CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw

CISA has updated a new alert to reflect the addition of CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 26, 2026.

CISA urges organizations to quickly fix the recently found serious flaws in PHP, CVE-2026-109618 and CVE-2026-109619. These flaws, called “php2shell,” let remote code run in PHP without authentication.

• Alert

CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw

By infosecbulletin / Tuesday , October 27 2026

CISA has updated a new alert to reflect the addition of CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV)...

Read More

• Alert

Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw

By infosecbulletin / Monday , October 26 2026

Cloudflare has shared an urgent update to its Web Application Firewall (WAF) rules due to CVE-2026-111497, a Brotli issue. The release...

Read More

• Daily Security Update
• Data Breach

Daily Cyber security update for 26.10. 2026

By infosecbulletin / Monday , October 26 2026

Cyberattacks are rising around the world, including ransomware, malware, data leaks, and hacked websites. These events show how complex and...

Read More

• Hot Topic

The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours

By infosecbulletin / Monday , October 26 2026

AI startup Cathedral gained a limited access to internal systems at Anthropic in less than 12 hours, exposing employee information,...

Read More

• Daily Security Update
• Data Breach

Daily Cyber security update for 25. 10. 2026

By infosecbulletin / Sunday , October 25 2026

Cyberattacks are rising around the world, including ransomware, malware, data leaks, and hacked websites. These events show how complex and...

Read More

• Daily Security Update
• Data Breach

Daily Cyber security update for 24. 10. 2026

By infosecbulletin / Saturday , October 24 2026

Cyberattacks are rising around the world, including ransomware, malware, data leaks, and hacked websites. These events show how complex and...

Read More

• Alert

PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation

By infosecbulletin / Friday , October 23 2026

The PHP security team shared ways to protect against a new flaw that lets someone run unwanted code on certain...

Read More

• Hot Topic

US banks faced unauthorized access by AI agents in customer accounts: Axios reports

By infosecbulletin / Friday , October 23 2026

Major US banks have detected unauthorized access to customer accounts by third-party AI agents, with some systems taking actions beyond...

Read More

• Alert

Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager

By infosecbulletin / Thursday , October 22 2026

Fortinet has urged customers to prioritize security updates for FortiOS, FortiManager, and FortiAnalyzer scheduled for October 22, 2026. The coordinated...

Read More

• Cyber Attack
• Data Breach

Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed

By infosecbulletin / Wednesday , October 21 2026

Hacker offers to sell Rajasthan Government’s Department of Information Technology & Communication (DoIT&C) data in a underground forum. The threat...

Read More

PHP Releases Windows Build Security Updates

PHP unveiled new Windows builds to fix a serious flaw dubbed HTTP2Shell. The new packages are PHP 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, and PHP announced them on October 26, 2026.

Each build now includes Brotli 1.2.1, which fixes CVE-2026-111497. Windows users running PHP should install these packages right away.

The flaw is in Google’s Brotli library. This is a tool that many programs use to unpack data. It has an out-of-bounds write issue, meaning the code writes past the memory area it should use. Node.js shared the bug in its security update on October 21, and researchers first named it Node2Shell.

Administrators should look for a different security update that PHP released on October 21. This update fixed two serious problems, CVE-2026-109618 and CVE-2026-109619, which can let bad actors run code without logging in. PHP 8.2 will no longer be supported after December 31, 2026, so teams using it should prepare to upgrade to a newer version.

Related news:

PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
Update now! PHP2Shell: Critical PHP vulnerabilities patched