTTP2Shell; Google Brotli 1.0.3 through 1.2.0) kept rippling through downstream vendors. Microsoft published out-of-band .NET updates — .NET 8.0.33, 9.0.22, 10.0.14 and 11 RC3 — for applications that process Brotli-compressed data via ASP.NET Core request decompression, HttpClient automatic decompression or the System.IO.Compression Brotli APIs; .NET Framework is not affected and Brotli decompression is off by default in a stock install. Palo Alto Networks then published its own advisory rating the issue CVSS 9.2 (v4.0, Critical) for PAN-OS 12.2, 12.1 and 11.2 firewalls that have Brotli inspection enabled together with SSL decryption, plus the Prisma Cloud Application Security Transporter Client before 0.2.9; hotfixes are staged through the end of the week and disabling Brotli inspection is the interim workaround. Proof-of-concept exploits are public, but neither Microsoft nor Palo Alto reports malicious exploitation, and the CVE is not in KEV. Upstream fixes are Brotli 1.0.10/1.1.1/1.2.1 and Node.js 22.23.4/24.22.1/26.12.1; applications that bundle their own Brotli copy need their own update and a restart.

“A buffer overflow vulnerability exists in .NET’s use of the Brotli decompression algorithm.” — Microsoft .NET Blog, October 2026 out-of-band security updates

Source: Microsoft .NET OOB advisory · MSRC CVE-2026-111497 · Palo Alto Networks advisory · Node.js advisory · BleepingComputer

Still developing

ENGIE confirms customer data theft via a partner marketing platform

ENGIE (via BleepingComputer) · October 27, 2026

French energy group ENGIE confirmed that attackers accessed customer data through a prospecting and marketing tool used by its business partners; the company says its internal IT systems were not breached, that access has been cut, and that authorities and affected customers in France have been notified. Breach letters reviewed by BleepingComputer list names, postal and email addresses, phone numbers, PDL/PCE meter-point identifiers, customer IDs and contract numbers; ENGIE says no banking data was involved. No group has claimed the intrusion and ENGIE has not said how many customers are affected.

“ENGIE’s internal IT systems were not compromised.” — ENGIE spokesperson, to BleepingComputer

Source: BleepingComputer

University of Copenhagen breach grows to roughly 525,000 people

University of Copenhagen (via BleepingComputer) · October 26, 2026

The University of Copenhagen says intruders reached one of its test environments, exposing names, Danish CPR national identity numbers, phone numbers and email addresses for about 525,000 people, with an update adding some 20,000 staff and students whose physical-access PIN codes were also taken. The university detected the intrusion on October 20, disclosed it October 23, reports no impact on operational systems, and has temporarily restricted physical access to some campus locations while it issues new codes.

Source: BleepingComputer

Collabora Online and Arista VeloCloud Orchestrator flaws under active exploitation

CISA · October 23, 2026

CISA added CVE-2026-110447 (CVSS 9.2, OS command injection in the Collabora Online built-in CODE server used with Nextcloud, fixed in 26.4.303) and CVE-2026-114625 (CVSS 9.9, SQL injection in on-premise Arista VeloCloud Orchestrator, fixed in 5.2.3.18, 6.1.3.10 and 6.4.2.12) to KEV on October 23 with a federal due date of October 26. Attackers have been backdooring Nextcloud servers with web shells and hunting for credential stores and crypto wallets, and Arista acknowledges the VCO bug is known to be actively exploited — the third VCO flaw exploited in the wild since July.

Source: CISA KEV alert (Collabora) · CISA KEV alert (Arista) · The Hacker News

This brief covers the trailing ~48 hours (October 25–27, 2026).

Primary sources:

• CISA — Adds Two Known Exploited Vulnerabilities to Catalog (Oct 26, 2026)
• CISA — Critical Vulnerabilities in PHP Require Immediate Patching (revised Oct 26, 2026)
• PHP — Security advisory for CVE-2026-109619
• Adel Karimi — PHP2Shell confirmed RCE honeypot report (Oct 24, 2026)
• Apple — About the security content of iOS 18.7.11 and iPadOS 18.7.11
• Apple — About the security content of iOS 27.2 and iPadOS 27.2
• Microsoft — .NET October 2026 out-of-band security updates
• Microsoft MSRC — CVE-2026-111497
• Palo Alto Networks — CVE-2026-111497 advisory
• Node.js — October 2026 security releases
• CISA — Adds One Known Exploited Vulnerability to Catalog (Collabora, Oct 23, 2026)
• CISA — Adds One Known Exploited Vulnerability to Catalog (Arista, Oct 23, 2026)

This brief covers the trailing ~48 hours (October 23–25, 2026). Every item below was checked against its primary source — the CISA KEV catalog (via NVD’s KEV fields), CVE.org/NVD records, and vendor or project advisories — and only developments dated inside the window are included in the main section.

