{"category":"patch","changes":[{"body":null,"category":"patch","date":"2026-10-30","incident":"linux-kernel-tcp-use-after-free-race-mptcp-linked-root-exploit-ubuntu-rhel-unpatched-cve-2026-98432","incidentTitle":"Linux kernel TCP use-after-free race (MPTCP-linked root exploit) — Ubuntu/RHEL unpatched (CVE-2026-98432)","kind":"advisory","patchStatus":"partial","severity":"critical","sourceUrl":"https://seclists.org/oss-sec/2026/q4/437","status":"live","title":"Go team issues official guidance on protecting Go programs against CVE-2026-98432","url":"https://helix.ml/threat-watch/i/linux-kernel-tcp-use-after-free-race-mptcp-linked-root-exploit-ubuntu-rhel-unpatched-cve-2026-98432"},{"body":null,"category":"patch","date":"2026-10-29","incident":"wordpress-7-1-4-unauthenticated-race-condition-in-core-update-process-enables-rce-exploitation-attempts-detected","incidentTitle":"WordPress 7.1.4: unauthenticated race condition in core update process enables RCE; exploitation attempts detected","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","status":"live","title":"WordPress 7.1.4: unauthenticated race condition in core update process enables RCE; exploitation attempts detected","url":"https://helix.ml/threat-watch/i/wordpress-7-1-4-unauthenticated-race-condition-in-core-update-process-enables-rce-exploitation-attempts-detected"},{"body":null,"category":"patch","date":"2026-10-29","incident":"linux-kernel-tcp-use-after-free-race-mptcp-linked-root-exploit-ubuntu-rhel-unpatched-cve-2026-98432","incidentTitle":"Linux kernel TCP use-after-free race (MPTCP-linked root exploit) — Ubuntu/RHEL unpatched (CVE-2026-98432)","kind":"disclosure","patchStatus":"partial","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html","status":"live","title":"Linux kernel TCP use-after-free race (MPTCP-linked root exploit) — Ubuntu/RHEL unpatched (CVE-2026-98432)","url":"https://helix.ml/threat-watch/i/linux-kernel-tcp-use-after-free-race-mptcp-linked-root-exploit-ubuntu-rhel-unpatched-cve-2026-98432"},{"body":null,"category":"patch","date":"2026-10-29","incident":"zip-cloaking-rust-zip-crate-parser-differential-lets-crafted-zips-bypass-security-scanners-and-overwrite-arbitrary-files","incidentTitle":"Zip Cloaking: Rust zip crate — parser differential bypasses scanners for arbitrary file write/RCE, plus symlink write, alloc-abort and legacy-decoder DoS (CVE-2026-115905, CVE-2026-115908, CVE-2026-115909, CVE-2026-115907)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-hjqx-j4rw-g7xv","status":"live","title":"Rust zip crate hit with three more high-severity advisories: lexical symlink validation enabling arbitrary file write (CVE-2026-115908), unbounded symlink-target allocation abort (CVE-2026-115909), and legacy Shrink decoder DoS (CVE-2026-115907)","url":"https://helix.ml/threat-watch/i/zip-cloaking-rust-zip-crate-parser-differential-lets-crafted-zips-bypass-security-scanners-and-overwrite-arbitrary-files"},{"body":null,"category":"patch","date":"2026-10-29","incident":"broadcom-vmware-esx-cve-2026-41709","incidentTitle":"VMware ESX insufficient logging zero-day (CVE-2026-41709) exploited by Warp Panda; PHP2Shell/Fragnesia chains root firewalls","kind":"advisory","patchStatus":"patched","severity":"high","sourceUrl":"https://securityaffairs.com/202050/hacking/u-s-cisa-adds-linux-kernel-and-broadcom-vmware-esx-flaws-to-its-known-exploited-vulnerabilities-catalog.html","status":"live","title":"CISA adds Broadcom VMware ESX flaw (alongside Linux Kernel bugs) to its Known Exploited Vulnerabilities catalog","url":"https://helix.ml/threat-watch/i/broadcom-vmware-esx-cve-2026-41709"},{"body":null,"category":"patch","date":"2026-10-29","incident":"broadcom-vmware-esx-cve-2026-41709","incidentTitle":"VMware ESX insufficient logging zero-day (CVE-2026-41709) exploited by Warp Panda; PHP2Shell/Fragnesia chains root firewalls","kind":"exploitation","patchStatus":"patched","severity":"high","sourceUrl":"https://www.helpnetsecurity.com/2026/10/29/php2shell-fragnesia-vmware-esx-zero-day/","status":"live","title":"China-nexus actors used the VMware ESX zero-day to hide their tracks and chained PHP2Shell/Fragnesia to root firewalls","url":"https://helix.ml/threat-watch/i/broadcom-vmware-esx-cve-2026-41709"},{"body":null,"category":"patch","date":"2026-10-29","incident":"oracle-ebs-sql-injection-to-rce-now-scanned-exploited-in-the-wild-cve-2026-101767","incidentTitle":"Oracle EBS SQL injection to RCE now scanned/exploited in the wild (CVE-2026-101767)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.helpnetsecurity.com/2026/10/29/oracle-e-business-suite-cve-2026-101767-exploitation/","status":"live","title":"Active exploitation confirmed: Oracle EBS decoys recorded exploratory exploits of CVE-2026-101767 on Oct 27","url":"https://helix.ml/threat-watch/i/oracle-ebs-sql-injection-to-rce-now-scanned-exploited-in-the-wild-cve-2026-101767"},{"body":null,"category":"patch","date":"2026-10-29","incident":"cisco-asa-ftd-ssl-vpn-zero-day-exploited-for-dos-patches-released-cve-2026-76418","incidentTitle":"Cisco ASA/FTD SSL VPN zero-day exploited for DoS — patches released (CVE-2026-76418)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/","status":"live","title":"Cisco confirms active exploitation of the ASA/FTD SSL VPN DoS zero-day and releases patches","url":"https://helix.ml/threat-watch/i/cisco-asa-ftd-ssl-vpn-zero-day-exploited-for-dos-patches-released-cve-2026-76418"},{"body":null,"category":"patch","date":"2026-10-29","incident":"cisco-asa-ftd-ssl-vpn-zero-day-exploited-for-dos-patches-released-cve-2026-76418","incidentTitle":"Cisco ASA/FTD SSL VPN zero-day exploited for DoS — patches released (CVE-2026-76418)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://thehackernews.com/2026/10/cisco-patches-actively-exploited-asa.html","status":"live","title":"Cisco confirms CVE-2026-76418 (CVSS 8.6) ASA/FTD VPN flaw is actively exploited; patches released","url":"https://helix.ml/threat-watch/i/cisco-asa-ftd-ssl-vpn-zero-day-exploited-for-dos-patches-released-cve-2026-76418"},{"body":null,"category":"patch","date":"2026-10-29","incident":"cisco-asa-ftd-ssl-vpn-zero-day-exploited-for-dos-patches-released-cve-2026-76418","incidentTitle":"Cisco ASA/FTD SSL VPN zero-day exploited for DoS — patches released (CVE-2026-76418)","kind":"disclosure","patchStatus":"patched","severity":"high","sourceUrl":"https://www.securityweek.com/attackers-exploit-second-cisco-firewall-vpn-zero-day-since-august/","status":"live","title":"Cisco ASA/FTD SSL VPN zero-day exploited for DoS — patches released (CVE-2026-76418)","url":"https://helix.ml/threat-watch/i/cisco-asa-ftd-ssl-vpn-zero-day-exploited-for-dos-patches-released-cve-2026-76418"},{"body":null,"category":"patch","date":"2026-10-29","incident":"broadcom-vmware-esx-cve-2026-41709","incidentTitle":"VMware ESX insufficient logging zero-day (CVE-2026-41709) exploited by Warp Panda; PHP2Shell/Fragnesia chains root firewalls","kind":"disclosure","patchStatus":"patched","severity":"high","sourceUrl":"https://www.securityweek.com/chinese-hackers-quietly-used-low-severity-esxi-logging-flaw-as-zero-day/","status":"live","title":"SecurityWeek confirms Chinese hackers used the low-severity ESXi logging flaw CVE-2026-41709 as a zero-day","url":"https://helix.ml/threat-watch/i/broadcom-vmware-esx-cve-2026-41709"},{"body":null,"category":"patch","date":"2026-10-29","incident":"broadcom-vmware-esx-cve-2026-41709","incidentTitle":"VMware ESX insufficient logging zero-day (CVE-2026-41709) exploited by Warp Panda; PHP2Shell/Fragnesia chains root