# MSP Threat Briefing: October 27, 2026

_October 27, 2026 · LNX Inc._

CISA adds PHP2Shell to its exploited list, and the Brotli decoder flaw now has .NET and PHP for Windows fixes plus reported exploit traffic.

Two items today. CISA now lists both PHP2Shell flaws as exploited, which ends any argument about priority. A Brotli decoder flaw that sits inside Node.js, .NET, Python and PHP for Windows picked up new patches over the weekend, and one sensor network reports exploit traffic.

1. Finish patching every PHP server to the October 21 releases. Federal agencies have until October 29; treat that as your deadline too.
2. Inventory Node.js, .NET and Python services that handle Brotli data, and update them to the fixed versions below. Restart them afterwards.
3. On Windows PHP servers, install the new `-1` builds that bundle Brotli 1.2.1.

## 1. Update: CISA adds both PHP2Shell flaws to its exploited list

This follows item 1 in the [October 26 briefing](/news/msp-threat-briefing-2026-10-26/). CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog on October 26 ([CISA alert](https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog)). The catalog sets a due date of October 29 for federal civilian agencies.

Nothing about the fix has changed. What has changed is the evidence. Until the weekend, every report described failed attempts. Adel Karimi's honeypots then recorded working code execution on October 24, as covered yesterday. The Hacker News [reports](https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html) that Karimi called his setup an intentionally favorable single-worker mod_php profile. So reliability on other configurations is not yet measured. Do not read that as a reason to wait.

**Who is exposed.** Any PHP site, hosting panel, intranet app or appliance on a build older than October 21. That includes vendor appliances that ship PHP inside. The Hacker News article links advisories from Synology, QNAP, NETGEAR, SonicWall, Veeam, Hikvision and dozens of others.

**What to do.**

- Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 ([php.net advisory](https://www.php.net/archive/2026.php#2026-10-21-5)). Restart PHP-FPM and Apache, then confirm the running version.
- Check each appliance vendor's PHP2Shell advisory for products you manage. Appliances will not pick up an OS package update.
- Keep `session.upload_progress.enabled=0` set in `php.ini` or the FPM pool file. PHP says it must apply before request parsing, so `ini_set()` and `.user.ini` do not work. It is also the interim fix for CVE-2026-115560, which is still unpatched.
- Hunt for `/bin/sh` started by `apache2`, `httpd` or `php-fpm`. The indicator table in the [October 26 briefing](/news/msp-threat-briefing-2026-10-26/) still applies; no new indicators were published in the last day.

## 2. Brotli decoder flaw: new .NET and PHP for Windows fixes, and reported exploit traffic

CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder. Crafted compressed data can crash a process, leak its memory or lead to code execution. Brotli versions 1.0.3 through 1.2.0 are affected; 1.0.10, 1.1.1 and 1.2.1 are fixed ([researchers' tracking page](https://broccoli2shell.com/)). It is rated 9.2 under CVSS 4.0 in the GitHub advisory. Microsoft rates it 8.1 under CVSS 3.1.

Node.js disclosed it on October 21 ([Node.js security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)). Three developments since then matter to MSPs:

- **.NET, October 25.** Microsoft shipped out-of-band .NET 8.0.33, 9.0.22 and 10.0.14 ([.NET blog](https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/)). The same release re-issues two incomplete fixes from October 13. Microsoft rates the Brotli flaw "Exploitation More Likely", [reported by The Register](https://www.theregister.com/security/2026/10/26/microsoft-releases-emergency-net-security-fixes-for-google-brotli-bug/5305515).
- **PHP for Windows, October 26.** PHP published rebuilt Windows packages 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 with Brotli 1.2.1 ([php.net](https://www.php.net/archive/2026.php#2026-10-26-1)). The flaw is reachable through the cURL extension only when automatic response decompression is turned on. That is off by default, but apps and HTTP libraries can enable it.
- **Exploit traffic, October 26.** ELLIO [reports](https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/) its sensors recorded an exploit payload aimed at Node.js v24.22.0 on x86-64. It does not report a successful compromise. Other researchers have not seen active exploitation, [reported by CyberScoop](https://cyberscoop.com/brotli-critical-vulnerability-decompression-library-node2shell-broccoli2shell/). It was not in the [CISA catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) when we checked on October 27.

