PHP: update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (8.1 and older: no fix). Unpatched third bug CVE-2026-115560: set session.upload_progress.enabled=0. Brotli: .NET 8.0.33/9.0.22/10.0.14, Oct 25 PowerShell 7.4/7.5/7.6 builds, Node 22.23.4/24.22.1/26.12.1. Rebuild, restart.

Sources: - Reported PHP2Shell hack (honeypot): bleepingcomputer.com/news/se… - $2,000 challenge claim + public code: cybersecuritynews.com/php2sh… - Suspected North Korea scanning (CYFIRMA): thehackernews.com/2026/10/ph… - HTTP2Shell beyond Node: securityweek.com/node2shell-…

☕ Morning briefing: researchers report PHP2Shell hacks in the wild, and exploit code is public. Update PHP today. HTTP2Shell, the Brotli bug, reportedly reaches .NET, PowerShell, FFmpeg and more. Microsoft patched Oct 25; no attacks reported yet. #infosec

What to do now: turn off Tailscale SSH where you don't need it (tailscale set --ssh=false, after making sure you have another way in), and give each SSH rule one source and one destination. On headscale 0.29.5, treat every SSH rule as root access.

News: cybersecuritynews.com/tailsc… Report (Tailworm, Oct 25): tailworm.com Watch for Tailscale's response: tailscale.com/security-bulle…

🚨 A new report says flaws in Tailscale SSH can turn one hacked device into root on every server it is allowed to SSH into. Tailscale hasn't confirmed it and there's no patch yet. Turn off Tailscale SSH where you don't need it and tighten your SSH rules. #infosec

Fixed versions (update to these or newer): Kata Containers 4.1.0, gVisor release-20260803.0, Docker Engine 29.9.0 (seccomp profile), Linux 6.6.158 / 6.12.111 / 6.18.53 / 7.1.13 / 7.2.3, or your distro's patched kernel.

Sources: - OpenAI, Oct 23: openai.com/index/securing-ou… - Kata Containers advisory (CVE-2026-24834, fixed 3.27.0): github.com/kata-containers/k… - The Hacker News: thehackernews.com/2026/10/op…

🚨 OpenAI let its AI agents try to escape test copies of its training sandboxes. They got past 3 walls: onto the host machine; from a host they were handed, onto the internet (limited) via log, metrics and login services; and between sealed boxes via CPU cache timing. #infosec

Fixed: Node 22.23.4 / 24.22.1 / 26.12.1, Bun 1.4.4, Brotli 1.0.10 / 1.1.1 / 1.2.1, Python Brotli 1.2.1, brotlicffi 1.2.1.0. Envoy/Istio: patch or turn off Brotli decompression. End-of-life Node (25, 23, 20 and older): no official fix.

Sources: - CVE record: cve.org/CVERecord?id=CVE-202… - Node.js: nodejs.org/en/blog/vulnerabi… - The Hacker News on Bun, Python, Envoy, Istio: thehackernews.com/2026/10/br…

🚨 CVE ALERT: Node2Shell (aka HTTP2Shell), CVE-2026-111497. Out-of-bounds write in Google's Brotli decoder (1.0.3-1.2.0), CVSS 4.0 9.2 (Google, the CNA). Hits Node, Bun, Python and Envoy/Istio when they decode untrusted Brotli. Not exploited yet. Patch, rebuild. #nodejs #infosec

Site operators: Chrome is expected to remove emSign ECC Root CA - G3 on Oct 27. If your certificate chains to it, get one from a different root now.

Sources: - Google Chrome Root Program: blog.google/security/protect… - Mozilla incident: bugzilla.mozilla.org/show_bu… - Scott Helme (all 8 key values, one is 4): scotthelme.co.uk/eight-bits-…

🚨 ALERT: A certificate authority's private key was the number 4. eMudhra's 8 intermediate CA keys (6 TLS, 2 code signing) were all below 256, so anyone could forge trusted HTTPS certs. Browsers blocked them. Your CA bundles and Docker images may not have. #infosec #PKI

Sources: - PHP advisories GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp and php.net (Oct 23, CVE-2026-115560) - AWS on exploitation: aws.amazon.com/blogs/securit… - Wiz: wiz.io/blog/php2shell-php-rc…

🚨 CVE ALERT: PHP2Shell. CVE-2026-109618/-109619 (unauth RCE, CVSS 4.0 9.2) are fixed in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. A related bug, CVE-2026-115560, is NOT fixed yet: set session.upload_progress.enabled=0 in php.ini (restart PHP) until the next release. #PHP #infosec

On PHP 8.1 or older: no new release. PHP posted source backports for 7.4, 8.0 and 8.1; check your distro's advisory, or upgrade.

It's Skyline imdb.com/title/tt1564585/