firewalls","kind":"exploitation","patchStatus":"patched","severity":"high","sourceUrl":"https://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html","status":"live","title":"CVE-2026-41709 added to CISA KEV after CrowdStrike tied it to China-nexus Warp Panda attacks on the U.S. legal sector","url":"https://helix.ml/threat-watch/i/broadcom-vmware-esx-cve-2026-41709"},{"body":"AI editor revision: China-nexus actors used the VMware ESX zero-day to hide their tracks and chained PHP2Shell/Fragnesia to root firewalls","category":"patch","date":"2026-10-28","incident":"broadcom-vmware-esx-cve-2026-41709","incidentTitle":"VMware ESX insufficient logging zero-day (CVE-2026-41709) exploited by Warp Panda; PHP2Shell/Fragnesia chains root firewalls","kind":"correction","patchStatus":"patched","severity":"high","sourceUrl":null,"status":"live","title":"Severity changed from medium to high","url":"https://helix.ml/threat-watch/i/broadcom-vmware-esx-cve-2026-41709"},{"body":"AI editor revision: CVE-2026-41709 added to CISA KEV after CrowdStrike tied it to China-nexus Warp Panda attacks on the U.S. legal sector","category":"patch","date":"2026-10-28","incident":"broadcom-vmware-esx-cve-2026-41709","incidentTitle":"VMware ESX insufficient logging zero-day (CVE-2026-41709) exploited by Warp Panda; PHP2Shell/Fragnesia chains root firewalls","kind":"status","patchStatus":"patched","severity":"high","sourceUrl":null,"status":"live","title":"Patch status changed from unknown to patched","url":"https://helix.ml/threat-watch/i/broadcom-vmware-esx-cve-2026-41709"},{"body":"AI editor revision: CVE-2026-41709 added to CISA KEV after CrowdStrike tied it to China-nexus Warp Panda attacks on the U.S. legal sector","category":"patch","date":"2026-10-28","incident":"broadcom-vmware-esx-cve-2026-41709","incidentTitle":"VMware ESX insufficient logging zero-day (CVE-2026-41709) exploited by Warp Panda; PHP2Shell/Fragnesia chains root firewalls","kind":"correction","patchStatus":"patched","severity":"high","sourceUrl":null,"status":"live","title":"Severity changed from low to medium","url":"https://helix.ml/threat-watch/i/broadcom-vmware-esx-cve-2026-41709"},{"body":null,"category":"patch","date":"2026-10-28","incident":"broadcom-vmware-esx-cve-2026-41709","incidentTitle":"VMware ESX insufficient logging zero-day (CVE-2026-41709) exploited by Warp Panda; PHP2Shell/Fragnesia chains root firewalls","kind":"exploitation","patchStatus":"patched","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-41709","status":"live","title":"CISA added CVE-2026-41709 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 11, 2026)","url":"https://helix.ml/threat-watch/i/broadcom-vmware-esx-cve-2026-41709"},{"body":null,"category":"patch","date":"2026-10-28","incident":"oracle-ebs-sql-injection-to-rce-now-scanned-exploited-in-the-wild-cve-2026-101767","incidentTitle":"Oracle EBS SQL injection to RCE now scanned/exploited in the wild (CVE-2026-101767)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.theregister.com/security/2026/10/28/oracle-celebrates-end-of-cybersecurity-awareness-month-with-quadruple-trouble/5306121","status":"live","title":"Attackers probe another Oracle EBS bug and ShinyHunters' PeopleSoft 0-day is revealed to involve three vulnerabilities","url":"https://helix.ml/threat-watch/i/oracle-ebs-sql-injection-to-rce-now-scanned-exploited-in-the-wild-cve-2026-101767"},{"body":null,"category":"patch","date":"2026-10-28","incident":"electrum-malicious-server-rbf-fee-bump-theft-via-unverified-mempool-tx-cve-2026-117601","incidentTitle":"Electrum malicious-server RBF fee-bump theft via unverified mempool tx (CVE-2026-117601)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-6jp4-8v48-cc5v","status":"live","title":"Electrum malicious-server RBF fee-bump theft via unverified mempool tx (CVE-2026-117601)","url":"https://helix.ml/threat-watch/i/electrum-malicious-server-rbf-fee-bump-theft-via-unverified-mempool-tx-cve-2026-117601"},{"body":null,"category":"patch","date":"2026-10-28","incident":"zip-cloaking-rust-zip-crate-parser-differential-lets-crafted-zips-bypass-security-scanners-and-overwrite-arbitrary-files","incidentTitle":"Zip Cloaking: Rust zip crate — parser differential bypasses scanners for arbitrary file write/RCE, plus symlink write, alloc-abort and legacy-decoder DoS (CVE-2026-115905, CVE-2026-115908, CVE-2026-115909, CVE-2026-115907)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-m665-v7pm-7grj","status":"live","title":"Zip Cloaking: Rust zip crate — parser differential lets crafted ZIPs bypass security scanners and overwrite arbitrary files (CVE-2026-115905)","url":"https://helix.ml/threat-watch/i/zip-cloaking-rust-zip-crate-parser-differential-lets-crafted-zips-bypass-security-scanners-and-overwrite-arbitrary-files"},{"body":null,"category":"patch","date":"2026-10-28","incident":"n-able-n-central-cve-2025-8876","incidentTitle":"N-able N-Central Command Injection Vulnerability (CVE-2025-8876)","kind":"exploitation","patchStatus":"patched","severity":"high","sourceUrl":"https://helix.ml/threat-watch/i/silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure","status":"closed","title":"Black Lotus Labs ties the N-central zero-day chain (CVE-2025-8875/8876) to Volt Typhoon's 'Silent Train' campaign","url":"https://helix.ml/threat-watch/i/n-able-n-central-cve-2025-8876"},{"body":null,"category":"patch","date":"2026-10-28","incident":"n-able-n-central-cve-2025-8875","incidentTitle":"N-able N-Central Insecure Deserialization Vulnerability (CVE-2025-8875)","kind":"exploitation","patchStatus":"patched","severity":"high","sourceUrl":"https://helix.ml/threat-watch/i/silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure","status":"closed","title":"Black Lotus Labs ties the N-central zero-day chain (CVE-2025-8875/8876) to Volt Typhoon's 'Silent Train' campaign","url":"https://helix.ml/threat-watch/i/n-able-n-central-cve-2025-8875"},{"body":"See the Silent Train incident for the full campaign.","category":"patch","date":"2026-10-28","incident":"cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127","incidentTitle":"Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability (CVE-2026-20127)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://helix.ml/threat-watch/i/silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure","status":"closed","title":"Black Lotus Labs ties exploitation to Volt Typhoon's 'Silent Train' campaign, active by late 2025 and continuing after the fix","url":"https://helix.ml/threat-watch/i/cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127"},{"body":"This is the third SD-WAN platform the group has exploited, after Versa Director and Cisco Catalyst SD-WAN. See the Silent Train incident for the full campaign.","category":"patch","date":"2026-10-28","incident":"arista-velocloud-orchestrator-cve-2026-16812","incidentTitle":"Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability (CVE-2026-16812)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://helix.ml/threat-watch/i/silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure","status":"closed","title":"Black Lotus Labs attributes zero-day exploitation to Volt Typhoon's 'Silent Train' campaign","url":"https://helix.ml/threat-watch/i/arista-velocloud-orchestrator-cve-2026-16812"},{"body":"Headscale memory exhaustion and Funnel entitlement gating remain open, according to the researcher. Conn25 is unreleased and will be fixed before it ships.","category":"patch","date":"2026-10-28","incident":"tailworm-tailscale-ssh-socket-forwarding-flaws-let-trusted-device-attackers-reach-root-only-sockets-no-cve","incidentTitle":"Tailworm: Tailscale SSH unix-socket forwarding gives policy-permitted peers root-only