**Who is exposed.** Clients running custom web apps, portals or APIs on Node.js, ASP.NET Core or Python. Exposure depends on whether the app decompresses Brotli data from outside. In Node.js, that includes `fetch()` of a Brotli-compressed response. In .NET, it means request decompression, `HttpClient` automatic decompression or the Brotli APIs; .NET Framework is not affected. Line-of-business software and appliances that bundle these runtimes are exposed too, and their vendors may be slower.

**What to do.**

- Update Node.js to 22.23.4, 24.22.1 or 26.12.1. Node 25, 23, 20 and older are end of life and get no fix; move them to a supported line.
- Install .NET 8.0.33, 9.0.22 or 10.0.14 on servers and rebuild self-contained apps. A runtime update does not reach an app that ships its own runtime.
- Update the Python `Brotli` package to 1.2.1 and `brotlicffi` to 1.2.1.0. Update lockfiles so builds do not reinstall the old versions.
- On Windows PHP hosts, install the `-1` packages from [php.net downloads](https://www.php.net/downloads.php?os=windows).
- Restart every updated process and redeploy container images. A running process keeps the old decoder.
- If an inbound service cannot be patched yet, reject `Content-Encoding: br` request bodies at the proxy, load balancer or WAF.
- Ask software vendors whose products bundle Node.js, .NET or Python when they will ship a fix.

| Indicator (from ELLIO) | Value |
|---|---|
| Exploit source IP | `94.154.43[.]7` |
| Scanner user agent | `Mozilla/5.0 (compatible; node2shell-check/1.0)` |
| Exploit request body SHA-256 | `7fcbdaaecd4419e2930927844f3b772668204737a4e7602a2290c991c93c5c4b` |
| Request shape | POST with `Content-Encoding: br`; the exploit body was 23,069,983 bytes |

ELLIO describes the user agent as an exposure checker that maps which hosts decompress Brotli. A hit means you were scanned, not compromised.

## Quick hits

**ConnectWise Cloud Backup.** Onboarding has slipped. The October 25 update targeted October 26. The [October 26 update](https://www.connectwise.com/company/trust/advisories) says only that ConnectWise is preparing for phased onboarding, with no new date. It lists no new indicators. Keep the affected app connections disabled until ConnectWise sends instructions for your service.

## Sources

- [CISA: two known exploited vulnerabilities added (PHP), October 26, 2026](https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [CISA Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [The Hacker News: CISA confirms active exploitation of two PHP2Shell flaws](https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html)
- [PHP: critical remote code execution vulnerabilities, October 21, 2026](https://www.php.net/archive/2026.php#2026-10-21-5)
- [PHP: updated Windows builds for Brotli security fix, October 26, 2026](https://www.php.net/archive/2026.php#2026-10-26-1)
- [Node.js October 2026 security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)
- [.NET October 2026 out-of-band security updates](https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/)
- [Broccoli2Shell tracking page for CVE-2026-111497](https://broccoli2shell.com/)
- [ELLIO: Node2Shell analysis and observed exploit traffic](https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/)
- [The Register: Microsoft releases emergency .NET fixes for Brotli bug](https://www.theregister.com/security/2026/10/26/microsoft-releases-emergency-net-security-fixes-for-google-brotli-bug/5305515)
- [CyberScoop: experts temper alarms over critical Brotli defect](https://cyberscoop.com/brotli-critical-vulnerability-decompression-library-node2shell-broccoli2shell/)
- [ConnectWise security advisories](https://www.connectwise.com/company/trust/advisories)