THREAT INTELLIGENCE BRIEF·Wednesday, October 28, 2026·Generated summary

Executive brief

The highest priority threat is the active exploitation of two PHP vulnerabilities, collectively tracked as PHP2Shell (CVE-2026-109618, CVE-2026-109619). Both are confirmed by CISA as actively exploited, have a perfect EPSS exploitation probability score of 1.0, and public exploit code is widely available. Also requiring immediate attention are actively exploited vulnerabilities in Google's Brotli compression library (CVE-2026-111497) and Apple's CoreGraphics framework (CVE-2026-86950), both of which are on the CISA KEV list. Critical-severity sandbox escape flaws in Wasmtime and a token-stealing flaw in Microsoft Authenticator for Android round out the top five most significant threats.

54 articles analysed7 CVEs mentioned

Threat Categories

Vulnerabilities5

Article Analyses (5)

CISA confirms PHP2Shell vulnerabilities now exploited in attacks

critical

KEVEPSS 100.0%PoC

Details

Two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, are being actively exploited in the wild. CISA has added both to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. The vulnerabilities have a perfect EPSS score, indicating an extremely high probability of exploitation. Public proof-of-concept exploit code is readily available, lowering the barrier for attackers.

Affected Systems

PHP-based systems. Specific versions are not detailed in the articles but should be investigated immediately.

Potential Impact

Successful exploitation can lead to remote code execution, server compromise, data extortion, and deployment of further malware. The vulnerabilities have already been linked to an extortion campaign against Japanese real estate websites.

Mitigations

Immediately patch all PHP instances. Federal agencies are required to patch systems by the CISA-mandated due date. Prioritize patching on all public-facing servers.

BleepingComputer Draft Post

Brotli bug reaches far beyond Node.js (CVE-2026-111497)

critical

CVE-2026-111497

KEVEPSS 55.5%PoC

Details

A remotely exploitable out-of-bounds write vulnerability, CVE-2026-111497, exists in Google's widely used Brotli compression library. An attacker can supply malicious Brotli-compressed data to an application, which upon decompression can corrupt process memory, leading to a crash or arbitrary code execution. CISA has confirmed this vulnerability is actively exploited, and public exploit code is available.

Affected Systems

Any software using the vulnerable Brotli library for decompression, with Node.js being a prominent example (via node:zlib). The impact is widespread due to Brotli's common use in web servers, browsers, and other applications.

Potential Impact

Remote code execution on servers and applications that decompress attacker-supplied data. This could lead to system compromise, data breaches, and denial of service.

Mitigations

Update all applications and systems that use the Brotli library. Identify all instances of the Brotli library in the environment and apply patches from respective vendors.

Help Net Security Draft Post

Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads

medium

CVE-2026-86950

KEVEPSS 26.2%

Details

An out-of-bounds write vulnerability (CVE-2026-86950) in Apple's CoreGraphics framework is being actively exploited. The flaw can be triggered when processing a maliciously crafted file, leading to arbitrary code execution. CISA has added this to the KEV list. Apple considers this a zero-day and has backported the fix to older devices, indicating a high risk to a wide range of products.

Affected Systems

Apple iOS, iPadOS, and macOS. Patches were released in iOS/macOS 27.2 and backported to older versions like iOS 18.

Potential Impact

Compromise of user devices (iPhones, iPads, Macs) through maliciously crafted files (e.g., images, documents). This can lead to theft of sensitive personal and corporate data, credential theft, and installation of persistent spyware.

Mitigations

Ensure all Apple devices are updated to the latest patched versions of iOS, iPadOS, and macOS.

The Hacker News Draft Post

[CRITICAL] "Wasmtime Sandbox Escape Flaws Patched in Cranelift"

critical

CVE-2026-115889 CVE-2026-115893

EPSS 0.4%

Details

Two critical sandbox escape vulnerabilities, CVE-2026-115889 and CVE-2026-115893, were discovered in Wasmtime. A specially crafted WebAssembly (Wasm) module can cause the Cranelift compiler to generate unsafe machine code, allowing an attacker to break out of the Wasm sandbox. Both vulnerabilities have a CVSS score of 9.9. Currently, there is no evidence of active exploitation or public PoC code.

Affected Systems

Platforms that compile and run Wasm modules from untrusted third-party sources using the Wasmtime runtime.

Potential Impact

An attacker could escape the sandbox and execute arbitrary code on the host system, compromising the underlying infrastructure. This is especially dangerous in multi-tenant cloud environments where Wasm is used for isolation.

Mitigations

Update to the patched version of Wasmtime released by the Bytecode Alliance on October 19, 2026. Review all applications that process external Wasm modules.

SOC Radar Draft Post

Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens

high

CVE-2026-80097

EPSS 0.5%

Details

A vulnerability in the Microsoft Authenticator app for Android (CVE-2026-80097) could allow a malicious, permissionless application on the same device to impersonate a trusted Microsoft app. This could trick a user into approving a sign-in, sending the resulting access tokens for their work account to the malicious app.

Affected Systems

Microsoft Authenticator for Android versions prior to 6.2606.4246.

Potential Impact

Compromise of corporate user accounts, leading to unauthorized access to enterprise resources, data breaches, and potential lateral movement within the corporate network.

Mitigations

Ensure all users update their Microsoft Authenticator app on Android devices to version 6.2606.4246 or later. Mobile Device Management (MDM) solutions can be used to enforce application version policies.

The Hacker News Draft Post

Generated by gemini-2.5-pro