sockets; fixed in 1.104.4 (TS-2026-014)","kind":"patch","patchStatus":"partial","severity":"high","sourceUrl":"https://github.com/tailscale/tailscale/releases/tag/v1.104.4","status":"live","title":"Tailscale 1.104.4 released, fixing TS-2026-014 to 017; Tailscale publishes \"Findings and fixes\"","url":"https://helix.ml/threat-watch/i/tailworm-tailscale-ssh-socket-forwarding-flaws-let-trusted-device-attackers-reach-root-only-sockets-no-cve"},{"body":"13 of the 15 are rated High and 2 Medium. They include XStream deserialization RCE, agent-launch and agent-config RCE, symlink file read/write, a setup-wizard admin-creation race, and stored XSS.","category":"patch","date":"2026-10-28","incident":"jenkins-multiple-vulnerabilities-fixed-in-2-588-lts-2-580-2-rce-arbitrary-file-read-write-xss-cve-2026-117612-et-al","incidentTitle":"Jenkins core: 15 vulnerabilities fixed in 2.588 / LTS 2.580.2. Low-privilege users can get RCE on the controller; an unauthenticated race in the setup wizard can create an admin (CVE-2026-117612–117626)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://www.jenkins.io/security/advisory/2026-10-28/","status":"live","title":"Jenkins advisory 2026-10-28 published; weekly 2.588 and LTS 2.580.2 fix 15 core vulnerabilities","url":"https://helix.ml/threat-watch/i/jenkins-multiple-vulnerabilities-fixed-in-2-588-lts-2-580-2-rce-arbitrary-file-read-write-xss-cve-2026-117612-et-al"},{"body":"Debian marks trixie no-DSA (minor issue) and tracks the fix as edk2 commits fa789071, 560ed9b5 and 14cdbb86 (bug #1151853); Ubuntu lists edk2 as needs-triage, medium priority.","category":"patch","date":"2026-10-28","incident":"cve-2026-97631-tianocore-edk-ii-uefi-pxe-driver-16-year-old-buffer-overflow-allows-pre-os-code-execution-during-network","incidentTitle":"TianoCore EDK II PXE driver: ICMP error overflow gives pre-boot code execution on network-booting machines (CVE-2026-97631)","kind":"advisory","patchStatus":"partial","severity":"critical","sourceUrl":"https://seclists.org/oss-sec/2026/q4/411","status":"closed","title":"oss-security post; Debian lists edk2/OVMF vulnerable in every release with no fix yet","url":"https://helix.ml/threat-watch/i/cve-2026-97631-tianocore-edk-ii-uefi-pxe-driver-16-year-old-buffer-overflow-allows-pre-os-code-execution-during-network"},{"body":null,"category":"patch","date":"2026-10-28","incident":"oracle-ebs-sql-injection-to-rce-now-scanned-exploited-in-the-wild-cve-2026-101767","incidentTitle":"Oracle EBS SQL injection to RCE now scanned/exploited in the wild (CVE-2026-101767)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html","status":"live","title":"Threat actors begin probing/exploiting CVE-2026-101767 days after Oracle's patch","url":"https://helix.ml/threat-watch/i/oracle-ebs-sql-injection-to-rce-now-scanned-exploited-in-the-wild-cve-2026-101767"},{"body":null,"category":"patch","date":"2026-10-28","incident":"oracle-ebs-sql-injection-to-rce-now-scanned-exploited-in-the-wild-cve-2026-101767","incidentTitle":"Oracle EBS SQL injection to RCE now scanned/exploited in the wild (CVE-2026-101767)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.bleepingcomputer.com/news/security/hackers-now-scanning-systems-for-recently-patched-oracle-flaw/","status":"live","title":"Oracle EBS SQL injection to RCE now scanned/exploited in the wild (CVE-2026-101767)","url":"https://helix.ml/threat-watch/i/oracle-ebs-sql-injection-to-rce-now-scanned-exploited-in-the-wild-cve-2026-101767"},{"body":null,"category":"patch","date":"2026-10-28","incident":"adobe-campaign-classic-8-critical-flaws-enabling-rce-and-security-bypass-patched-cve-2026-104351-et-al","incidentTitle":"Adobe Campaign Classic: 8 critical flaws enabling RCE and security bypass patched (CVE-2026-104351 et al.)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/adobe-fixes-8-critical-campaign-classic.html","status":"live","title":"Adobe Campaign Classic: 8 critical flaws enabling RCE and security bypass patched (CVE-2026-104351 et al.)","url":"https://helix.ml/threat-watch/i/adobe-campaign-classic-8-critical-flaws-enabling-rce-and-security-bypass-patched-cve-2026-104351-et-al"},{"body":null,"category":"patch","date":"2026-10-28","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Node2Shell / HTTP2Shell: Brotli decoder flaw lets attackers run code in Node.js, Bun, Python and other HTTP software (CVE-2026-111497)","kind":"advisory","patchStatus":"partial","severity":"critical","sourceUrl":"https://securityaffairs.com/201922/security/u-s-cisa-adds-google-brotli-and-adobe-commerce-and-magento-flaws-to-its-known-exploited-vulnerabilities-catalog.html","status":"live","title":"CISA adds the Brotli Node2Shell flaw (CVE-2026-111497) to its Known Exploited Vulnerabilities catalog","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-28","incident":"epics-base-ai-agent-finds-4-severe-bugs-incl-critical-rce-in-industrial-control-software-cve-2026-114595","incidentTitle":"EPICS Base: AI agent finds 4 severe bugs incl. critical RCE in industrial control software (CVE-2026-114595)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.securityweek.com/long-hidden-flaws-patched-in-epics-research-facility-control-software/","status":"live","title":"EPICS Base flaws disclosed publicly; could crash processes at particle accelerators and fusion labs","url":"https://helix.ml/threat-watch/i/epics-base-ai-agent-finds-4-severe-bugs-incl-critical-rce-in-industrial-control-software-cve-2026-114595"},{"body":null,"category":"patch","date":"2026-10-28","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Node2Shell / HTTP2Shell: Brotli decoder flaw lets attackers run code in Node.js, Bun, Python and other HTTP software (CVE-2026-111497)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-now-exploiting-critical-node2shell-flaw/","status":"live","title":"CISA confirms active exploitation of the Node2Shell Brotli RCE (CVE-2026-111497)","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-28","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Node2Shell / HTTP2Shell: Brotli decoder flaw lets attackers run code in Node.js, Bun, Python and other HTTP software (CVE-2026-111497)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.securityweek.com/cisa-warns-of-node2shell-exploitation-as-honeypots-log-attack-attempts/","status":"live","title":"CISA adds CVE-2026-111497 to KEV as honeypots log real-world Node2Shell exploitation attempts","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-28","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Node2Shell / HTTP2Shell: Brotli decoder flaw lets attackers run code in Node.js, Bun, Python and other HTTP software (CVE-2026-111497)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/adobe-commerce-polyshell-attacks-breach.html","status":"live","title":"CISA adds Brotli decoder flaw CVE-2026-111497 to KEV amid active PolyShell exploitation of Adobe Commerce/Magento stores","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-28","incident":"three-tls-bugs-in-goahead-web-server-revoked-certs-accepted-dh-truncation-chain-depth-bypass-no-cves","incidentTitle":"Three TLS Bugs in GoAhead web server: revoked certs accepted, DH truncation, chain-depth bypass (no CVEs)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://seclists.org/oss-sec/2026/q4/408","status":"live","title":"Three TLS Bugs in GoAhead web server: revoked certs accepted, DH truncation, chain-depth bypass (no CVEs)","url":"https://helix.ml/threat-watch/i/three-tls-bugs-in-goahead-web-server-revoked-certs-accepted-dh-truncation-chain-depth-bypass-no-cves"},{"body":"Intel says no commercial product under security support is