THREAT INTELLIGENCE BRIEF·Tuesday, October 27, 2026·Generated summary

Executive brief

The most urgent threat is the active exploitation of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Both have been added to the CISA KEV list, indicating confirmed exploitation in the wild, and have near-perfect EPSS scores suggesting a very high probability of further exploitation. A widespread supply chain vulnerability in the Brotli compression library, dubbed Node2Shell, also requires attention, as it impacts numerous development ecosystems including Node.js, Python, and .NET. Other significant threats include an ongoing supply chain attack harvesting developer credentials from GitHub repositories, a major data breach at the University of Copenhagen, and a critical flaw in the Microsoft Authenticator app for Android.

54 articles analysed3 CVEs mentioned

Threat Categories

Vulnerabilities3

Supply Chain1

Data Breach1

Article Analyses (5)

[CRITICAL] "CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution"

critical

CVE-2026-109618

KEVEPSS 100.0%PoC

Details

Two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively tracked as PHP2Shell, allow for unauthenticated remote code execution. Both vulnerabilities are rated 9.2 on the CVSS scale. CISA has confirmed active exploitation by adding both to its Known Exploited Vulnerabilities (KEV) catalog.

Affected Systems

PHP deployments. Specific versions affected are not detailed in the articles but updates should be applied across all environments.

Potential Impact

Complete system compromise through unauthenticated remote code execution, leading to data theft, malware deployment, or lateral movement within the network.

Mitigations

Immediately apply the latest PHP security patches. Per CISA's KEV directive, federal agencies are required to patch these vulnerabilities. All organizations should prioritize patching immediately.

The Hacker News Draft Post

[CRITICAL] "Node2Shell: Brotli Flaw Hits Python Packages"

critical

CVE-2026-111497

EPSS 36.0%

Details

A critical out-of-bounds write vulnerability (CVE-2026-111497) in Google's Brotli compression C decoder library can lead to memory corruption and potential remote code execution. This is a supply chain vulnerability affecting numerous packages and applications that use the library for decompression, particularly in handling HTTP responses.

Affected Systems

Multiple ecosystems are impacted, including: Node.js, Python (via PyPI Brotli and brotlicffi packages used by 'requests', 'httpx', 'aiohttp'), Microsoft .NET, PowerShell, and PHP (Windows packages using the cURL extension).

Potential Impact

An attacker could craft a malicious compressed data stream (e.g., an HTTP response) that, when processed by a vulnerable application, could lead to denial of service or arbitrary code execution.

Mitigations

Emergency patches have been released across affected ecosystems. Update Node.js, Microsoft .NET, and relevant Python and PHP packages to the latest versions. Review dependencies to identify any applications using vulnerable versions of the Brotli library.

SOC Radar Draft Post

[CRITICAL] "'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets"

critical

Details

An ongoing supply chain attack, dubbed 'Gheist', is actively harvesting credentials and sensitive data from thousands of developer repositories on GitHub. The attack weaponizes GitHub tokens to gain access and exfiltrate cloud secrets and other sensitive information stored within the codebases.

Affected Systems

Public and private code repositories on GitHub, particularly those containing sensitive information such as API keys, credentials, and cloud service tokens.

Potential Impact

Compromise of cloud infrastructure, unauthorized access to sensitive data and services, and further supply chain attacks originating from compromised developer accounts and code.

Mitigations

The source article does not specify mitigation actions. General best practices for this type of threat include auditing repository access logs, rotating all credentials, implementing secrets scanning tools, and enforcing multi-factor authentication.

Dark Reading Draft Post

[HIGH] "Microsoft Authenticator vulnerability let rogue Android apps steal work account access"

high

Details

A vulnerability discovered in the Microsoft Authenticator app for Android allows any other application on the same device to quietly take over a user's work account. The malicious app does not require special permissions, and no user interaction is needed for the takeover to occur. The flaw abuses the app's function as an account 'broker' for other Microsoft apps like Teams and Outlook.

Affected Systems

Microsoft Authenticator app on the Android platform.

Potential Impact

Complete compromise of a user's Microsoft 365 work account, leading to unauthorized access to email, corporate documents, and other sensitive enterprise resources.

Mitigations

Ensure all users update their Microsoft Authenticator app on Android devices to the latest version immediately through the Google Play Store.

Help Net Security Draft Post

[CRITICAL] "University of Copenhagen data breach exposes data of 525,000 people"

critical

Details

The University of Copenhagen confirmed a significant data breach where hackers gained access to one of its test environments. This environment contained the personal data of 525,000 individuals.

Affected Systems

A test environment server at the University of Copenhagen.

Potential Impact

The exposed personal data could be used for identity theft, phishing campaigns, and other fraudulent activities targeting the affected individuals. Reputational damage to the university is also significant.

Mitigations

The source article describes a past event and does not list mitigation actions. This incident serves as a reminder to enforce strict data governance and security controls on non-production environments, ensuring they are properly isolated and do not contain sensitive production data.

BleepingComputer Draft Post

Generated by gemini-2.5-pro