Brotli RCE in PHP; Magento stores hijacked; GitHub supply

Checked by defend.network against the NIST National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities catalog.

CVE-2026-111497 in PHP Brotli library: the source articles reported no exploitation. NVD rates it 9.2 (CRITICAL) on CVSS v4.0.

CVE-2026-109618 in PHP Group PHP is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-10-26; federal remediation due 2026-10-29). NVD rates it 9.8 (CRITICAL) on CVSS v3.1. NVD lists a vendor advisory.

CVE-2026-109619 in PHP Group PHP is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-10-26; federal remediation due 2026-10-29). NVD rates it 8.1 (HIGH) on CVSS v3.1. NVD lists a vendor advisory.

Critical Brotli memory-corruption flaw ( CVE-2026-111497 ) in PHP Windows packages is patched; PHP RCEs CVE-2026-109618 and CVE-2026-109619 under active exploitation affecting ~70% of web infrastructure. 953 Magento stores compromised with scanner-evasion code; GitHub tokens stolen in supply-chain attack; 525,000 records exposed at University of Copenhagen.

PHP vulnerability pair (CVE-2026-109618, CVE-2026-109619) enabling unauthenticated RCE is actively exploited across nearly 70% of websites; CISA KEV entries mandate federal patching by October 29.

Critical Brotli compression library flaw (CVE-2026-111497) patched in PHP 8.2–8.5 Windows builds and present in Node.js and Python; exploitable through HTTP/2 and cURL.

953 e-commerce stores, predominantly Magento, infected with JavaScript code designed to evade security scanners in ongoing campaign active since July 2025.

Supply-chain attack “Gheist” harvesting GitHub tokens and cloud credentials from thousands of developer repositories.

University of Copenhagen confirms breach exposing personal data of 525,000 individuals; ransomware negotiators linked to ShinyHunters extortion group under FBI investigation.

1. Critical PHP RCEs Under Active Exploitation Across 70% of Web Infrastructure

Severity: CRITICAL Affected: Technology

CVE-2026-109618 and CVE-2026-109619 are a pair of remote code execution vulnerabilities in PHP that allow unauthenticated attackers to seize full control of affected servers [1] . Both vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities catalog as of October 26, with a federal remediation deadline of October 29 [2] [3] . CVE-2026-109618 is an out-of-memory corruption flaw, and CVE-2026-109619 is a stale internal request-state vulnerability [2] [3] . Working exploits are publicly available, and researchers report that nearly 70 percent of websites require updates to patch these flaws [1] . Sources: [1] Krebs on Security [2] CISA KEV [3] CISA KEV

Prioritize PHP patching immediately; verify all web servers are running patched versions

Monitor for signs of server compromise (unexpected shell creation, outbound connections, file modifications) on all PHP-powered infrastructure

Enable request logging and anomaly detection on web application firewalls

Enforce authentication and IP allowlisting on administrative interfaces

2. Brotli Compression Library RCE in PHP, Node.js, Python Windows Implementations

Severity: CRITICAL Affected: Technology

CVE-2026-111497, dubbed “HTTP2Shell,” is a critical memory corruption flaw in the Brotli compression library that is built into PHP, Node.js, and other runtime environments [2] . In PHP, the flaw is exploitable through the cURL extension and can allow attackers to corrupt memory and access sensitive data or execute arbitrary code [1] . PHP has issued emergency rebuilds of its official Windows packages for versions 8.2 through 8.5 to address the vulnerability [1] . The flaw is also present in Node.js and other implementations ⚠ [2] . Sources: [1] The Hacker News [2] BleepingComputer

Update PHP Windows distributions to the latest patched builds (8.2, 8.3, 8.4, 8.5 as available)

Audit and patch Node.js deployments for Brotli-related updates

Disable Brotli compression if patches are unavailable and the software cannot be updated immediately