believed affected and points customers to their system makers; Arm says the CVE does not directly apply to its portfolio. AMI, Insyde, Phoenix and most server OEMs had not published advisories.","category":"patch","date":"2026-10-27","incident":"cve-2026-97631-tianocore-edk-ii-uefi-pxe-driver-16-year-old-buffer-overflow-allows-pre-os-code-execution-during-network","incidentTitle":"TianoCore EDK II PXE driver: ICMP error overflow gives pre-boot code execution on network-booting machines (CVE-2026-97631)","kind":"other","patchStatus":"partial","severity":"critical","sourceUrl":"https://securityaffairs.com/201928/security/cve-2026-97631-16-year-old-uefi-flaw-threatens-servers.html","status":"closed","title":"Ars Technica coverage; Intel and Arm say their products are not directly affected","url":"https://helix.ml/threat-watch/i/cve-2026-97631-tianocore-edk-ii-uefi-pxe-driver-16-year-old-buffer-overflow-allows-pre-os-code-execution-during-network"},{"body":null,"category":"patch","date":"2026-10-27","incident":"chrome-stable-update-fixes-353-security-flaws-incl-critical-memory-corruption-cve-2026-113341-cve-2026-113279-cve-2026-1","incidentTitle":"Chrome: stable update fixes 353 security flaws incl. critical memory corruption (CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280)","kind":"patch","patchStatus":"patched","severity":"critical","sourceUrl":"http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","status":"live","title":"Chrome 156.0.8078.73/.74 stable update released for desktop and Android","url":"https://helix.ml/threat-watch/i/chrome-stable-update-fixes-353-security-flaws-incl-critical-memory-corruption-cve-2026-113341-cve-2026-113279-cve-2026-1"},{"body":null,"category":"patch","date":"2026-10-27","incident":"node-js-october-2026-security-releases-fix-dns-truncation-tls-hostname-bypasses-brotli-rce-and-http-keep-alive-flaws-cve","incidentTitle":"Node.js: October 2026 security releases fix DNS truncation, TLS hostname bypasses, Brotli RCE and HTTP keep-alive flaws (CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-111497, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074)","kind":"advisory","patchStatus":"patched","severity":"high","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20node.js%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1","status":"live","title":"Cisco PSIRT advisory confirms Node.js October 2026 fixes (Brotli decoder, DNS, TLS validation) affect Cisco products","url":"https://helix.ml/threat-watch/i/node-js-october-2026-security-releases-fix-dns-truncation-tls-hostname-bypasses-brotli-rce-and-http-keep-alive-flaws-cve"},{"body":null,"category":"patch","date":"2026-10-27","incident":"adobe-commerce-and-magento-cve-2026-48356","incidentTitle":"Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2026-48356)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-48356","status":"live","title":"CISA added CVE-2026-48356 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 10, 2026)","url":"https://helix.ml/threat-watch/i/adobe-commerce-and-magento-cve-2026-48356"},{"body":null,"category":"patch","date":"2026-10-27","incident":"epics-base-ai-agent-finds-4-severe-bugs-incl-critical-rce-in-industrial-control-software-cve-2026-114595","incidentTitle":"EPICS Base: AI agent finds 4 severe bugs incl. critical RCE in industrial control software (CVE-2026-114595)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.theregister.com/security/2026/10/27/ai-hacker-finds-4-severe-bugs-in-popular-industrial-control-software-in-under-4-hours/5305811","status":"live","title":"EPICS Base: AI agent finds 4 severe bugs incl. critical RCE in industrial control software (CVE-2026-114595)","url":"https://helix.ml/threat-watch/i/epics-base-ai-agent-finds-4-severe-bugs-incl-critical-rce-in-industrial-control-software-cve-2026-114595"},{"body":null,"category":"patch","date":"2026-10-27","incident":"gitlab-unauthenticated-rce-via-ruby-onigmo-regex-compiler-integer-overflow-across-all-releases-since-7-0-cve-2026-110264","incidentTitle":"GitLab: Unauthenticated RCE via Ruby Onigmo regex compiler integer overflow across all releases since 7.0 (CVE-2026-110264)","kind":"patch","patchStatus":"patched","severity":"critical","sourceUrl":"https://databreaches.net/2026/10/27/gitlab-warns-of-new-max-severity-code-execution-vulnerability/","status":"live","title":"GitLab patches max-severity regex compiler RCE CVE-2026-110264 reported via HackerOne","url":"https://helix.ml/threat-watch/i/gitlab-unauthenticated-rce-via-ruby-onigmo-regex-compiler-integer-overflow-across-all-releases-since-7-0-cve-2026-110264"},{"body":null,"category":"patch","date":"2026-10-27","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Node2Shell / HTTP2Shell: Brotli decoder flaw lets attackers run code in Node.js, Bun, Python and other HTTP software (CVE-2026-111497)","kind":"disclosure","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.helpnetsecurity.com/2026/10/27/node2shell-broccoli2shell-vulnerability-cve-2026-111497/","status":"live","title":"Brotli flaw CVE-2026-111497 now widely known as Node2Shell/Broccoli2Shell/Brotli2Shell and affects a broad range of software beyond Node.js","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-27","incident":"better-auth-oauth-state-usable-as-magic-link-token-to-take-over-any-account-by-email-address-cve-2026-114607","incidentTitle":"better-auth: OAuth state accepted as a Magic Link token enables account takeover by email (CVE-2026-114607)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-965c-763c-88jm","status":"live","title":"better-auth: OAuth state usable as Magic Link token to take over any account by email address (CVE-2026-114607)","url":"https://helix.ml/threat-watch/i/better-auth-oauth-state-usable-as-magic-link-token-to-take-over-any-account-by-email-address-cve-2026-114607"},{"body":null,"category":"patch","date":"2026-10-27","incident":"authlib-jws-empty-signatures-bypass-authlib-deserialize-json-accepts-unsigned-payloads-as-verified-cve-2026-96760","incidentTitle":"Authlib: unsigned JWS JSON accepted as verified when the signatures array is empty (CVE-2026-96760)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-6v38-4h7w-rj9h","status":"live","title":"Authlib JWS empty-signatures bypass: authlib — deserialize_json() accepts unsigned payloads as verified (CVE-2026-96760)","url":"https://helix.ml/threat-watch/i/authlib-jws-empty-signatures-bypass-authlib-deserialize-json-accepts-unsigned-payloads-as-verified-cve-2026-96760"},{"body":null,"category":"patch","date":"2026-10-27","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.theregister.com/cyber-crime/2026/10/27/cisa-confirms-php2shell-under-attack-as-researchers-clock-successful-exploits/5305681","status":"live","title":"CISA adds both PHP2Shell flaws to the Known Exploited Vulnerabilities catalog as researchers confirm successful exploit attempts yielding shells","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-27","incident":"agno-eval-code-injection-in-functioncall-field-type-arbitrary-python-code-execution-cve-2026-35002","incidentTitle":"Agno: eval() on FunctionCall field_type runs arbitrary Python code (CVE-2026-35002)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-m4w4-3r8h-jw98","status":"live","title":"Agno eval() code injection in FunctionCall field_type — arbitrary Python code execution (CVE-2026-35002)","url":"https://helix.ml/threat-watch/i/agno-eval-code-injection-in-functioncall-field-type-arbitrary-python-code-execution-cve-2026-35002"},{"body":null,"category":"patch","date":"2026-10-27","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.wiz.io/blog/php2shell-exploitation-so-far","status":"live","title":"Wiz