CISA flags two actively exploited PHP flaws as Brotli patches cascade across vendors

CISA added two PHP vulnerabilities to its Known Exploited Vulnerabilities catalog on 26 October, both known to be exploited. CISA's alert lists CVE-2026-109618, a PHP memory corruption vulnerability carrying CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 9.8, and CVE-2026-109619, a PHP stale internal request-state vulnerability carrying CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 8.1. CISA says these vulnerability types are a frequent attack vector and directs remediation under Binding Operational Directive 26-04. Follow the PHP Group advisories for the fixed release and interim mitigation: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w and https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp. Match your estate against what CISA lists.

Separately, a flaw in the Brotli compression library drove emergency patching across multiple projects. BleepingComputer reported a critical flaw dubbed "HTTP2Shell" in the Brotli C decoder library built into Node.js that could let attackers corrupt memory and access sensitive data. The Hacker News reported PHP rebuilt its official Windows packages for PHP 8.2 through 8.5 — its second Windows update in five days — to fix a Brotli flaw reachable through the cURL extension. The Register reported Microsoft released emergency .NET security fixes for the same Google Brotli bug.

SecurityWeek reported Siemens, Schneider Electric and ABB confirmed some of their products are affected by the "PHP2Shell" vulnerabilities.

Google's advisory covers four browser flaws fixed in Chrome 156.0.8078.47: CVE-2026-113342, CVE-2026-113336, CVE-2026-113328 and CVE-2026-113300, each carrying CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H and a base score of 9.6. The fixed release is at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html.

On breaches and campaigns: BleepingComputer reported the University of Copenhagen confirmed hackers accessed a test environment holding personal data on 525,000 people. The Hacker News reported Dutch firm Sansec found an unknown threat actor infected 953 online stores, mostly running Magento, with scanner-evading JavaScript in a campaign active since July 2025. BleepingComputer reported DreamHost forced password resets for email and FTP/SFTP users after an incident disrupting its File Manager. The Register reported the LiteLLM supply chain attack began with an exposed master key that was not rotated.

In arrests and research: BleepingComputer reported South Korean police identified seven suspects who breached more than 90 organisations and stole 8.2 million records using the ARTEX AI pentesting framework in most attacks. The Record reported Dutch police extradited 44-year-old Zheng Zhao, accused of laundering Cambodian investment-scam funds. The Register reported a worm armed 42 GitHub repositories by hiding payload blobs of 12.9 to 13.7 MB, large enough to evade GitHub code search. Help Net Security reported an O'Reilly survey of 209 security professionals found employees pasting company data into AI tools worries teams more than AI-powered attacks.