CISA KEV: Arista VeloCloud Orchestrator SQL injection (CVE-2026-114625) actively exploited, federal deadline October 26

CISA / Arista · October 23, 2026

CISA added CVE-2026-114625 to the Known Exploited Vulnerabilities catalog on October 23 with a three-day remediation deadline of October 26. The flaw is a SQL injection (CWE-89) in on-premises Arista VeloCloud Orchestrator (VCO) rated CVSS 3.1 9.9 / CVSS 4.0 9.4; an attacker with network access to the VCO web interface and any authenticated session (Enterprise Read Only is sufficient) can reach internal-only functionality and masquerade as a local “superuser operator.” Affected trains are VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, and 6.4.x before 6.4.2.12; fixed releases are available and Arista’s hosted and dedicated VCO instances were patched earlier. Arista’s advisory (SA-0199, published October 22) says the issue was detected internally and is under active exploitation, and publishes two attacker IPs, 74.82.197[.]86 and 38.54.50[.]151. This is the third VCO flaw to reach KEV since July 2026.

“This issue was detected by Arista and is known to be actively exploited.” — Arista Networks Security Advisory 0199

Source: Arista Security Advisory 0199 · NVD CVE-2026-114625 · CISA alert · The Hacker News

CISA KEV: Collabora Online Built-in CODE Server command injection (CVE-2026-110447) used to backdoor Nextcloud servers

CISA / CVE.org · October 23, 2026

Also added to KEV on October 23 (due October 26) is CVE-2026-110447, a CVSS 4.0 9.2 OS command injection (CWE-78) in the Collabora Online Built-in CODE Server Nextcloud app (richdocumentscode) before 26.4.303. The bug lives in proxy.php and is reachable by unauthenticated attackers when the bundled CODE server is not running, for example right after a restart; standalone Collabora Online deployments are not affected. The CVE record states the flaw was exploited in the wild in September and October 2026 and is distinct from the earlier CVE-2025-66208. Reported intrusions have planted web shells on Nextcloud hosts and gone after credential stores, password-manager artifacts and cryptocurrency wallets. The fix (26.4.303) shipped in September; administrators who cannot update should remove the app.

“Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026.” — CVE-2026-110447 record (MITRE)

Source: CVE.org CVE-2026-110447 · NVD · CISA alert · Security Affairs

PHP flags a third RCE vector (CVE-2026-115560) with no patch as PHP2Shell exploitation attempts reach the millions

PHP Project · October 23, 2026

Two days after shipping emergency fixes for the “PHP2Shell” pair (CVE-2026-109618 and CVE-2026-109619, both CVSS 4.0 9.2 per PHP, with NVD scoring CVE-2026-109618 at 9.8 under CVSS 3.1; fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35), the PHP project published an informational advisory for CVE-2026-115560, an additional, unpatched remote code execution vector it rates unlikely. It is reachable only when an application configures session.serialize_handler as php_binary or php_serialize, switches it to php at runtime via ini_set() before session_start(), and leaves session upload progress enabled. The fix will arrive in the next regular bugfix release; the mitigation is session.upload_progress.enabled=0, which was already recommended on October 21. Meanwhile exploitation of the original pair is widespread: Cloudflare reported millions of attempts within a day of disclosure, Cisco Talos and others see mostly scanning plus uncoordinated payload delivery including a Mirai-derived botnet, and Amazon Threat Intelligence says its honeypots first observed exploitation on October 17, four days before the patches. Neither PHP2Shell CVE carried CISA KEV fields in NVD as of October 24.

