10/21/2026-10/28/2026 Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages; Exploitation of Two PHP2Shell Flaws; Critical Flaw in Python’s Popular Pillow Image Library And More.

1. Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

A critical out-of-bounds write flaw in Google’s Brotli compression library, tracked as CVE-2026-111497 and dubbed Node2Shell, has prompted patches from Microsoft, Node.js and two Python packages. Bun, Envoy and Istio were also updated.

The bug affects Brotli 1.0.3 through 1.2.0 and carries a CVSS v4 score of 9.2. Fixes are in versions 1.0.10, 1.1.1 and 1.2.1. Specially crafted input can overflow a decoder buffer, causing crashes, memory leaks or, potentially, unauthenticated code execution. OpenAI Codex Security researchers found it during red-teaming. The root cause had been fixed in Brotli’s source in February, but no release followed.

Imperva demonstrated code execution on the official Node.js 24.22.0 Linux arm64 image, though not on every attempt, and has not published its exploit. Attacks require malicious Brotli data to reach the decoder, such as through compressed request bodies, untrusted server responses or files.

No in-the-wild exploitation has been reported. A public proof-of-concept works only against a deliberately weakened build, and some researchers argue the flaw enables only denial of service.

Microsoft’s October 25 updates cover .NET, Visual Studio and PowerShell. The Python packages Brotli and brotlicffi are patched. DuckDB, Apache Arrow, p7zip and others remain unpatched. Affected services must be restarted and container images rebuilt.

2. CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

CISA confirmed active exploitation of the recently patched PHP2Shell flaws, adding them to its KEV catalog. Both are rated 9.2 on the CVSS scale and allow unauthenticated remote code execution:

• CVE-2026-109618: out-of-memory corruption flaw
• CVE-2026-109619: stale internal request-state flaw

The listing follows Adel Karimi of Perplexity confirming successful remote code execution against honeypot systems on October 24. He noted the result applies to a favorable single-worker mod_php setup and does not measure exploit reliability elsewhere.

Fixes arrived October 21 in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Federal agencies must patch by October 29.

PHP runs roughly 70% of websites, and Censys estimates over 32.51 million PHP services still run affected versions. Dozens of vendors and agencies, including Dell, Citrix, Siemens, IBM, Drupal, and WordPress, have issued advisories.

Separately, the PHP Foundation released Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1 to fix CVE-2026-111497 (“Broccoli2Shell”), an out-of-bounds write in the Brotli decoder that can enable privilege escalation and remote code execution. It is reachable through the cURL extension only when automatic HTTP response decompression is enabled, which is off by default. Brotli 1.0.10, 1.1.1, and 1.2.1 contain the fix.

3. Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image

Pillow, Python’s most widely used image library, has a flaw that lets attackers run operating system commands on a server through a crafted filename. The bug, CVE-2026-112900, affects EPS handling: Pillow passes the filename to Ghostscript without checking it, and Ghostscript can treat an attacker-chosen name as instructions. It needs the gs program installed and affects versions 2.6.0 to 12.3.0.
Pillow 13.0.0, released October 16, is a large security release. It also fixes two critical-rated bugs: a stale-data memory flaw and JPEG decoding overflows, one of which allows code execution via a crafted FlashPix file. A TIFF overflow dating to 2013 affects saving to in-memory buffers. No attacks are known.

What to do: upgrade, rebuild bundled containers, and note that Pillow 13 requires Python 3.11 or newer.

pip install -U "Pillow>=13.0.0"

Until then: keep gs off hosts handling untrusted uploads, avoid draft() and thumbnail() on untrusted JPEGs, and treat in-memory TIFF saves of user images as risky.

4. Gheist Hackers Abuse GitHub Tokens to Steal Repository Secrets

A campaign dubbed “Gheist,” active since September 15, uses stolen GitHub tokens to plant workflows that print a repository’s secrets into its own log, download the log through the API, and delete the run within seconds. Wiz researchers recovered over 13,500 branches from more than 850 compromised accounts, including enterprise private repositories.

Each attack creates a “ci-sync-” branch with an unsigned commit that appears to come from the token’s owner. In enterprises, attackers cycled through tokens, cloned private repositories, and later used cloud credentials to enumerate AWS Secrets Manager.

Payloads keep evolving. One variant captures secrets from all deployment environments, often production credentials. On October 19, another began targeting self-hosted runners for tokens, private keys, cloud credentials, and Kubernetes tokens, though that job is buggy.

GitHub’s July 28 control, which holds suspicious workflow runs in public repositories until a collaborator approves them, has blocked every observed public attack. It doesn’t cover private repositories or GitHub Enterprise Server.

