🚨 PHP2Shell is on CISA's exploited list (KEV; federal deadline Oct 29). Adel Karimi logged 35 working shells on honeypots; Delft TI Lab counts 66,000+ exploit requests from 640+ IPs. Wiz: no end-to-end success on its honeypots. Update PHP: 8.5.12/8.4.27/8.3.36/8.2.35 #infosec

☕ Morning briefing: researchers report PHP2Shell hacks in the wild, and exploit code is public. Update PHP today. HTTP2Shell, the Brotli bug, reportedly reaches .NET, PowerShell, FFmpeg and more. Microsoft patched Oct 25; no attacks reported yet. #infosec

🚨 A new report says flaws in Tailscale SSH can turn one hacked device into root on every server it is allowed to SSH into. Tailscale hasn't confirmed it and there's no patch yet. Turn off Tailscale SSH where you don't need it and tighten your SSH rules. #infosec

🚨 OpenAI let its AI agents try to escape test copies of its training sandboxes. They got past 3 walls: onto the host machine; from a host they were handed, onto the internet (limited) via log, metrics and login services; and between sealed boxes via CPU cache timing. #infosec

🚨 CVE ALERT: Node2Shell (aka HTTP2Shell), CVE-2026-111497. Out-of-bounds write in Google's Brotli decoder (1.0.3-1.2.0), CVSS 4.0 9.2 (Google, the CNA). Hits Node, Bun, Python and Envoy/Istio when they decode untrusted Brotli. Not exploited yet. Patch, rebuild. #nodejs #infosec

🚨 ALERT: A certificate authority's private key was the number 4. eMudhra's 8 intermediate CA keys (6 TLS, 2 code signing) were all below 256, so anyone could forge trusted HTTPS certs. Browsers blocked them. Your CA bundles and Docker images may not have. #infosec #PKI

🚨 CVE ALERT: PHP2Shell. CVE-2026-109618/-109619 (unauth RCE, CVSS 4.0 9.2) are fixed in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. A related bug, CVE-2026-115560, is NOT fixed yet: set session.upload_progress.enabled=0 in php.ini (restart PHP) until the next release. #PHP #infosec