“We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector.” — PHP project, informational advisory

Source: PHP announcement (Oct 23) · PHP security advisory (Oct 21) · NVD CVE-2026-109618 · The Hacker News · BleepingComputer

LiteLLM traces its poisoned 1.107.0 release to a master key leaked in May and never revoked

LiteLLM · October 23, 2026

LiteLLM published the root-cause analysis of the October 21 supply-chain compromise that pushed a malicious litellm==1.107.0 to PyPI and poisoned Docker Hub and GHCR images (tags v1.107.0, latest, main-latest, main-stable) for roughly two hours before PyPI quarantined the release. The chain started on May 27, 2026, when a configuration file holding an internal Agent Platform master key was committed to a public repository and force-pushed over without the key being revoked. On October 10 the attacker used it to extract a GitHub CLI OAuth token tied to an organization owner, ran malicious workflows to harvest maintainer secrets, then on October 21 overrode branch protection and pointed the release pipeline at a lookalike “Berri-AI/litellm” repository. The payload executes on Python startup even if LiteLLM is never imported, exfiltrates credentials to litellm[.]dev, and installs an hourly backdoor on Unix hosts. LiteLLM is rotating every token tied to its internal and vendor systems; users who ran the affected artifacts should rebuild hosts rather than only remove the package, and rotate any credentials present.

“However, key revocation did not occur for the master key.” — Oliver Jensen and Mateo Wang, LiteLLM

Source: LiteLLM: The attack chain behind the v1.107.0 release · LiteLLM incident post · The Hacker News · BleepingComputer

Ruby 4.0.9, 3.4.12 and 3.3.13 fix the Onigmo regex bugs behind four critical GitLab RCEs, including CVSS 10.0 CVE-2026-110264

Ruby Project · October 23, 2026

The Ruby core team released 4.0.9, 3.4.12 and 3.3.13 to fix three regular-expression compilation bugs in the Onigmo engine that underlie GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. The newest, CVE-2026-110264 (CVSS 3.1 10.0, CWE-190 integer overflow), lets an unauthenticated attacker execute arbitrary code on a GitLab server via a crafted regular expression and affects every GitLab CE/EE release from 7.0 up to the October 21 patch releases (18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, 19.5.1). Ruby has not requested its own CVE IDs and notes that the exposure is not GitLab-specific: any application that compiles a regex from attacker-controlled text is affected, and Regexp.timeout offers no protection. Ruby 3.2 and earlier are end-of-life and will not be fixed. None of the four GitLab CVEs is in CISA KEV; GitLab has published detection rules for self-managed administrators.

“Regexp.timeout does not protect against these bugs.” — Ruby project announcement

Source: Ruby: Regexp compilation fixes · CVE.org CVE-2026-110264 · GitLab 19.5.1 patch release · The Hacker News

Brotli decoder overflow (CVE-2026-111497) behind the Node.js “Node2Shell” RCE spreads to Bun, Python, Envoy and Istio

Google / Node.js / NVD · October 24, 2026

The CVSS 4.0 9.2 out-of-bounds write in Google’s Brotli decoder (versions 1.0.3 through 1.2.0; fixed in 1.0.10, 1.1.1 and 1.2.1) that Node.js patched on October 21 (22.23.4, 24.22.1, 26.12.1) is now confirmed to reach far beyond Node. Downstream advisories published inside the window cover Bun (fixed in 1.4.4), the Python Brotli and brotlicffi packages (PYSEC-2026-4322/4323, fixed in 1.2.1 and 1.2.1.0), Envoy and Istio when Brotli decompression is enabled, Debian 13 (brotli 1.1.0-2+deb13u1) and the oss-security list. Imperva’s Red Team has demonstrated code execution against an unmodified Node.js 24.22.0 Linux arm64 build via both the request-body path (Express 5 / body-parser 2) and fetch() of a br response, though it has not released exploit code and the result is build-specific. NVD’s CISA SSVC assessment still records exploitation as “none” and the CVE is not in KEV. Where updating is not yet possible, reject Content-Encoding: br at the edge and disable automatic Brotli decoding in HTTP clients; in Python, uninstalling the packages removes the exposure.

“Imperva Red Team demonstrated remote code execution against the official vulnerable Node.js build.” — Ron Masas, Imperva

Source: Node.js October 2026 security releases · NVD CVE-2026-111497 · Google Brotli releases · Imperva: Node2Shell · The Hacker News

Still developing

HPE patches eight CVSS 10.0 unauthenticated RCE and auth-bypass flaws in Aruba AOS-8 and AOS-10

HPE · October 22, 2026

HPE’s advisory HPESBNW05162 fixes 72 ArubaOS vulnerabilities across mobility conductors, controllers, gateways and access points, eight of them rated CVSS 3.1 10.0: CVE-2026-79844, -79845, -79847 and -79851 (authentication bypass and unauthenticated buffer overflows leading to RCE in AOS-10, including the PAPI protocol) and CVE-2026-79846, -79848, -79849 and -79850 (unauthenticated command injection, SQL injection and auth bypass in AOS-8). CVE-2026-79844 affects AOS-10 10.8.0.0–10.8.1.1, 10.7.0.0–10.7.2.6 and 10.4.0.0–10.4.1.13. HPE says it is not aware of public exploit code or in-the-wild exploitation; none of the CVEs is in KEV. Interim guidance is to confine CLI and web management interfaces to a dedicated management VLAN behind layer-3 firewall policy.

