Verified status as of October 26, 2026
Checked by defend.network against the NIST National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities catalog.
- CVE-2026-111497 in PHP Brotli library: the source articles reported no exploitation. NVD rates it 9.2 (CRITICAL) on CVSS v4.0.
- CVE-2026-109618 in PHP Group PHP is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-10-26; federal remediation due 2026-10-29). NVD rates it 9.8 (CRITICAL) on CVSS v3.1. NVD lists a vendor advisory.
- CVE-2026-109619 in PHP Group PHP is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-10-26; federal remediation due 2026-10-29). NVD rates it 8.1 (HIGH) on CVSS v3.1. NVD lists a vendor advisory.
TL;DR
Critical Brotli memory-corruption flaw (CVE-2026-111497) in PHP Windows packages is patched; PHP RCEs CVE-2026-109618 and CVE-2026-109619 under active exploitation affecting ~70% of web infrastructure. 953 Magento stores compromised with scanner-evasion code; GitHub tokens stolen in supply-chain attack; 525,000 records exposed at University of Copenhagen.
Executive Summary
- PHP vulnerability pair (CVE-2026-109618, CVE-2026-109619) enabling unauthenticated RCE is actively exploited across nearly 70% of websites; CISA KEV entries mandate federal patching by October 29.
- Critical Brotli compression library flaw (CVE-2026-111497) patched in PHP 8.2–8.5 Windows builds and present in Node.js and Python; exploitable through HTTP/2 and cURL.
- 953 e-commerce stores, predominantly Magento, infected with JavaScript code designed to evade security scanners in ongoing campaign active since July 2025.
- Supply-chain attack “Gheist” harvesting GitHub tokens and cloud credentials from thousands of developer repositories.
- University of Copenhagen confirms breach exposing personal data of 525,000 individuals; ransomware negotiators linked to ShinyHunters extortion group under FBI investigation.
Top Threats Today
1. Critical PHP RCEs Under Active Exploitation Across 70% of Web Infrastructure
Severity: CRITICAL Affected: Technology
CVE-2026-109618 and CVE-2026-109619 are a pair of remote code execution vulnerabilities in PHP that allow unauthenticated attackers to seize full control of affected servers [1]. Both vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities catalog as of October 26, with a federal remediation deadline of October 29 [2][3]. CVE-2026-109618 is an out-of-memory corruption flaw, and CVE-2026-109619 is a stale internal request-state vulnerability [2][3]. Working exploits are publicly available, and researchers report that nearly 70 percent of websites require updates to patch these flaws [1].
Sources:[1] Krebs on Security[2] CISA KEV[3] CISA KEV
Recommended Action
- Prioritize PHP patching immediately; verify all web servers are running patched versions
- Monitor for signs of server compromise (unexpected shell creation, outbound connections, file modifications) on all PHP-powered infrastructure
- Enable request logging and anomaly detection on web application firewalls
- Enforce authentication and IP allowlisting on administrative interfaces
2. Brotli Compression Library RCE in PHP, Node.js, Python Windows Implementations
Severity: CRITICAL Affected: Technology
CVE-2026-111497, dubbed “HTTP2Shell,” is a critical memory corruption flaw in the Brotli compression library that is built into PHP, Node.js, and other runtime environments [2]. In PHP, the flaw is exploitable through the cURL extension and can allow attackers to corrupt memory and access sensitive data or execute arbitrary code [1]. PHP has issued emergency rebuilds of its official Windows packages for versions 8.2 through 8.5 to address the vulnerability [1]. The flaw is also present in Node.js and other implementations ⚠[2].