reports PHP2Shell exploitation attempts observed but none succeeded so far; analysis of what blocked attacks and exposure trends","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-27","incident":"pydicom-ds-is-nan-inf-validation-bypass-monailabel-crash-silent-inference-corruption-cve-2026-48705","incidentTitle":"pydicom: NaN/inf DICOM values let one upload crash MONAILabel and corrupt inference (CVE-2026-48705)","kind":"disclosure","patchStatus":"partial","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-6hp3-vr39-rqw8","status":"live","title":"pydicom DS/IS NaN/inf validation bypass → MONAILabel crash \u0026 silent inference corruption (CVE-2026-48705)","url":"https://helix.ml/threat-watch/i/pydicom-ds-is-nan-inf-validation-bypass-monailabel-crash-silent-inference-corruption-cve-2026-48705"},{"body":null,"category":"patch","date":"2026-10-27","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://therecord.media/php-vulnerabilities-cisa-kev","status":"live","title":"CISA adds PHP2Shell bugs to KEV, warns of exploitation attempts and gives federal agencies days to patch","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-27","incident":"hpe-arubaos-72-vulnerabilities-patched-including-eight-max-severity-unauthenticated-rce-and-auth-bypass-flaws-cve-2026-7","incidentTitle":"HPE ArubaOS: 72 vulnerabilities patched, including eight max-severity unauthenticated RCE and auth bypass flaws (CVE-2026-79844 through CVE-2026-79851)","kind":"patch","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.securityweek.com/hpe-patches-dozens-of-critical-flaws-in-networking-products/","status":"live","title":"HPE patches dozens of critical flaws in networking products, eight max-severity RCE/auth bypass defects","url":"https://helix.ml/threat-watch/i/hpe-arubaos-72-vulnerabilities-patched-including-eight-max-severity-unauthenticated-rce-and-auth-bypass-flaws-cve-2026-7"},{"body":null,"category":"patch","date":"2026-10-27","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://securityaffairs.com/201840/security/u-s-cisa-adds-php-flaws-php2shell-to-its-known-exploited-vulnerabilities-catalog.html","status":"live","title":"CISA adds PHP PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619) to Known Exploited Vulnerabilities catalog","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":"Tod Beardsley (runZero, formerly of CISA) writes that consolidated edge appliances concentrate risk. He notes that Citrix's average time from discovery to disclosure for NetScaler fell to 17 days in 2026, and that CISA rarely adds entries to KEV on a Sunday.","category":"patch","date":"2026-10-27","incident":"netscaler-zero-days-citrix-adc-gateway-unauthenticated-rce-actively-exploited-emergency-weekend-patches-cve-2026-88771-t","incidentTitle":"Citrix NetScaler ADC/Gateway zero-days: two pre-auth RCEs exploited since early September, plus an exploited SAML flaw (CVE-2026-88771, CVE-2026-88772, CVE-2026-88779)","kind":"other","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.securityweek.com/this-is-fine-what-netscaler-zero-days-tell-us-about-the-new-normal/","status":"closed","title":"Analysis: what the NetScaler zero-days say about edge-device patch cadence","url":"https://helix.ml/threat-watch/i/netscaler-zero-days-citrix-adc-gateway-unauthenticated-rce-actively-exploited-emergency-weekend-patches-cve-2026-88771-t"},{"body":null,"category":"patch","date":"2026-10-27","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/","status":"live","title":"CISA adds PHP2Shell vulnerabilities to actively exploited catalog, ordering federal agencies to patch by Thursday","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-27","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html","status":"live","title":"CISA adds PHP2Shell flaws (CVE-2026-109618/CVE-2026-109619) to KEV catalog, confirming active exploitation","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-27","incident":"chromeos-chromeos-flex-stable-channel-update-fixes-critical-and-high-kernel-browser-vulnerabilities-cve-2026-106200","incidentTitle":"ChromeOS / ChromeOS Flex: Stable channel update fixes critical and high kernel/browser vulnerabilities (CVE-2026-106200)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"http://chromereleases.googleblog.com/2026/10/long-term-support-channel-update-for_0661547040.html","status":"live","title":"ChromeOS LTS-150 channel update 150.0.7871.287 rolls out selected security fixes, including critical memory corruption CVE-2026-113279 and high-severity Skia/Animation flaws","url":"https://helix.ml/threat-watch/i/chromeos-chromeos-flex-stable-channel-update-fixes-critical-and-high-kernel-browser-vulnerabilities-cve-2026-106200"},{"body":null,"category":"patch","date":"2026-10-27","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"patch","patchStatus":"partial","severity":"critical","sourceUrl":"https://seclists.org/oss-sec/2026/q4/398","status":"live","title":"Backported PHP 5.4–5.6 patches for PHP2Shell OOM flaw (CVE-2026-109618) now available via community PPAs","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-27","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Node2Shell / HTTP2Shell: Brotli decoder flaw lets attackers run code in Node.js, Bun, Python and other HTTP software (CVE-2026-111497)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://cyberscoop.com/brotli-critical-vulnerability-decompression-library-node2shell-broccoli2shell/","status":"live","title":"No in-the-wild exploitation of the Brotli decoder flaw observed; experts temper emergency-level alarms","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":"Tailscale says most of the SSH issues are privilege escalation and is not recommending that everyone disable Tailscale SSH.","category":"patch","date":"2026-10-26","incident":"tailworm-tailscale-ssh-socket-forwarding-flaws-let-trusted-device-attackers-reach-root-only-sockets-no-cve","incidentTitle":"Tailworm: Tailscale SSH unix-socket forwarding gives policy-permitted peers root-only sockets; fixed in 1.104.4 (TS-2026-014)","kind":"advisory","patchStatus":"partial","severity":"high","sourceUrl":"https://tailscale.com/ssh-investigation-update","status":"live","title":"Tailscale publishes an investigation update and bulletins TS-2026-014 to 017, with TS_SSH_DISABLE_FORWARDING=1 as the interim mitigation","url":"https://helix.ml/threat-watch/i/tailworm-tailscale-ssh-socket-forwarding-flaws-let-trusted-device-attackers-reach-root-only-sockets-no-cve"},{"body":"Apple's iOS 27.2 security content page is dated 2026-10-26. The iOS 18 backport comes from NVD's fixed-in text and press coverage, not from a line on that page.","category":"patch","date":"2026-10-26","incident":"apple-multiple-products-cve-2026-86950","incidentTitle":"CoreGraphics zero-day: crafted file gives code execution on Apple iOS, iPadOS and macOS (CVE-2026-86950)","kind":"patch","patchStatus":"unknown","severity":"high","sourceUrl":null,"status":"closed","title":"iOS 27.2 and iPadOS 27.2 released; press reports the CoreGraphics fix backported to iOS 18","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2026-86950"},{"body":null,"category":"patch","date":"2026-10-26","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"patch","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.aikido.dev/blog/how-to-patch-php2shell-with-free-aikido-images","status":"live","title":"Free backported patch images (Aikido) now available for PHP2Shell (CVE-2026-109618/CVE-2026-109619) covering PHP 5.5–8.5","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-26","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Node2Shell / HTTP2Shell: Brotli decoder flaw lets attackers run code in Node.js, Bun, Python and other HTTP software (CVE-2026-111497)","kind":"advisory","patchStatus":"partial","severity":"critical","sourceUrl":"https://security.paloaltonetworks.com/CVE-2026-111497","status":"live","title":"Palo Alto Networks publishes advisory assessing impact of Brotli vulnerability CVE-2026-111497 on its products","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-26","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Node2Shell / HTTP2Shell: Brotli decoder flaw lets attackers run code in Node.js, Bun, Python and other HTTP software (CVE-2026-111497)","kind":"patch","patchStatus":"partial","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/php-issues-second-windows-security.html","status":"live","title":"PHP rebuilds Windows packages (8.2–8.5) and Microsoft ships emergency .NET fixes for Brotli flaw CVE-2026-111497, reachable via cURL extension auto-decompression","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-26","incident":"node-js-october-2026-security-releases-fix-dns-truncation-tls-hostname-bypasses-brotli-rce-and-http-keep-alive-flaws-cve","incidentTitle":"Node.js: October 2026 security releases fix DNS truncation, TLS hostname bypasses, Brotli RCE and HTTP keep-alive flaws (CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-111497, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074)","kind":"advisory","patchStatus":"patched","severity":"high","sourceUrl":"https://fortiguard.fortinet.com/psirt/cvrf/FG-IR-26-187","status":"live","title":"Fortinet PSIRT advisory confirms Node.js CVE-2026-105482/105483/106069/111497 affect Node.js 26.x, 24.x and 22.x with high severity ratings","url":"https://helix.ml/threat-watch/i/node-js-october-2026-security-releases-fix-dns-truncation-tls-hostname-bypasses-brotli-rce-and-http-keep-alive-flaws-cve"},{"body":null,"category":"patch","date":"2026-10-26","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"patch","patchStatus":"partial","severity":"critical","sourceUrl":"https://seclists.org/oss-sec/2026/q4/392","status":"live","title":"Custom PHP 5.4.23 backported patch released for PHP2Shell OOM vulnerability (CVE-2026-109618) for out-of-support PHP 5.x forks","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-26","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Node2Shell / HTTP2Shell: Brotli decoder flaw lets attackers run code in Node.js, Bun, Python and other HTTP software (CVE-2026-111497)","kind":"patch","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/","status":"live","title":"HTTP2Shell Brotli flaw (CVE-2026-111497) triggers emergency patches; git-remote-https also vulnerable when libcurl is built with brotli support","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-26","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.theregister.com/security/2026/10/26/partner-content-no-login-no-app-code-no-warning-what-next/5305336","status":"live","title":"PHP2Shell coverage details exploitation progress and remediation guidance for the two critical unauthenticated PHP RCE flaws","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-26","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Node2Shell / HTTP2Shell: Brotli decoder flaw lets attackers run code in Node.js, Bun, Python and other HTTP software (CVE-2026-111497)","kind":"patch","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-emergency-net-patches-for-critical-brotli-flaw/","status":"live","title":"Microsoft ships emergency .NET patches for the Brotli flaw now widely tracked as Broccoli2Shell (also Node2Shell/HTTP2Shell)","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-26","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"victim","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.securityweek.com/industrial-vendors-check-products-for-php2shell-vulnerabilities/","status":"live","title":"Industrial vendors (Siemens, Schneider Electric, ABB and others) confirm products affected by PHP2Shell vulnerabilities","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-26","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.securityweek.com/php2shell-exploitation-moves-from-probes-to-working-shells/","status":"live","title":"PHP2Shell exploitation escalates from probes to working shells — 35 successful shells launched against honeypots on October 24","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-26","incident":"wasmtime-cranelift-bit-packing-overflow-enables-sandbox-escape-via-crafted-wasm-module-cve-2026-115889","incidentTitle":"Wasmtime: two critical Cranelift sandbox-escape flaws let malicious Wasm modules break out (CVE-2026-115889, CVE-2026-115893)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html","status":"live","title":"Wasmtime maintainers disclose a second critical sandbox-escape flaw alongside CVE-2026-115889, with one flaw affecting only ARM64 builds","url":"https://helix.ml/threat-watch/i/wasmtime-cranelift-bit-packing-overflow-enables-sandbox-escape-via-crafted-wasm-module-cve-2026-115889"},{"body":"Help Net Security (2026-10-26) reports that Fortinet's hardening releases fix critical and high-severity flaws uncovered with AI models and validated by humans, and that full details come on 2026-11-10.","category":"patch","date":"2026-10-26","incident":"fortios-fortimanager-fortianalyzer-fortimail-fortiauthenticator-critical-high-severity-flaws-found-with-ai-assistance-de","incidentTitle":"Fortinet: critical/high fixes in FortiOS, FortiManager, FortiAnalyzer, FortiMail, FortiAuthenticator (Nov 10)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.helpnetsecurity.com/2026/10/26/fortinet-patches-critical-fortios-flaws-found-with-ai-help/","status":"live","title":"Help Net Security reports Fortinet's AI-assisted discovery of critical and high fixes, with details due 2026-11-10","url":"https://helix.ml/threat-watch/i/fortios-fortimanager-fortianalyzer-fortimail-fortiauthenticator-critical-high-severity-flaws-found-with-ai-assistance-de"},{"body":null,"category":"patch","date":"2026-10-26","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Node2Shell / HTTP2Shell: Brotli decoder flaw lets attackers run code in Node.js, Bun, Python and other HTTP software (CVE-2026-111497)","kind":"patch","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.securityweek.com/node2shell-brotli-flaw-triggers-patching-across-microsoft-node-js-python-packages/","status":"live","title":"Node2Shell Brotli flaw triggers patching across Microsoft (.NET, PowerShell), Node.js and Python packages","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-26","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://securityaffairs.com/201748/hacking/php2shell-suspected-north-korean-campaign-targets-216-vulnerable-php-hosts.html","status":"live","title":"PHP2Shell mass scanning of 216 vulnerable hosts linked to suspected North Korean campaign using AI-ranked public exploits","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-26","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/","status":"live","title":"PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619) now confirmed successfully exploited in the wild","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":"Evidence: Amazon Threat Intelligence says it detected an attempt to exploit PHP2Shell on October 17, four days before patches were released.","category":"patch","date":"2026-10-26","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"correction","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749","status":"live","title":"Breach date set