All posts

PHP2Shell CVEs Now Exploited, Brotli Added to CISA KEV

October 28, 2026 · Senserva Trustworthy AI

Senserva Watch

Join Senserva Watch and get Three Free Unlimited Audits with our full Claude MCP, a fresh audit credit every quarter, alerts when a CVE or KB you follow changes, critical security updates when they land, the Patch Tuesday wire on release day, and 20% off when you buy.

Join Senserva Watch

One email address. No tenant connection, no agent, no call.

The Senserva daily security read, October 28, 2026

PHP2Shell: CVE-2026-109618 and CVE-2026-109619 are being exploited now

CISA confirmed that the PHP2Shell vulnerabilities are being used in real attacks, and both landed on the Known Exploited Vulnerabilities catalog on 2026-10-26. CVE-2026-109618 is a PHP memory corruption flaw rated CVSS 9.8, and CVE-2026-109619 is a stale internal request-state flaw rated CVSS 8.1. Both are tied to the emergency PHP release of 2026-10-21 and both allow unauthenticated remote code execution.

These two sit at ranks one and two on the hot list with EPSS of 1.0, and they dominated public discussion with 1,428 and 1,204 Hacker News points respectively. A KEV listing plus active exploitation plus unauthenticated RCE is the clearest patch-now signal you will get. If you run PHP anywhere that touches the internet, confirm you are on the emergency release and hunt for web shells.

Brotli flaw CVE-2026-111497 reaches past Node.js into PAN-OS

The Brotli decoder vulnerability CVE-2026-111497 was added to the KEV catalog on 2026-10-27. Help Net Security reports the bug reaches far beyond Node.js, since Brotli is embedded in many products. Palo Alto Networks confirmed the flaw affects PAN-OS and has released workarounds. It is rated High at CVSS 8.1 with an EPSS of 0.55.

Treat this as a supply-chain style exposure. The fix is not one vendor patch but tracking every product that ships the Brotli decoder. Start with your Palo Alto gateways and apply the vendor workarounds if you cannot patch immediately.

The other KEV add: Adobe Commerce and Magento

CISA also added CVE-2026-48356 on 2026-10-27, an unrestricted file upload flaw in Adobe Commerce and Magento rated CVSS 9.3. Unrestricted upload of a dangerous file type on an e-commerce platform means direct code execution on a storefront. If you run Magento or Adobe Commerce, this is urgent.

Ransomware-linked movers still on the board

Two items in the hot list carry a ransomware linkage and deserve the same urgency as the new adds. CVE-2026-63077, the JetBrains TeamCity deserialization flaw at CVSS 9.8, and CVE-2026-35273, the Oracle PeopleSoft PeopleTools missing-authentication flaw at CVSS 9.8 with EPSS 0.97, are both KEV-listed and ransomware-associated. CVE-2026-41940 in WebPros cPanel and WHM is also ransomware-linked with EPSS 0.99. These are patch-now, not patch-eventually.

On the Microsoft side, the top-ranked KBs this cycle include KB5046616 for Windows Server 2022 (34 CVEs), KB5046617 for Windows 11 24H2 ARM64 (33 CVEs), and KB5046615 for Windows 10 1809 (28 CVEs), all flagged Critical with KEV content. Separately, Microsoft shipped out-of-band Windows updates to distrust eMudhra certificates.

Microsoft 365 identity attacks in the press

Several reports this week point at Microsoft 365 account abuse without a CVE. Attackers hijacked accounts at 79 organizations using stolen login tokens, AI agents were used to target more than 2,250 tenants through ConnectWise, and a spam-then-Teams scheme has attackers posing as IT support to gain remote access. These are identity and social-engineering problems, so review token protection, conditional access, and Teams external access settings.

Apple also backported patches for the exploited CoreGraphics zero-day CVE-2026-86950 to older iPhones, and iOS and macOS 27.2 fixed 286 bugs. HashiCorp Consul on Kubernetes has a critical privilege-escalation flaw, CVE-2026-110720.

Do this first

Work the exploited items in order of what is confirmed under attack.

  • Patch PHP to the emergency 2026-10-21 release for CVE-2026-109618 and CVE-2026-109619, then hunt for web shells on internet-facing hosts.
  • Apply Palo Alto workarounds or patches for the Brotli flaw CVE-2026-111497 and inventory other products that bundle the Brotli decoder.
  • Patch Adobe Commerce and Magento for CVE-2026-48356 before an attacker uploads a shell.
  • Prioritize the ransomware-linked KEV entries: JetBrains TeamCity CVE-2026-63077, Oracle PeopleSoft CVE-2026-35273, and WebPros cPanel CVE-2026-41940.
  • Deploy this cycle's Windows KBs and the out-of-band eMudhra certificate update.
  • Review Microsoft 365 token protection, conditional access, and Teams external access given the active account-hijack and fake-helpdesk campaigns.

Confirm your own state

After a KEV add, the question is whether your environment is actually exposed. Senserva's free Microsoft Patch Tracker ranks open Microsoft patches by CISA KEV, EPSS, and ransomware linkage, and the non-Microsoft exploited-CVE tracker follows KEV additions daily so you can line up this week's PHP, Brotli, and Adobe entries against what you still have open. If the Microsoft 365 identity reports have you worried, the three free unlimited audits let you check your own Microsoft 365, Intune, Defender, and Entra ID configuration.

Sources

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-28.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.

All posts

Patching across Intune, Windows Autopatch, Defender, Azure, and your endpoint managers: see Senserva patching in action.