THREAT INTELLIGENCE BRIEF·Tuesday, October 27, 2026

Executive brief

The most urgent threat is the active exploitation of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Both have been added to the CISA KEV list, indicating confirmed exploitation in the wild, and have near-perfect EPSS scores suggesting a very high probability of further exploitation. A widespread supply chain vulnerability in the Brotli compression library, dubbed Node2Shell, also requires attention, as it impacts numerous development ecosystems including Node.js, Python, and .NET. Other significant threats include an ongoing supply chain attack harvesting developer credentials from GitHub repositories, a major data breach at the University of Copenhagen, and a critical flaw in the Microsoft Authenticator app for Android.

54 articles analysed
3 CVEs mentioned
Email Brief

Threat Categories

Vulnerabilities3
Supply Chain1
Data Breach1

Article Analyses (5)

[CRITICAL] "CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution"

critical
CVE-2026-109618
KEVEPSS 100.0%PoC

Details

Two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively tracked as PHP2Shell, allow for unauthenticated remote code execution. Both vulnerabilities are rated 9.2 on the CVSS scale. CISA has confirmed active exploitation by adding both to its Known Exploited Vulnerabilities (KEV) catalog.

Affected Systems

PHP deployments. Specific versions affected are not detailed in the articles but updates should be applied across all environments.

Potential Impact

Complete system compromise through unauthenticated remote code execution, leading to data theft, malware deployment, or lateral movement within the network.

Mitigations

Immediately apply the latest PHP security patches. Per CISA's KEV directive, federal agencies are required to patch these vulnerabilities. All organizations should prioritize patching immediately.

The Hacker NewsDraft Post

[CRITICAL] "Node2Shell: Brotli Flaw Hits Python Packages"

critical
CVE-2026-111497
EPSS 36.0%

Details

A critical out-of-bounds write vulnerability (CVE-2026-111497) in Google's Brotli compression C decoder library can lead to memory corruption and potential remote code execution. This is a supply chain vulnerability affecting numerous packages and applications that use the library for decompression, particularly in handling HTTP responses.

Affected Systems

Multiple ecosystems are impacted, including: Node.js, Python (via PyPI Brotli and brotlicffi packages used by 'requests', 'httpx', 'aiohttp'), Microsoft .NET, PowerShell, and PHP (Windows packages using the cURL extension).

Potential Impact

An attacker could craft a malicious compressed data stream (e.g., an HTTP response) that, when processed by a vulnerable application, could lead to denial of service or arbitrary code execution.

Mitigations

Emergency patches have been released across affected ecosystems. Update Node.js, Microsoft .NET, and relevant Python and PHP packages to the latest versions. Review dependencies to identify any applications using vulnerable versions of the Brotli library.

SOC RadarDraft Post

[CRITICAL] "'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets"

critical

Details

An ongoing supply chain attack, dubbed 'Gheist', is actively harvesting credentials and sensitive data from thousands of developer repositories on GitHub. The attack weaponizes GitHub tokens to gain access and exfiltrate cloud secrets and other sensitive information stored within the codebases.

Affected Systems

Public and private code repositories on GitHub, particularly those containing sensitive information such as API keys, credentials, and cloud service tokens.

Potential Impact

Compromise of cloud infrastructure, unauthorized access to sensitive data and services, and further supply chain attacks originating from compromised developer accounts and code.

Mitigations

The source article does not specify mitigation actions. General best practices for this type of threat include auditing repository access logs, rotating all credentials, implementing secrets scanning tools, and enforcing multi-factor authentication.

Dark ReadingDraft Post

[HIGH] "Microsoft Authenticator vulnerability let rogue Android apps steal work account access"

high

Details

A vulnerability discovered in the Microsoft Authenticator app for Android allows any other application on the same device to quietly take over a user's work account. The malicious app does not require special permissions, and no user interaction is needed for the takeover to occur. The flaw abuses the app's function as an account 'broker' for other Microsoft apps like Teams and Outlook.

Affected Systems

Microsoft Authenticator app on the Android platform.

Potential Impact

Complete compromise of a user's Microsoft 365 work account, leading to unauthorized access to email, corporate documents, and other sensitive enterprise resources.

Mitigations

Ensure all users update their Microsoft Authenticator app on Android devices to the latest version immediately through the Google Play Store.

Help Net SecurityDraft Post

[CRITICAL] "University of Copenhagen data breach exposes data of 525,000 people"

critical

Details

The University of Copenhagen confirmed a significant data breach where hackers gained access to one of its test environments. This environment contained the personal data of 525,000 individuals.

Affected Systems

A test environment server at the University of Copenhagen.

Potential Impact

The exposed personal data could be used for identity theft, phishing campaigns, and other fraudulent activities targeting the affected individuals. Reputational damage to the university is also significant.

Mitigations

The source article describes a past event and does not list mitigation actions. This incident serves as a reminder to enforce strict data governance and security controls on non-production environments, ensuring they are properly isolated and do not contain sensitive production data.

BleepingComputerDraft Post