5. Tailscale Warns of SSH Flaws Allowing Root Privilege Escalation

Tailscale is racing to patch 11 unpatched vulnerabilities, collectively named Tailworm, that could allow credential theft, server crashes, and root-level code execution.
Cyberdione Labs found the flaws while auditing Tailscale 1.104.2 and the self-hosted headscale v0.29.5 control server. Founder Erica Windisch confirmed each was reproduced on unmodified, released software, and the researchers published the details, arguing that quick public awareness will speed remediation. The most critical bug sits in Tailscale’s SSH server. Through Unix-socket forwarding, an authorized attacker could gain root code execution on a target. Other flaws affect experimental app connectors (cloud metadata, internal network, and Kubernetes access), the DERP relay client (memory exhaustion), tailscale serve (administrative-API access and authorization bypasses), and headscale (an unauthenticated crash loop that blocks device onboarding).

Tailscale called the issues “serious,” noting exploitation depends on permissions and configuration. VP of Engineering Mike Shaver said the company does not recommend disabling Tailscale SSH entirely. Instead, Tailscale advises reviewing SSH access policies, limiting access to necessary users and devices, and disabling SSH forwarding by setting TS_SSH_DISABLE_FORWARDING=1 in the tailscaled environment and restarting the service, which mitigates several of the more serious findings.

Developers aim to release a fixed version by the end of Tuesday, October 27, and urge users to prepare to apply the patched client when available.

6. Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances

AI agents using the x402 SDKs could be tricked into signing a payment for their entire token balance, security firm V12 said on October 22. The default client set no spending limit until August 18 releases added one. Only agents that signed payments automatically, in apps with no limits, were at risk.

This was one of three critical flaws among 25 V12 found, all fixed on August 18. Another let a facilitator accept a Solana token approval, which moves no tokens, as valid payment; only the TypeScript SDK was affected. The third let a malicious server get an agent to sign a login message for a different website.

V12 found them through code review and local tests. No attacks have been reported. However, the x402 Foundation published no security advisory, and npm audit and PyPI showed no warnings, so developers may not know to upgrade.

The fixes cap payments at $1 by default, restrict clients to recognized US dollar stablecoins, add the missing Solana check, and require login messages to match the site contacted. Upgrade to 2.23.0 or later. Teams that can’t upgrade can register a payment policy that blocks large amounts.

10/14/2026-10/21/2026 Next.js Ships Out-of-Band Patch; PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws; OpenCode Security Breach And More.

1. Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

Next.js released an out-of-band security update on October 14, fixing two critical unauthenticated remote code execution (RCE) flaws and one high-severity denial-of-service (DoS) flaw. Fixes are in versions 16.4.1 and 15.5.28.

The flaws:

• use cache RCE (CVSS 9.5): Affects version 16 apps with Cache Components enabled, where a use cache function returns multiple typed arrays. It’s far narrower than December 2025’s React2Shell.
• SVG RCE (CVE-2026-96889, CVSS 9.5): A librsvg memory bug reached through sharp. It affects apps passing attacker-supplied SVGs on glibc-based Linux, including next/og on Node.js.
• Server Actions DoS: Crafted requests can max out a server process’s CPU in App Router apps with at least one Server Action.

What to do:
Upgrade to 16.4.1 or 15.5.28, then rebuild and redeploy. Version 16.4.1 requires sharp 0.35.5, but 15.5.28 may keep an older, vulnerable sharp. Check with npm ls sharp and update if needed. Without upgrading, you can mitigate the SVG flaw by updating sharp or blocking SVG rendering. The other two flaws have no workaround.

Scanners may miss the use cache and Server Actions flaws, which had no CVE or npm advisory as of October 15. No attacks have been reported.

2. PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws

Details of two critical PHP vulnerabilities, dubbed PHP2Shell, have leaked online ahead of coordinated disclosure and official patches. Both carry a CVSS score of 9.2.
PHP has scheduled patches for Wednesday, 21 October 2026 and urged users to prepare for immediate upgrades. It warned that fixes may come sooner if technical details are published or in-the-wild exploitation emerges.

The flaws, reportedly CVE-2026-109618 and CVE-2026-109619, could allow remote code execution. Given their scores, CERT-EU says both are likely exploitable without authentication. Public reporting suggests all versions from PHP 5 onwards are affected, and one report describes the first flaw as a use-after-free bug. The root cause, affected component, and attack path remain undisclosed.

WatchTowr says it reproduced CVE-2026-109618 but is withholding details until patches ship. Both WatchTowr and Huntress report no exploitation in the wild so far.

3. OpenCode Security Breach Exposes Third-Party API Keys of its Console Users

OpenCode disclosed a security breach affecting 1.4% of its Console users (not its entire user base). Third-party API keys saved in affected workspaces, including those for OpenAI and Anthropic, may have been exposed. In an October 17 statement, the company linked the incident to a large-scale distillation attack and said it was working with Anthropic, OpenAI, and Google. Affected users were emailed that morning; those who received no email were not impacted.