“HPE Networking is not aware of any public discussion or exploit code that targets the listed vulnerabilities.” — HPE, as quoted by BleepingComputer

Source: HPE Security Bulletin HPESBNW05162 · CVE.org CVE-2026-79844 · BleepingComputer

Quest Diagnostics reports unauthorized access to Quanum LSM with patient records believed accessed

Quest Diagnostics (SEC Form 8-K) · October 22, 2026

Quest Diagnostics filed an 8-K (Item 8.01) disclosing that on October 21 it learned of unauthorized access to Quanum LSM, the platform clients use to order tests and view results, and that it believes an unauthorized party accessed certain patient records. Quest took the system offline and temporarily paused Essential Insights and LabHQ, directing customers to paper requisitions or Quanum eLabs. The scope and data types remain under investigation, no count of affected individuals has been given, and no threat group has claimed the intrusion. Quest says business operations and its ability to serve patients were not materially disrupted.

“…the Company believes that an unauthorized party accessed certain patient records.” — Quest Diagnostics, Form 8-K

Source: Quest Diagnostics Form 8-K · BleepingComputer

Kaspersky: APT41 “BlackX” UEFI bootkit revives BlackLotus to bypass Secure Boot on Windows hosts missing DBX revocations

Kaspersky GReAT · October 22, 2026

Kaspersky researchers Georgy Kucherin, Vladimir Nestor and Vasily Berdnikov describe BlackX, a UEFI bootkit used against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan in early 2026 and attributed with medium confidence to China-linked APT41. BlackX exploits the long-patched CVE-2022-21894 (“Baton Drop”, CVSS 4.4) to run before the OS on systems where administrators have not applied Microsoft’s manual Secure Boot revocations, installs Machine Owner Keys, loads a kernel driver signed with a since-revoked certificate to tamper with endpoint security, and deploys a RAT that uses Google Drive, OneDrive and Yandex.Disk for command and control. Kaspersky notes that the “Windows Production PCA 2011” certificate expired on October 19, 2026, yet still loads vulnerable binaries unless it is added to the DBX blocklist.

“Having examined it, we found it to be similar to BlackLotus.” — Kaspersky GReAT

Source: Kaspersky Securelist: BlackX · The Hacker News · BleepingComputer

This brief covers the trailing ~48 hours (October 23–25, 2026).

Primary sources: CISA KEV catalog · Arista SA-0199 · NVD CVE-2026-114625 · CVE-2026-110447 · PHP announcements · NVD CVE-2026-109618 · LiteLLM root-cause post · Ruby regexp fixes · CVE-2026-110264 · Node.js security releases · NVD CVE-2026-111497 · Imperva Node2Shell · HPE HPESBNW05162 · Quest Diagnostics 8-K · Kaspersky Securelist

This is a special follow-up to this morning’s brief, which went out while PHP’s emergency release was still pending. The patches shipped at 14:00 UTC on October 21, the GitHub advisories are now public, and the picture has moved quickly: exploitation attempts were being reported before the fix was even available. Everything below is drawn from the PHP project’s own advisory, the two GHSA entries, and the researchers who were first to confirm the bugs.

The short version

Two critical bugs in the PHP interpreter itself, not in any framework or application, allow unauthenticated remote code execution against essentially any PHP installation serving web requests. Both are rated CVSS v4.0 9.2 by PHP. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. There are no complete mitigations short of updating. Cloudflare reported early attack traffic at 07:43 UTC on October 21, roughly six hours before the patch, and watchTowr says it has observed in-the-wild exploitation attempts against both CVEs. If you run PHP anywhere that accepts HTTP requests, treat this as a patch-today event.

“Put simply: if you have not applied the patch, your deployment of PHP is vulnerable.” — watchTowr

How we got here: the timeline

October 20. A post on Hacker News claimed two critical PHP RCE flaws would be disclosed on October 22, ahead of any patch. The post was removed, but screenshots spread, along with screenshots of an exploit tool styled “PHP2Shell” that claimed to work against PHP 5.4.0 and later. watchTowr publicly confirmed the leaked details were real and under embargo. That evening the PHP security team published an advance notice of an out-of-cycle release for October 21 at 14:00 UTC, pulling disclosure forward by a day.

