· 5 min read · LNX Inc.

MSP Threat Briefing: October 27, 2026

CISA adds PHP2Shell to its exploited list, and the Brotli decoder flaw now has .NET and PHP for Windows fixes plus reported exploit traffic.

A security analyst seen from behind, reviewing three monitors of status tiles and a world map in a dark office before dawn

Two items today. CISA now lists both PHP2Shell flaws as exploited, which ends any argument about priority. A Brotli decoder flaw that sits inside Node.js, .NET, Python and PHP for Windows picked up new patches over the weekend, and one sensor network reports exploit traffic.

  1. Finish patching every PHP server to the October 21 releases. Federal agencies have until October 29; treat that as your deadline too.
  2. Inventory Node.js, .NET and Python services that handle Brotli data, and update them to the fixed versions below. Restart them afterwards.
  3. On Windows PHP servers, install the new -1 builds that bundle Brotli 1.2.1.

1. Update: CISA adds both PHP2Shell flaws to its exploited list

This follows item 1 in the October 26 briefing. CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog on October 26 (CISA alert). The catalog sets a due date of October 29 for federal civilian agencies.

Nothing about the fix has changed. What has changed is the evidence. Until the weekend, every report described failed attempts. Adel Karimi's honeypots then recorded working code execution on October 24, as covered yesterday. The Hacker News reports that Karimi called his setup an intentionally favorable single-worker mod_php profile. So reliability on other configurations is not yet measured. Do not read that as a reason to wait.

Who is exposed. Any PHP site, hosting panel, intranet app or appliance on a build older than October 21. That includes vendor appliances that ship PHP inside. The Hacker News article links advisories from Synology, QNAP, NETGEAR, SonicWall, Veeam, Hikvision and dozens of others.

What to do.

  • Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (php.net advisory). Restart PHP-FPM and Apache, then confirm the running version.
  • Check each appliance vendor's PHP2Shell advisory for products you manage. Appliances will not pick up an OS package update.
  • Keep session.upload_progress.enabled=0 set in php.ini or the FPM pool file. PHP says it must apply before request parsing, so ini_set() and .user.ini do not work. It is also the interim fix for CVE-2026-115560, which is still unpatched.
  • Hunt for /bin/sh started by apache2, httpd or php-fpm. The indicator table in the October 26 briefing still applies; no new indicators were published in the last day.

2. Brotli decoder flaw: new .NET and PHP for Windows fixes, and reported exploit traffic

CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder. Crafted compressed data can crash a process, leak its memory or lead to code execution. Brotli versions 1.0.3 through 1.2.0 are affected; 1.0.10, 1.1.1 and 1.2.1 are fixed (researchers' tracking page). It is rated 9.2 under CVSS 4.0 in the GitHub advisory. Microsoft rates it 8.1 under CVSS 3.1.

Node.js disclosed it on October 21 (Node.js security release). Three developments since then matter to MSPs:

  • .NET, October 25. Microsoft shipped out-of-band .NET 8.0.33, 9.0.22 and 10.0.14 (.NET blog). The same release re-issues two incomplete fixes from October 13. Microsoft rates the Brotli flaw "Exploitation More Likely", reported by The Register.
  • PHP for Windows, October 26. PHP published rebuilt Windows packages 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 with Brotli 1.2.1 (php.net). The flaw is reachable through the cURL extension only when automatic response decompression is turned on. That is off by default, but apps and HTTP libraries can enable it.
  • Exploit traffic, October 26. ELLIO reports its sensors recorded an exploit payload aimed at Node.js v24.22.0 on x86-64. It does not report a successful compromise. Other researchers have not seen active exploitation, reported by CyberScoop. It was not in the CISA catalog when we checked on October 27.

Who is exposed. Clients running custom web apps, portals or APIs on Node.js, ASP.NET Core or Python. Exposure depends on whether the app decompresses Brotli data from outside. In Node.js, that includes fetch() of a Brotli-compressed response. In .NET, it means request decompression, HttpClient automatic decompression or the Brotli APIs; .NET Framework is not affected. Line-of-business software and appliances that bundle these runtimes are exposed too, and their vendors may be slower.

What to do.

  • Update Node.js to 22.23.4, 24.22.1 or 26.12.1. Node 25, 23, 20 and older are end of life and get no fix; move them to a supported line.
  • Install .NET 8.0.33, 9.0.22 or 10.0.14 on servers and rebuild self-contained apps. A runtime update does not reach an app that ships its own runtime.
  • Update the Python Brotli package to 1.2.1 and brotlicffi to 1.2.1.0. Update lockfiles so builds do not reinstall the old versions.
  • On Windows PHP hosts, install the -1 packages from php.net downloads.
  • Restart every updated process and redeploy container images. A running process keeps the old decoder.
  • If an inbound service cannot be patched yet, reject Content-Encoding: br request bodies at the proxy, load balancer or WAF.
  • Ask software vendors whose products bundle Node.js, .NET or Python when they will ship a fix.
Indicator (from ELLIO)Value
Exploit source IP94.154.43[.]7
Scanner user agentMozilla/5.0 (compatible; node2shell-check/1.0)
Exploit request body SHA-2567fcbdaaecd4419e2930927844f3b772668204737a4e7602a2290c991c93c5c4b
Request shapePOST with Content-Encoding: br; the exploit body was 23,069,983 bytes

ELLIO describes the user agent as an exposure checker that maps which hosts decompress Brotli. A hit means you were scanned, not compromised.

Quick hits

ConnectWise Cloud Backup. Onboarding has slipped. The October 25 update targeted October 26. The October 26 update says only that ConnectWise is preparing for phased onboarding, with no new date. It lists no new indicators. Keep the affected app connections disabled until ConnectWise sends instructions for your service.

Sources

threat-briefingmanaged-it

More from LNX

All posts →
A security analyst seen from behind, reviewing three monitors of status tiles and a world map in a dark office before dawn MSP Threat Briefing: October 29, 2026 CISA lists Fragnesia, a Linux kernel flaw chained with PHP2Shell to get root on firewalls. Federal deadline is October 31. ConnectWise starts restores. Read the post → A security analyst seen from behind, reviewing three monitors of status tiles and a world map in a dark office before dawn MSP Threat Briefing: October 28, 2026 CISA lists the Brotli decoder flaw and Adobe Commerce PolyShell as exploited. Both carry a November 10 federal deadline. Read the post → A security analyst seen from behind, reviewing three monitors of status tiles and a world map in a dark office before dawn MSP Threat Briefing: October 26, 2026 PHP2Shell now has confirmed successful exploitation, and CISA lists an exploited flaw in Nextcloud's built-in Collabora CODE server. Read the post →

Tell us what's in front of you.

A drawing set, a failing switch, an audit deadline, or a hunch that IT costs too much. We'll tell you who picks it up and what it takes.

Request a quote Book an assessment (833) 569-5690 · Mon–Fri 8–4