Monitor HTTP/2 traffic for unusual compression patterns or decompression errors

3. 953 Magento and E-commerce Stores Infected with Scanner-Evading JavaScript

Severity: HIGH Affected: Retail

An unknown threat actor has infected 953 online stores, the majority running Magento, as part of a long-running campaign active since July 2025 [1] . The campaign injects a small piece of JavaScript code into store pages that is designed to evade detection by security scanners [1] . The injected code executes when store pages are visited by customers, creating risk for credential theft and payment card compromise. ⚠ Sources: [1] The Hacker News

Scan Magento and other e-commerce platforms for unauthorized JavaScript injections in front-end templates and page headers

Review file integrity monitoring logs for unexpected modifications to theme files, JavaScript assets, and checkout pages since July 2025

Audit admin account access logs and API keys; reset credentials for any suspicious activity

Deploy client-side security scanning that looks for inline scripts in payment and login contexts

4. GitHub Supply-Chain Attack 'Gheist' Steals Tokens and Cloud Credentials

Severity: HIGH Affected: Technology

An ongoing supply-chain attack designated “Gheist” is harvesting GitHub tokens and cloud credentials from thousands of developer repositories [1] . The attack exploits the trust developers place in GitHub to compromise sensitive credentials and access internal cloud infrastructure, amplifying the reach of downstream attacks on organizations using affected open-source projects and repositories. Sources: [1] Dark Reading

Audit GitHub personal access tokens and organization tokens; rotate all tokens immediately

Review repository commit history and pull requests for suspicious activity since the campaign’s discovery

Enable branch protection rules and require code reviews on all critical repositories

Scan cloud credential stores (AWS Secrets Manager, Azure Key Vault, etc.) for evidence of unauthorized access

Monitor GitHub organization audit logs for token creation, key rotation, or permission changes

5. University of Copenhagen Data Breach Exposes 525,000 Individuals

Severity: HIGH Affected: Education

The University of Copenhagen confirmed a data breach in which attackers accessed one of its test environments containing personal data belonging to 525,000 people [1] . The exposure of a test environment underscores risks posed by inadequate segmentation of non-production infrastructure and the sensitive data retained within it. Sources: [1] BleepingComputer

Notify affected individuals in accordance with GDPR and applicable data protection regulations

Segment test and development environments from production and restrict access by role and business necessity

Audit all non-production systems for the presence of production data; implement automated redaction of PII in development/test environments

Review access controls and credential management on test infrastructure

Ransomware negotiator arrested in ShinyHunters investigation: The FBI arrested the co-founder of a Canadian cybersecurity firm in connection with the ShinyHunters extortion group that recently breached the FBI itself [15]. Federal investigators have identified executives at ransomware negotiation firms who maintained close relations with ShinyHunters [12]. U.K. sanctions Cryptomus: The United Kingdom issued economic sanctions against Cryptomus, a cryptocurrency platform serving as a payment conduit for ransomware, narcotics, and darknet markets [13]. Microsoft Teams abuse: Threat actors are conducting social engineering and malware delivery via Microsoft Teams external chat creation feature, exploiting IT support impersonation patterns [3]. Earlier coverage of related threats .

Today’s Action Checklist

☐ URGENT (Today): Patch all PHP instances to latest versions addressing CVE-2026-109618 and CVE-2026-109619; verify deployment and test applications before production rollout

☐ URGENT (Today): Deploy PHP Windows security updates for CVE-2026-111497 (Brotli) to all affected systems running versions 8.2–8.5

☐ URGENT: If running Magento or other e-commerce platforms, conduct file integrity audit for unauthorized JavaScript injections and scanner-evasion techniques

☐ URGENT: Rotate all GitHub tokens, personal access tokens, and cloud credential store keys; audit usage logs

☐ HIGH: Segregate test and development environments from production; audit and remove PII from non-production systems

☐ HIGH: Review Microsoft Teams external chat policies and audit recent external conversations for signs of social engineering or credential compromise

☐ MEDIUM: Monitor CISA KEV updates through October 29 for additional federal remediation deadlines