According to the notification, attackers gained unauthorized access to a legacy system that OpenCode was already preparing to shut down. The wording describes possible exposure, not confirmed theft or use of every key.

Affected users should revoke and replace keys through each provider’s dashboard, update every application using them, and review recent usage and billing for unexpected activity.

Distillation means training one AI model on another’s outputs. OpenCode has not explained how attackers got in, how long they stayed, how many keys were involved, or whether stolen credentials were used for the distillation requests. It also named no attacker and reported no confirmed loss figure.

The incident was still ongoing at publication, and OpenCode said it could not share more details.

4. Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor

Rank Math PRO copies downloaded from rankmath.com or delivered as updates contained malware, according to a company notice. The affected version was 3.0.123, but version number alone doesn’t show exposure: only copies obtained during that window are affected. The free WordPress.org plugin isn’t named.
Sites that installed and activated an affected copy should be treated as compromised, even if later updated to clean version 3.0.124. The malware can recreate a hidden backdoor, and may have added backdoor files, administrator accounts, scheduled tasks, SSH keys, and .htaccess changes. Any credentials the site could reach should be considered exposed. Wordfence rates the incident (CVE-2026-111862) 9.8.

Recovery:
Restoring a pre-20:02 UTC October 15 backup is preferred, followed by a security scan and changing all credentials. Without a clean backup, first delete the entire rank-math-pro folder, remove three malicious wp_options entries, and block rank1cdn[.]com. Then hunt for rogue files, admin accounts (wpsupport_), and server persistence. Change all credentials, and install 3.0.124 last, directly from rankmath.com.

Rank Math hasn’t explained how the files entered its system or how many customers were affected. This is at least the third premium WordPress plugin update-channel compromise this year.

5. CVE-2026-99999: Critical PwnEscape Linux Kernel Flaw Enables Guest-to-Host Escape

CVE-2026-99999 (“PwnEscape”) is a Linux kernel flaw, present since version 2.6.27, that lets a guest VM break out to the host. Malformed checksum metadata can make skb_checksum_help() alter an IPv4 header after it was validated. Researchers used this to change a 20-byte header into a 60-byte one, leaking 32 bytes of host memory. It scores CVSS 9.3 (Critical) with a Local attack vector, since the attacker needs code execution inside a guest.

In a controlled KVM environment, researchers chained the leak into host-kernel writes and root execution. Only the memory disclosure was reproduced on Vercel’s live sandbox infrastructure, with no evidence of customer data exposure. Multi-tenant platforms running untrusted code are most at risk. No exploitation or CISA KEV listing has been reported.

Mitigation:
Upgrade the host kernel (guest updates don’t help) to a fixed stable release, such as 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 or 7.2.11. Check distribution advisories, since fixes may be backported. Reboot, then verify the active kernel on every host. Monitor for host crashes and anomalous fragmentation tied to guest traffic. If an escape is suspected, treat the host as compromised.

10/07/2026-10/14/2026 GhostAction Attack Compromises 500+ GitHub Accounts; Docker Fixes Critical Two-Year-Old Hub Flaw; Critical Code Injection and Memory Corruption Vulnerabilities And More.

1. GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking

GitHub now expires unvalidated npm trusted publishing configurations 48 hours after creation, after Bloom Security found attackers could push new versions of others’ packages without stealing credentials. A configuration becomes validated after its first successful publish; changing the repository or project identity requires a new 48-hour window. npm also rejects trusted publishing tokens from GitHub Actions issue_comment events.

The flaw, dubbed SlugFest, stems from npm anchoring trust to a repository’s name (“owner/repository”) rather than its immutable ID until the first publish. If a maintainer renames, transfers or deletes a repository, an attacker can claim the freed name, mint an OIDC token, and obtain a publish credential for the victim’s package, inheriting its reputation and downloads. Bloom found over 1,500 vulnerable packages with more than 10 million combined downloads; AI agents pulling latest versions could worsen exposure. Maintainers should audit trusted publisher bindings, recreate them after renames or transfers, delete them when repositories are removed, and monitor unexpected publishes.

2. GhostAction Attack Compromises 500+ GitHub Accounts to Steal Cloud and AI Credentials 

A new GhostAction campaign has compromised over 500 GitHub accounts and, since October 7, 2026, spread malicious workflows across tens of thousands of repositories. It steals GitHub Actions secrets and searches source code and Git history for cloud and AI credentials.

An October 8 burst involved compromised maintainer accounts henrywoo and kitao, which injected security-audit.yml into 346 repositories, including uber/athenadriver and kitao/pyxel. The workflow runs on every push and manual dispatch, targeting secrets whose names were extracted from existing workflows. No malicious package releases had been found as of October 9.