to 2026-10-17 (per cited source)","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-26","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Node2Shell / HTTP2Shell: Brotli decoder flaw lets attackers run code in Node.js, Bun, Python and other HTTP software (CVE-2026-111497)","kind":"disclosure","patchStatus":"partial","severity":"critical","sourceUrl":"https://seclists.org/oss-sec/2026/q4/389","status":"live","title":"Brotli CVE-2026-111497 impact list expanded: dozens more affected projects including Chromium, Firefox, .NET, PHP, Ruby, DuckDB, ClickHouse; upstream fix commit published","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-26","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"patch","patchStatus":"partial","severity":"critical","sourceUrl":"https://seclists.org/oss-sec/2026/q4/386","status":"live","title":"Community backported patch for PHP2Shell OOM flaw (CVE-2026-109618) published for PHP 5.4-5.6, with debate on crash-vs-handle OOM handling","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-25","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Node2Shell / HTTP2Shell: Brotli decoder flaw lets attackers run code in Node.js, Bun, Python and other HTTP software (CVE-2026-111497)","kind":"advisory","patchStatus":"partial","severity":"critical","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497","status":"live","title":"MSRC confirms CVE-2026-111497 Brotli decoder out-of-bounds write also affects .NET, allowing network elevation of privilege","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-25","incident":"microsoft-october-2026-patch-tuesday-fixes-1-413-cves-incl-two-zero-days-one-actively-exploited-cve-2026-96951-cve-2026","incidentTitle":"October 2026 Patch Tuesday: Microsoft — record 1,413+ CVE batch incl. two zero-days, Outlook RCE, iSCSI/RDP RCEs, SharePoint EoP/XSS, Visio RCE","kind":"patch","patchStatus":"patched","severity":"critical","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85905","status":"closed","title":"October 2026 Patch Tuesday MSRC release adds 20 more Windows CVEs, including DNS Server network RCEs (CVE-2026-85903, CVE-2026-83889) and multiple local EoP/info-disclosure flaws","url":"https://helix.ml/threat-watch/i/microsoft-october-2026-patch-tuesday-fixes-1-413-cves-incl-two-zero-days-one-actively-exploited-cve-2026-96951-cve-2026"},{"body":null,"category":"patch","date":"2026-10-25","incident":"microsoft-october-2026-patch-tuesday-fixes-1-413-cves-incl-two-zero-days-one-actively-exploited-cve-2026-96951-cve-2026","incidentTitle":"October 2026 Patch Tuesday: Microsoft — record 1,413+ CVE batch incl. two zero-days, Outlook RCE, iSCSI/RDP RCEs, SharePoint EoP/XSS, Visio RCE","kind":"patch","patchStatus":"patched","severity":"critical","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83935","status":"closed","title":"October 2026 Patch Tuesday MSRC advisories detail additional Windows and Microsoft component fixes: XML and GDI+ RCEs, RPC Runtime network RCE, OpenSSH for Windows path traversal RCE, Hyper-V RCE, and numerous kernel/service EoP and info-disclosure flaws (CVE-2026-83935, CVE-2026-83934, CVE-2026-83910, CVE-2026-83923, CVE-2026-83931 et al.)","url":"https://helix.ml/threat-watch/i/microsoft-october-2026-patch-tuesday-fixes-1-413-cves-incl-two-zero-days-one-actively-exploited-cve-2026-96951-cve-2026"},{"body":null,"category":"patch","date":"2026-10-25","incident":"microsoft-october-2026-patch-tuesday-fixes-1-413-cves-incl-two-zero-days-one-actively-exploited-cve-2026-96951-cve-2026","incidentTitle":"October 2026 Patch Tuesday: Microsoft — record 1,413+ CVE batch incl. two zero-days, Outlook RCE, iSCSI/RDP RCEs, SharePoint EoP/XSS, Visio RCE","kind":"patch","patchStatus":"patched","severity":"critical","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88079","status":"closed","title":"October 2026 Patch Tuesday batch expanded with additional MSRC advisories: Windows Installer EoP set, RMCAST pre-auth adjacent-network RCE (CVE-2026-69789), Hyper-V security bypass, Winlogon, WSL, MSMQ and Linux kernel EoP fixes","url":"https://helix.ml/threat-watch/i/microsoft-october-2026-patch-tuesday-fixes-1-413-cves-incl-two-zero-days-one-actively-exploited-cve-2026-96951-cve-2026"},{"body":null,"category":"patch","date":"2026-10-25","incident":"microsoft-october-2026-patch-tuesday-fixes-1-413-cves-incl-two-zero-days-one-actively-exploited-cve-2026-96951-cve-2026","incidentTitle":"October 2026 Patch Tuesday: Microsoft — record 1,413+ CVE batch incl. two zero-days, Outlook RCE, iSCSI/RDP RCEs, SharePoint EoP/XSS, Visio RCE","kind":"patch","patchStatus":"patched","severity":"critical","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88149","status":"closed","title":"October 2026 Patch Tuesday batch expanded with 20 additional Windows/Office CVEs, including network-reachable BITS and NFS RCE flaws (CVE-2026-88142, CVE-2026-88121, CVE-2026-88115)","url":"https://helix.ml/threat-watch/i/microsoft-october-2026-patch-tuesday-fixes-1-413-cves-incl-two-zero-days-one-actively-exploited-cve-2026-96951-cve-2026"},{"body":null,"category":"patch","date":"2026-10-25","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html","status":"live","title":"PHP2Shell exploitation hits a European government entity with post-exploitation via agentic AI platforms amid global scanning","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-25","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"advisory","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell","status":"live","title":"Aikido publishes guidance on affected PHP versions, patches and mitigations for the actively exploited PHP2Shell RCE flaws (CVE-2026-109618, CVE-2026-109619)","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-25","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Node2Shell / HTTP2Shell: Brotli decoder flaw lets attackers run code in Node.js, Bun, Python and other HTTP software (CVE-2026-111497)","kind":"advisory","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.wiz.io/blog/cve-2026-111497-brotli-rce-node-js","status":"live","title":"Wiz publishes analysis of CVE-2026-111497, now widely referred to as Broccoli2shell, with detection and mitigation guidance","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":"AI editor revision: PAN-OS CVE-2026-0322 clarified as authenticated RCE in the Management Interface (HIGH severity)","category":"patch","date":"2026-10-25","incident":"palo-alto-networks-pan-os-cve-2026-0322","incidentTitle":"PAN-OS: Authenticated RCE in Management Interface Allows Root Code Execution (CVE-2026-0322)","kind":"status","patchStatus":"patched","severity":"high","sourceUrl":null,"status":"closed","title":"Patch status changed from unknown to patched","url":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2026-0322"},{"body":null,"category":"patch","date":"2026-10-25","incident":"palo-alto-networks-pan-os-cve-2026-0322","incidentTitle":"PAN-OS: Authenticated RCE in Management Interface Allows Root Code Execution (CVE-2026-0322)","kind":"advisory","patchStatus":"patched","severity":"high","sourceUrl":"https://security.paloaltonetworks.com/CVE-2026-0322","status":"closed","title":"PAN-OS CVE-2026-0322 clarified as authenticated RCE in the Management Interface (HIGH severity)","url":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2026-0322"},{"body":null,"category":"patch","date":"2026-10-25","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Node2Shell / HTTP2Shell: Brotli decoder flaw lets attackers run code in Node.js, Bun, Python and other HTTP software (CVE-2026-111497)","kind":"correction","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497","status":"live","title":"Reframed as Node2Shell / HTTP2Shell: the incident was first written from the PyPI Brotli advisory alone; the same flaw affects Node.js, Bun, Python, libbrotli, curl, Envoy and Istio. Patch status set to partial while vendors ship fixes.","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":"Reframed after review: first drafted from the PyPI advisory alone","category":"patch","date":"2026-10-25","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Node2Shell / HTTP2Shell: Brotli decoder flaw lets attackers run code in Node.js, Bun, Python and other HTTP software (CVE-2026-111497)","kind":"status","patchStatus":"partial","severity":"critical","sourceUrl":null,"status":"live","title":"Patch status changed from patched to partial","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-25","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Node2Shell / HTTP2Shell: Brotli decoder flaw lets attackers run code in Node.js, Bun, Python and other HTTP software (CVE-2026-111497)","kind":"advisory","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497","status":"live","title":"Node2Shell evolves to HTTP2Shell: CVE-2026-111497 blast radius extends to libraries/apps using HTTP with Brotli","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-25","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Node2Shell / HTTP2Shell: Brotli decoder flaw lets attackers run code in Node.js, Bun, Python and other HTTP software (CVE-2026-111497)","kind":"advisory","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497","status":"live","title":"Node2Shell: Node.js Brotli flaw CVE-2026-111497 enables remote code execution","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-25","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Node2Shell / HTTP2Shell: Brotli decoder flaw lets attackers run code in Node.js, Bun, Python and other HTTP software (CVE-2026-111497)","kind":"advisory","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497","status":"live","title":"Node2Shell Brotli flaw (CVE-2026-111497) expands to HTTP2Shell, affecting libraries and apps using HTTP with Brotli","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":"Researcher Erica Windisch lab-tested Tailscale v1.104.2 and headscale v0.29.5 on 2026-10-22 to 2026-10-24 and published without coordinated disclosure. The report recommends disabling Tailscale SSH and App Connectors.","category":"patch","date":"2026-10-24","incident":"tailworm-tailscale-ssh-socket-forwarding-flaws-let-trusted-device-attackers-reach-root-only-sockets-no-cve","incidentTitle":"Tailworm: Tailscale SSH unix-socket forwarding gives policy-permitted peers root-only sockets; fixed in 1.104.4 (TS-2026-014)","kind":"disclosure","patchStatus":"partial","severity":"high","sourceUrl":"https://tailworm.com/","status":"live","title":"Cyberdione Labs publishes the Tailworm report (11 findings) about two hours after sending it to Tailscale","url":"https://helix.ml/threat-watch/i/tailworm-tailscale-ssh-socket-forwarding-flaws-let-trusted-device-attackers-reach-root-only-sockets-no-cve"},{"body":null,"category":"patch","date":"2026-10-24","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://securityaffairs.com/201662/hacking/pierluigi-paganini-answers-questions-about-the-php2shell-flaws.html","status":"live","title":"New interview details confirm PHP2Shell exploitation began four days before public disclosure","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-24","incident":"collabora-collabora-online-built-in-code-server-cve-2026-110447","incidentTitle":"Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (CVE-2026-110447)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://securityaffairs.com/201652/security/u-s-cisa-adds-collabora-online-flaw-to-its-known-exploited-vulnerabilities-catalog.html","status":"live","title":"CISA adds Collabora Online CVE-2026-110447 to Known Exploited Vulnerabilities catalog","url":"https://helix.ml/threat-watch/i/collabora-collabora-online-built-in-code-server-cve-2026-110447"},{"body":null,"category":"patch","date":"2026-10-24","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Node2Shell / HTTP2Shell: Brotli decoder flaw lets attackers run code in Node.js, Bun, Python and other HTTP software (CVE-2026-111497)","kind":"patch","patchStatus":"partial","severity":"critical","sourceUrl":"https://seclists.org/oss-sec/2026/q4/373","status":"live","title":"Brotli v1.2.1 released fixing CVE-2026-111497; downstream releases tracked via patchtheplanet","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-24","incident":"arista-velocloud-orchestrator-cve-2026-114625","incidentTitle":"Arista VeloCloud Orchestrator SQL Injection Vulnerability (CVE-2026-114625)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://securityaffairs.com/201609/hacking/u-s-cisa-adds-arista-velocloud-orchestrator-flaw-to-its-known-exploited-vulnerabilities-catalog.html","status":"live","title":"CISA adds Arista VeloCloud Orchestrator SQL injection (CVE-2026-114625, CVSS 9.4) to its Known Exploited Vulnerabilities catalog","url":"https://helix.ml/threat-watch/i/arista-velocloud-orchestrator-cve-2026-114625"},{"body":null,"category":"patch","date":"2026-10-24","incident":"collabora-collabora-online-built-in-code-server-cve-2026-110447","incidentTitle":"Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (CVE-2026-110447)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html","status":"live","title":"CISA adds Collabora Online CODE Server CVE-2026-110447 to KEV citing active exploitation","url":"https://helix.ml/threat-watch/i/collabora-collabora-online-built-in-code-server-cve-2026-110447"},{"body":"PRs #1989 (merged 2026-10-22) and #1990 (merged 2026-10-23). Amazon rates the bug 8.3 (adjacent network); Amazon Linux 2 edk2 pending fix, AL2023 not affected.","category":"patch","date":"2026-10-23","incident":"cve-2026-97631-tianocore-edk-ii-uefi-pxe-driver-16-year-old-buffer-overflow-allows-pre-os-code-execution-during-network","incidentTitle":"TianoCore EDK II PXE driver: ICMP error overflow gives pre-boot code execution on network-booting machines (CVE-2026-97631)","kind":"patch","patchStatus":"partial","severity":"critical","sourceUrl":"https://github.com/microsoft/mu_basecore/pull/1990","status":"closed","title":"Microsoft Project Mu backports the fix to mu_basecore release/202608 and release/202511","url":"https://helix.ml/threat-watch/i/cve-2026-97631-tianocore-edk-ii-uefi-pxe-driver-16-year-old-buffer-overflow-allows-pre-os-code-execution-during-network"},{"body":null,"category":"patch","date":"2026-10-23","incident":"tailworm-tailscale-ssh-socket-forwarding-flaws-let-trusted-device-attackers-reach-root-only-sockets-no-cve","incidentTitle":"Tailworm: Tailscale SSH unix-socket forwarding gives policy-permitted peers root-only sockets; fixed in 1.104.4 (TS-2026-014)","kind":"other","patchStatus":"partial","severity":"high","sourceUrl":"https://tailscale.com/blog/tailscale-ssh-findings-fixes","status":"live","title":"Concerns about Tailscale SSH circulate on social media; Tailscale opens an investigation","url":"https://helix.ml/threat-watch/i/tailworm-tailscale-ssh-socket-forwarding-flaws-let-trusted-device-attackers-reach-root-only-sockets-no-cve"}],"feeds":{"changes":"https://helix.ml/threat-watch/c/patch/changes.json","json":"https://helix.ml/threat-watch/c/patch/feed.json","llms":"https://helix.ml/threat-watch/c/patch/llms.txt","page":"https://helix.ml/threat-watch?c=patch","rss":"https://helix.ml/threat-watch/c/patch/feed.xml"},"generatedAt":"2026-10-30T06:06:08Z","site":"https://helix.ml/threat-watch"}