October 21, 07:43 UTC. Cloudflare CTO Dane Knecht said the company was seeing early attacks and updating mitigations as new vectors appeared.

October 21, ~14:00 UTC. PHP published its advisory and the four fixed releases, plus minimal source backports for the end-of-life 7.4, 8.0 and 8.1 branches. The UK NCSC issued an alert, and CISA published an alert titled “Critical Vulnerabilities in PHP Require Immediate Patching.”

October 21, 14:19 UTC. watchTowr published its technical write-up and reported exploitation attempts in the wild.

The two bugs

CVE-2026-109618, “RCE via OOM corruption” (GHSA-w8hw-w9fx-j79w). PHP handled out-of-memory conditions by calling longjmp() to abort the request. In some code paths, request memory is reachable before initialization has finished; an allocation failure at that moment leaves partially initialized data behind, and request shutdown then reads or branches on it. The failed allocation does not have to be related to the memory that ends up corrupted. The advisory’s primary trigger is multipart parsing: a request without a usable Content-Length can pass the initial post_max_size check, and a single part can carry an unbounded number of headers whose in-memory representation is far larger than the wire form. Empty file controls do not count toward max_file_uploads but still allocate metadata, and nested field names multiply the work. Full RCE over HTTP was demonstrated against Apache mod_php with default limits. PHP-FPM is assessed as susceptible from source analysis, though no complete exploit was demonstrated; FrankenPHP and LSAPI are considered likely susceptible but not validated. The fix removes the longjmp() OOM path entirely: a soft OOM is now raised at the next VM safe point, and a hard OOM calls _exit() past a higher threshold.

CVE-2026-109619, “RCE via stale global state” (GHSA-6wmf-4rv5-p3rp). In persistent worker models, PHP’s global state (error, session, object and extension state) can retain pointers into memory owned by a previous request. That state is supposed to be cleared before the request heap is freed, but a fatal error such as OOM or “Maximum execution time exceeded” can abort an operation before its reset runs, and nonfatal diagnostics emitted late in shutdown can repopulate error state after it was cleared. The next request on the same worker can then read, free or branch on a dangling pointer before normal initialization replaces it. Three confirmed consumers are described: INI diagnostics raised while applying per-request settings (reachable via .htaccess and php_value directives on mod_php, and conditionally on FPM if the frontend passes PHP_VALUE/PHP_ADMIN_VALUE); session upload progress handling, which runs before ordinary session initialization, is enabled by default and does not require session_start(); and, on PHP 8.5 only, the new fatal_error_backtraces feature, which is the confirmed RCE path on mod_php. Exploitation requires a producer request and a consumer request to land on the same worker plus a cooperative heap layout, which is why both CVEs carry AC:H and AT:P in their vectors.

Both advisories share the vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H and credit the same reporters: lcfr-hax, sagitzadik-wiz (Wiz), tomash-areion and amyb-oai. The remediation was developed by arnaud-lb, iluuu1994, bukka and ndossche.

“Updating to a PHP release containing the patch to this vulnerability is the only complete mitigation.” — php/php-src advisory GHSA-w8hw-w9fx-j79w

Who is affected

PHP’s advisory is blunt: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The project considers mod_php the highest-risk configuration because there is a demonstrated exploit where an unauthenticated request triggers the bug before any application code runs. Every version from PHP 5 onward is believed to be affected; only 8.2 through 8.5 receive official fixed releases. PHP 8.2 itself reaches end of life on December 31, 2026. For scale, Silas Cutler estimates over 1.3 million internet-exposed hosts are potentially vulnerable, a Shodan query by Henk Poley counts over 1.9 million hosts advertising PHP, and Mallory counted roughly 884,000 hosts whose banners show PHP 8.1 or older. These are banner counts, not confirmed vulnerable systems, but they illustrate the exposure.

“The PHP situation will lead to a mass of incidents – it’s one of the biggest vulns in years.” — Kevin Beaumont, via Help Net Security

Exploitation status

Before the patch, watchTowr and Huntress both said they had not seen exploitation. That changed on the morning of October 21: Cloudflare reported early attacks at 07:43 UTC, and SecurityWeek’s updated story notes firms observed exploitation attempts, some before the fixes landed. watchTowr’s post-patch write-up lists CVE-2026-109619 as exploited in the wild. Sansec, which tracks e-commerce attacks, said it expects mass exploitation now that both the patch and the write-ups are public, and noted that the circulating PHP2Shell tool combines both CVEs into a single unauthenticated attack. As of the reports I could verify, neither CVE had yet appeared in CISA’s KEV catalog, though CISA did publish a standalone alert; I was unable to load the alert page itself to confirm its contents.

