#cisa

A flaw in Google's reference C decoder for Brotli, the compression format many websites use, lets crafted compressed data write past the end of a buffer, which can crash a program, leak memory or, in some setups, run code. Node.js disclosed it on October 21 with credit to OpenAI's Codex Security researchers; the fix was in Brotli's source in February, but nobody knew then it was a security bug, The Register reports.

This week the fallout spread. Microsoft shipped out-of-band .NET updates on October 25, and Palo Alto Networks rolled out hotfixes for PAN-OS firewalls that inspect Brotli traffic. According to the Broccoli2Shell site, threat-intelligence firm ELLIO saw exploit traffic using the public proof of concept on October 26, and CISA added CVE-2026-111497 to its exploited-vulnerabilities catalog on October 27.

Anything that decompresses Brotli data from others with Brotli 1.0.3 to 1.2.0 can be exposed, including Node's built-in fetch and Python's requests when a Brotli package is installed. Patched programs must also be restarted, and container images rebuilt.

New this week on PHP2Shell, the two critical PHP flaws patched on October 21: on Monday, October 26, the US Cybersecurity and Infrastructure Security Agency (CISA) added both (CVE-2026-109618 and CVE-2026-109619) to its catalog of exploited vulnerabilities and gave federal agencies until October 29 to patch, The Register reports. A Perplexity researcher logged successful shell commands on honeypots, while Sophos and Palo Alto Networks walked back earlier claims of successful attacks.

On October 28, Israeli security company Dream said it had recovered the tools of a suspected Chinese, apparently AI-assisted campaign that chained a custom PHP2Shell exploit with a Linux kernel bug (Fragnesia, CVE-2026-46300) to get root on 25 Palo Alto Networks PAN-OS firewalls and management servers in the US, Japan, Taiwan and South Korea. From a US government-affiliated firewall, Dream says, the attackers moved into the internal network and went after Active Directory. Palo Alto's Unit 42 independently verified the tooling, and Palo Alto is releasing fixed PAN-OS versions.

Admins are told to move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and to keep management interfaces off the internet.

CISA, the FBI, the U.S. Secret Service and partners in Germany and the UK released a joint advisory on October 20 about SafePay, which CISA calls one of the most active ransomware groups. It says SafePay has affected businesses and critical infrastructure in North America, South America, Europe and Australia, including at least 600 critical-infrastructure organizations since August 2024.

The advisory says SafePay gets in through exposed credentials, brute-force password attacks and VPN access, particularly from IP addresses of the VPN provider Mullvad, and by exploiting known flaws in edge devices. BleepingComputer adds that SafePay works without affiliates, steals data before encrypting it and threatens to leak it, and may delete shadow copies and reset backup storage to hamper recovery.

The agencies recommend multifactor authentication, limiting admin tools and privileges, and patching VPNs, firewalls and other edge devices, and say paying a ransom does not guarantee files come back.

CISA warned on October 21 that attackers are actively exploiting four vulnerabilities in Plex Media Server, the popular software people use to stream their own movies, music and photos. Chained together as "Plex2Shell," they let an attacker obtain the owner's admin token and run code with elevated privileges, BleepingComputer reports.

Researcher Zach Main reported the flaws to Plex on July 27, published technical details on October 16 and a proof-of-concept exploit three days later. Reports of exploitation began on October 17, at first against Plex honeypots to install a cryptominer. The researcher rates the full chain 9.8 out of 10.

Plex Media Server versions before 1.43.3.10861, released August 4, are affected. CISA gave federal agencies until October 23 to patch. In the same update CISA added exploited flaws in Siemens Software Center and the SiteGuard Server Edition web application firewall to its catalog.