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- Update PHP Windows distributions to the latest patched builds (8.2, 8.3, 8.4, 8.5 as available)
- Audit and patch Node.js deployments for Brotli-related updates
- Disable Brotli compression if patches are unavailable and the software cannot be updated immediately
- Monitor HTTP/2 traffic for unusual compression patterns or decompression errors
3. 953 Magento and E-commerce Stores Infected with Scanner-Evading JavaScript
Severity: HIGH Affected: Retail
An unknown threat actor has infected 953 online stores, the majority running Magento, as part of a long-running campaign active since July 2025 [1]. The campaign injects a small piece of JavaScript code into store pages that is designed to evade detection by security scanners [1]. The injected code executes when store pages are visited by customers, creating risk for credential theft and payment card compromise. ⚠
Sources:[1] The Hacker News
Recommended Action
- Scan Magento and other e-commerce platforms for unauthorized JavaScript injections in front-end templates and page headers
- Review file integrity monitoring logs for unexpected modifications to theme files, JavaScript assets, and checkout pages since July 2025
- Audit admin account access logs and API keys; reset credentials for any suspicious activity
- Deploy client-side security scanning that looks for inline scripts in payment and login contexts
4. GitHub Supply-Chain Attack 'Gheist' Steals Tokens and Cloud Credentials
Severity: HIGH Affected: Technology
An ongoing supply-chain attack designated “Gheist” is harvesting GitHub tokens and cloud credentials from thousands of developer repositories [1]. The attack exploits the trust developers place in GitHub to compromise sensitive credentials and access internal cloud infrastructure, amplifying the reach of downstream attacks on organizations using affected open-source projects and repositories.
Sources:[1] Dark Reading
Recommended Action
- Audit GitHub personal access tokens and organization tokens; rotate all tokens immediately
- Review repository commit history and pull requests for suspicious activity since the campaign’s discovery
- Enable branch protection rules and require code reviews on all critical repositories
- Scan cloud credential stores (AWS Secrets Manager, Azure Key Vault, etc.) for evidence of unauthorized access
- Monitor GitHub organization audit logs for token creation, key rotation, or permission changes
5. University of Copenhagen Data Breach Exposes 525,000 Individuals
Severity: HIGH Affected: Education
The University of Copenhagen confirmed a data breach in which attackers accessed one of its test environments containing personal data belonging to 525,000 people [1]. The exposure of a test environment underscores risks posed by inadequate segmentation of non-production infrastructure and the sensitive data retained within it.
Sources:[1] BleepingComputer
Recommended Action
- Notify affected individuals in accordance with GDPR and applicable data protection regulations
- Segment test and development environments from production and restrict access by role and business necessity
- Audit all non-production systems for the presence of production data; implement automated redaction of PII in development/test environments
- Review access controls and credential management on test infrastructure
Ongoing Threats
Ransomware negotiator arrested in ShinyHunters investigation: The FBI arrested the co-founder of a Canadian cybersecurity firm in connection with the ShinyHunters extortion group that recently breached the FBI itself [15]. Federal investigators have identified executives at ransomware negotiation firms who maintained close relations with ShinyHunters [12]. U.K. sanctions Cryptomus: The United Kingdom issued economic sanctions against Cryptomus, a cryptocurrency platform serving as a payment conduit for ransomware, narcotics, and darknet markets [13]. Microsoft Teams abuse: Threat actors are conducting social engineering and malware delivery via Microsoft Teams external chat creation feature, exploiting IT support impersonation patterns [3]. Earlier coverage of related threats.
Today’s Action Checklist
- ☐ URGENT (Today): Patch all PHP instances to latest versions addressing CVE-2026-109618 and CVE-2026-109619; verify deployment and test applications before production rollout
- ☐ URGENT (Today): Deploy PHP Windows security updates for CVE-2026-111497 (Brotli) to all affected systems running versions 8.2–8.5
- ☐ URGENT: If running Magento or other e-commerce platforms, conduct file integrity audit for unauthorized JavaScript injections and scanner-evasion techniques
- ☐ URGENT: Rotate all GitHub tokens, personal access tokens, and cloud credential store keys; audit usage logs
- ☐ HIGH: Segregate test and development environments from production; audit and remove PII from non-production systems
- ☐ HIGH: Review Microsoft Teams external chat policies and audit recent external conversations for signs of social engineering or credential compromise
- ☐ MEDIUM: Monitor CISA KEV updates through October 29 for additional federal remediation deadlines