The workflow also checks out full history and scans git log -p --all output for 13 credential patterns covering AWS, Anthropic, OpenAI, GitHub and others. Results go via cleartext HTTP POST to 193.32.204[.]199, even when nothing is found. Socket advises removing injected workflows, rotating all exposed credentials (not just Actions secrets), revoking sessions and tokens, scanning history, reviewing CloudTrail, and blocking the IP.

3. Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another

A flaw in Docker Hub (CVE-2026-105445, CVSS 9.4) let one user push, pull or delete images as another. Docker fixed it on September 30 and found no evidence of exploitation.

The bug sat in the feature converting a personal account into an organization. Conversion transferred the account’s personal access tokens to the designated owner, but the token secrets stayed unchanged. An attacker could create a token, convert the account, name a victim as owner, and use the token as that victim, without the victim’s consent or notification.

Researchers Peter Molnar and Krisztian Hozak, who named it GhostPat, reported it; Docker fixed it within four hours. The flaw had been open since August 2024.

Docker reviewed about 304,000 pushes with transferred tokens and found no malicious activity, but treated all transferred tokens as possibly affected, since logs miss unused ones. Affected users were emailed October 2. Users should review tokens, revoke unfamiliar ones, and use organization access tokens for automation.

4. SAP Security Update Patches Critical Code Injection and Memory Corruption Vulnerabilities

SAP’s October 13, 2026 Patch Day fixes 22 entries: four critical, three high, 14 medium and one low, covering S/4HANA, NetWeaver, Web Dispatcher, Commerce Cloud and development libraries.

The top-rated flaw, CVE-2026-89111 (CVSS 10.0), is an OAuth2 server-side request forgery in SAP Cloud SDK for Python before 0.45.2. In multi-tenant BTP applications, an attacker controlling the tenant_subdomain parameter can redirect token requests and expose client credentials.

CVE-2026-89107 (9.9) lets an authenticated attacker with specific business privileges inject executable ABAP code through S/4HANA’s Manage Substitution/Validation Rules (Note 3805589). CVE-2026-89110 (9.9), a broken access control flaw in NetWeaver Visual Composer 7.50, and CVE-2026-89108 (9.1), a missing authorization check in Manufacturing Integration and Intelligence, are also critical.

CVE-2026-58249 (7.5) is a high-severity memory corruption bug in the Internet Communication Manager that lets unauthenticated remote attackers crash processes, with no confidentiality or integrity impact.

No exploitation of these flaws has been reported. SAP urges prioritized patching; administrators should check installed components against the full affected-version lists.

5. GitLab Patches Max-Severity Vulnerability CVE-2026-97229

GitLab has fixed CVE-2026-97229 (CVSS 10.0), a critical integer overflow in Community and Enterprise Editions that could let unauthenticated attackers execute code on servers. The cause is weak validation of regular expressions in CI/CD configurations. Affected versions are 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2; users should upgrade. Researcher joaxcar reported it via HackerOne.
GitLab also patched three high-severity flaws:

• CVE-2026-92883 (8.7): a crafted repository can make another user’s browser run malicious JavaScript.
• CVE-2026-16301 (8.5): Developer-role users can bypass permissions and run pipelines on protected branches.
• CVE-2026-14814 (8.2): a pattern-matching flaw lets attackers manipulate cached files, so victims’ pipelines run malicious code and may leak environment variables.

In early October, GitLab fixed CVE-2026-90970 (9.9) in its AI Gateway. An authenticated user with Duo Agent Platform access could escape the prompt template sandbox via a crafted flow configuration and run commands on the gateway host. Fixed versions are 19.2.4, 19.3.2 and 19.4.1.

6. Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects

Anthropic has launched OSS Scanner, an opt-in, free AI vulnerability scanner for open-source projects, drawing on its Project Glasswing experience. Its strongest models, including Claude Mythos, will run periodic scans, and the reports are fully model-generated, with no human review or triage.

Anthropic expects to select projects using criteria similar to Google’s OSS-Fuzz. Core maintainers enroll by opening a pull request to the OSS Scanner GitHub repository with a YAML file giving the repository link, a primary contact email, and a Dockerfile path that builds the project with all dependencies so an offline agent can audit it. Optional fields include CC emails, a GPG key, a threat model file, and an opt-out flag. So far, 116 pull requests have been submitted.

Because of possible false positives, Anthropic imposes no 90-day disclosure period, though manually validated reports may follow its CVD policy.

Anthropic has identified over 29,000 candidate vulnerabilities, reported about 6,000, and produced 584 advisories as of October 2. It also announced a Critical Infrastructure Defense Program.