This brief covers the trailing ~48 hours (October 25–27, 2026). Every item below was traced to its primary source — the CISA alert, the vendor advisory, or the original research — and the disclosure date was confirmed on that page before inclusion.
CISA adds both PHP2Shell flaws to KEV as honeypots record the first confirmed shells
CISA · October 26, 2026
CISA added CVE-2026-109618 (PHP Memory Corruption) and CVE-2026-109619 (PHP Stale Internal Request-State) to the Known Exploited Vulnerabilities catalog on October 26 and updated its October 21 PHP alert to match; under BOD 26-04, federal civilian agencies now have to remediate on the accelerated KEV timeline. Both bugs are rated CVSS 9.2 (v4.0, Critical) by the PHP project and allow unauthenticated remote code execution against any PHP installation serving web requests (Apache mod_php is considered highest risk, but PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are all in scope). Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and earlier get no fix and should be taken offline until upgraded. The KEV addition follows honeypot evidence published October 24 by researcher Adel Karimi showing 35 Apache-parent shell spawns across three sensors — the first confirmed in-the-wild code execution, as opposed to the millions of failed probes vendors had been logging since the October 21 patches.
“These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.” — CISA, KEV catalog alert, October 26, 2026
Source: CISA KEV alert · CISA PHP alert (revised Oct 26) · PHP advisory (CVE-2026-109619) · Karimi honeypot report · SecurityWeek · BleepingComputer
Apple backports the exploited CoreGraphics zero-day fix to iOS 18 alongside iOS/macOS 27.2
Apple · October 26, 2026
Apple shipped iOS 18.7.11 and iPadOS 18.7.11 on October 26 to carry the fix for CVE-2026-86950, an out-of-bounds write in CoreGraphics discovered by Meta Product Security, to older hardware: iPhone XS, XS Max and XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later. Apple says the bug may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27; it was first patched in late September in iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Apple does not publish CVSS scores, and the CVE is not currently in CISA’s KEV catalog. The same day Apple released iOS/iPadOS 27.2, macOS 27.2, iOS/iPadOS 26.7.2, macOS 26.7.2 and 15.8.2, tvOS, watchOS, visionOS and Safari 27.2 — SecurityWeek counts 286 fixes across the two flagship 27.2 releases — with no additional flaws flagged as exploited.
“Processing a maliciously crafted file may lead to arbitrary code execution.” — Apple, security content of iOS 18.7.11 and iPadOS 18.7.11
Source: Apple security content — iOS 18.7.11 · Apple security content — iOS 27.2 · SecurityWeek · BleepingComputer
Microsoft ships out-of-band .NET fixes and Palo Alto confirms PAN-OS exposure to the Brotli “HTTP2Shell” bug
Microsoft · October 25, 2026 — Palo Alto Networks · October 26, 2026
The Brotli decoder out-of-bounds write CVE-2026-111497 (variously branded Broccoli2Shell, Node2Shell and HTTP2Shell; Google Brotli 1.0.3 through 1.2.0) kept rippling through downstream vendors. Microsoft published out-of-band .NET updates — .NET 8.0.33, 9.0.22, 10.0.14 and 11 RC3 — for applications that process Brotli-compressed data via ASP.NET Core request decompression, HttpClient automatic decompression or the System.IO.Compression Brotli APIs; .NET Framework is not affected and Brotli decompression is off by default in a stock install. Palo Alto Networks then published its own advisory rating the issue CVSS 9.2 (v4.0, Critical) for PAN-OS 12.2, 12.1 and 11.2 firewalls that have Brotli inspection enabled together with SSL decryption, plus the Prisma Cloud Application Security Transporter Client before 0.2.9; hotfixes are staged through the end of the week and disabling Brotli inspection is the interim workaround. Proof-of-concept exploits are public, but neither Microsoft nor Palo Alto reports malicious exploitation, and the CVE is not in KEV. Upstream fixes are Brotli 1.0.10/1.1.1/1.2.1 and Node.js 22.23.4/24.22.1/26.12.1; applications that bundle their own Brotli copy need their own update and a restart.
“A buffer overflow vulnerability exists in .NET’s use of the Brotli decompression algorithm.” — Microsoft .NET Blog, October 2026 out-of-band security updates
Source: Microsoft .NET OOB advisory · MSRC CVE-2026-111497 · Palo Alto Networks advisory · Node.js advisory · BleepingComputer
Still developing
ENGIE confirms customer data theft via a partner marketing platform
ENGIE (via BleepingComputer) · October 27, 2026
French energy group ENGIE confirmed that attackers accessed customer data through a prospecting and marketing tool used by its business partners; the company says its internal IT systems were not breached, that access has been cut, and that authorities and affected customers in France have been notified. Breach letters reviewed by BleepingComputer list names, postal and email addresses, phone numbers, PDL/PCE meter-point identifiers, customer IDs and contract numbers; ENGIE says no banking data was involved. No group has claimed the intrusion and ENGIE has not said how many customers are affected.
“ENGIE’s internal IT systems were not compromised.” — ENGIE spokesperson, to BleepingComputer
Source: BleepingComputer
University of Copenhagen breach grows to roughly 525,000 people
University of Copenhagen (via BleepingComputer) · October 26, 2026
The University of Copenhagen says intruders reached one of its test environments, exposing names, Danish CPR national identity numbers, phone numbers and email addresses for about 525,000 people, with an update adding some 20,000 staff and students whose physical-access PIN codes were also taken. The university detected the intrusion on October 20, disclosed it October 23, reports no impact on operational systems, and has temporarily restricted physical access to some campus locations while it issues new codes.
Source: BleepingComputer
Collabora Online and Arista VeloCloud Orchestrator flaws under active exploitation
CISA · October 23, 2026
CISA added CVE-2026-110447 (CVSS 9.2, OS command injection in the Collabora Online built-in CODE server used with Nextcloud, fixed in 26.4.303) and CVE-2026-114625 (CVSS 9.9, SQL injection in on-premise Arista VeloCloud Orchestrator, fixed in 5.2.3.18, 6.1.3.10 and 6.4.2.12) to KEV on October 23 with a federal due date of October 26. Attackers have been backdooring Nextcloud servers with web shells and hunting for credential stores and crypto wallets, and Arista acknowledges the VCO bug is known to be actively exploited — the third VCO flaw exploited in the wild since July.
Source: CISA KEV alert (Collabora) · CISA KEV alert (Arista) · The Hacker News
This brief covers the trailing ~48 hours (October 25–27, 2026).
Primary sources:
- CISA — Adds Two Known Exploited Vulnerabilities to Catalog (Oct 26, 2026)
- CISA — Critical Vulnerabilities in PHP Require Immediate Patching (revised Oct 26, 2026)
- PHP — Security advisory for CVE-2026-109619
- Adel Karimi — PHP2Shell confirmed RCE honeypot report (Oct 24, 2026)
- Apple — About the security content of iOS 18.7.11 and iPadOS 18.7.11
- Apple — About the security content of iOS 27.2 and iPadOS 27.2
- Microsoft — .NET October 2026 out-of-band security updates
- Microsoft MSRC — CVE-2026-111497
- Palo Alto Networks — CVE-2026-111497 advisory
- Node.js — October 2026 security releases
- CISA — Adds One Known Exploited Vulnerability to Catalog (Collabora, Oct 23, 2026)
- CISA — Adds One Known Exploited Vulnerability to Catalog (Arista, Oct 23, 2026)