“We expect mass exploitation now that the patch and the writeups are public.” — Sansec

Patches and where to get them

Upstream: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with source and Windows binaries on php.net. Linux distributions and LTS vendors received the patches in advance. Ubuntu has fixes for every supported release (php8.5 for 26.10 and 26.04, php8.3 8.3.6-0ubuntu0.24.04.13 for 24.04, php8.1 8.1.2-1ubuntu2.28 for 22.04) and ESM builds for 20.04 back to 14.04. AlmaLinux had patched packages in testing on October 21. The PHP team specifically warned that the volunteer-maintained rpms.remirepo.net would not have updates on release day and urged those users to switch to distribution packages or build from source. For anyone stuck on 7.4, 8.0 or 8.1 without a vendor, PHP published minimal source-only backport branches on GitHub (PHP-7.4-CVE-2026-109618-109619 and siblings). After updating, restart every worker; a patched binary on disk does nothing for a worker that is still running the old code.

If you cannot patch in the next hour

PHP’s advisory is explicit that the measures below reduce exposure to specific paths but do not make an installation safe. PHP 8.6 release manager Joe Ferguson put it more bluntly: “ini settings won’t save you.”

For CVE-2026-109618, set memory_limit=-1 in a way applications cannot override (for example php_admin_value in the FPM pool or Apache config) and confirm nothing re-imposes a finite limit. This removes the controllable memory-limit failure but not an underlying allocation failure. Set a low post_max_size (8M where uploads are not needed, 32M otherwise) and keep upload_max_filesize below it. Enforce limits at the web server or proxy for decoded request size, field count, multipart part count, header count and nesting depth, and make sure those limits apply to requests with no usable Content-Length. Use a container or cgroup limit as the availability boundary, and do not substitute RLIMIT_AS or RLIMIT_DATA, which themselves trigger the vulnerable path.

For CVE-2026-109619, set session.upload_progress.enabled=0 in php.ini or pool configuration (not via ini_set() or .user.ini) and restart every worker. On PHP 8.5, also set fatal_error_backtraces=0. Remove invalid or deprecated per-request INI settings that emit diagnostics before initialization; suppressing them with error_reporting, display_errors or @ does not help. Consider pm.max_requests=1 on FPM. Fix attacker-reachable fatal errors and execution timeouts.

Sansec adds two blunter options for sites that cannot patch at all right now: block multipart/form-data at the web server (breaks uploads and some checkout flows), or reject every method except GET and HEAD until the update lands. Cloudflare has WAF rules for the known vectors available on all plans including free, but both Cloudflare and Sansec stress that this only covers traffic that actually routes through the proxy, and that the attack executes inside PHP before any application-layer rule can see it.

What to do now

Inventory every host running PHP, including the ones nobody remembers: internal dashboards, admin panels, bundled appliances, Docker images built months ago. Update to a fixed release and restart workers; do not stop at the package upgrade. If you are on mod_php, move to the front of the queue. If you are on 8.1 or older, get a vendor backport, apply the PHP source backport, or take the system offline, which is what the NCSC has recommended for anything that cannot be fixed immediately. Then look backward: with attack traffic observed before 08:00 UTC on the 21st, any exposed PHP host that was unpatched through the day should be reviewed for signs of compromise, starting with unexpected processes spawned by the web server user, new files in writable directories, and outbound connections from the web tier.

This follow-up reflects primary sources available as of the evening of October 21, 2026 (UTC).

Primary sources:

• PHP.net security advisory: Critical remote code execution vulnerabilities, update now
• GHSA-w8hw-w9fx-j79w (CVE-2026-109618, RCE via OOM corruption)
• GHSA-6wmf-4rv5-p3rp (CVE-2026-109619, RCE via stale global state)
• PHP.net advance notice, October 20
• watchTowr: PHP Remote Code Execution (“PHP2Shell”)
• Sansec: PHP2Shell
• Ubuntu: php2shell fixes available
• AlmaLinux: patched packages in testing
• CISA alert: Critical Vulnerabilities in PHP Require Immediate Patching
• SecurityWeek · Tenable FAQ · Check Point · Help Net Security