ITSECURITY.GURU WHAT HAPPENED · DOES IT AFFECT YOU · WHAT TO DO
Search Contact
Menu
Search Contact
Board › Newsletters › Past editions › ITsecurity Daily — Monday, 26 October 2026: CISA flags two actively exploited PHP flaws as Brotli patches cascade across vendors

ITSECURITY.GURU

ITsecurity Daily

Daily Briefing

CISA flags two actively exploited PHP flaws as Brotli patches cascade across vendors

By The IT Security Desk

Good morning. CISA added two PHP vulnerabilities to its Known Exploited Vulnerabilities catalog on 26 October, both known to be exploited. CISA's alert lists CVE-2026-109618, a PHP memory corruption vulnerability carrying CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 9.8, and CVE-2026-109619, a PHP stale internal request-state vulnerability carrying CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 8.1. CISA says these vulnerability types are a frequent attack vector and directs remediation under Binding Operational Directive 26-04. Follow the PHP Group advisories for the fixed release and interim mitigation: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w and https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp. Match your estate against what CISA lists.

Separately, a flaw in the Brotli compression library drove emergency patching across multiple projects. BleepingComputer reported a critical flaw dubbed "HTTP2Shell" in the Brotli C decoder library built into Node.js that could let attackers corrupt memory and access sensitive data. The Hacker News reported PHP rebuilt its official Windows packages for PHP 8.2 through 8.5 — its second Windows update in five days — to fix a Brotli flaw reachable through the cURL extension. The Register reported Microsoft released emergency .NET security fixes for the same Google Brotli bug.

SecurityWeek reported Siemens, Schneider Electric and ABB confirmed some of their products are affected by the "PHP2Shell" vulnerabilities.

Read the full briefing →

Zoom out: A flaw in the Brotli compression library pulled in maintainer after maintainer on the same day, per The Register, The Hacker News and BleepingComputer.

Vulnerability in focus

CVE-2026-109619 — PHP Group. CVSS 8.1 CISA lists it as known to be exploited.

Affected: panos.

What to do: Follow the vendor advisory for the fixed release and any interim mitigation.

Elsewhere

  • The Hacker News: Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses Read it
  • Help Net Security: Several AI security market categories are headed for bigger platforms Read it
  • Help Net Security: Microsoft Authenticator vulnerability let rogue Android apps steal work account access Read it
  • Help Net Security: LLM agent security needs more than guardrails Read it
  • The Hacker News: CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution Read it
  • Help Net Security: 71% of vulnerability exploitation starts within a week of disclosure Read it
  • Help Net Security: Cybersecurity jobs available right now: October 27, 2026 Read it
  • Help Net Security: GPT-6.1 Terra meets OpenAI’s Critical cyber threshold, and it’s cheaper than GPT-5.6 Terra Read it
  • SecurityWeek: Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics Read it
  • The Register: Japanese virtual desktop cloud hacked so hard it asks to be banned Read it
  • CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog Read it
  • The Register: Worm armed 42 GitHub repos by hiding a payload too big to fail Read it

Sources

Every briefing is on the site, with the advisory record behind it. All briefings

itsecurity.guruPast editions

You are receiving this because you subscribed at itsecurity.guru.

Headlines from other outlets belong to them; each one credits its outlet and leads to their own report.

All past editions · Get them by email