InfoSec Briefing - October 28, 2026

🎧 Audio Briefing

Playback Speed:

Security news from the BlueTeamSec community for Wednesday the 28th of October 2026. Starting with a CISA alert that's getting active exploitation.

CISA have added CVE-2026-111497, dubbed Node2Shell, to the known exploited catalogue. It's a heap overflow in the Google Brotli decoder — affects Node.js, Bun, .NET, and other runtimes that use Brotli versions 1.0.3 through 1.2.0. Remote code execution with no authentication required, and it's already being exploited in the wild. CISA want patching and a full supply chain audit completed within twenty-four hours, which tells you how seriously they're taking this one. We covered detection opportunities for this yesterday.

Palo Alto Networks published a threat brief on two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. Both are remote code execution flaws stemming from improper error handling in memory management, with over twenty-two million potentially vulnerable instances identified globally. We've seen this one develop over the past few days — there was coverage of exploitation attempts earlier in the week, and Assetnote released a high-fidelity scanner on the 27th.

CYFIRMA are attributing a sophisticated campaign targeting global PHP infrastructure to DPRK-nexus actors, leveraging those same PHP2Shell exploits. The report suggests they're using AI to accelerate weaponisation of zero-day and N-day vulnerabilities, deploying web shells via remote code execution against PHP memory state flaws. Recommended mitigations include strict egress filtering, process isolation, and mandatory restarts of PHP service workers to flush exploited states. Worth reading if you're running PHP at scale.

And finally, the Australian Broadcasting Corporation disclosed that staff devices were wiped following a sophisticated spyware campaign. The attack, attributed to an entity called Discover-Tech, exploited real-time bidding in digital advertising to deliver zero-click infections through malicious ads served via legitimate ad platforms. They're calling it an 'adfection' campaign — which is either a portmanteau we'll be stuck with or wishful thinking, depending on how widely this technique spreads.

That's all for today. The articles are the work of their original authors — the analysis here was automated, as always.

📰 Articles Covered

CVE-2026-111497 - CISA KEV

CVE-2026-111497, widely referred to in the security community as **"Node2Shell,"** is a critical vulnerability involving an out-of-bounds memory write within the Brotli decompression library .

### Overview of CVE-2026-111497
| Attribute | Details |
| :--- | :--- |
| **Product/Vendor** | Node.js (specifically the bundled Brotli decoder) |
| **Vulnerability Type** | Out-of-bounds (OOB) write / Buffer overflow |
| **Impact** | Remote Code Execution (RCE) |

### Vulnerability Mechanics and Exploitation
The vulnerability exists within the reference C implementation of the Brotli decoder (specifically `c/dec/decode.c`), which is used by Node.js to decompress Brotli-encoded data .

* **Attack Vector:** Attackers can trigger this vulnerability by sending a maliciously crafted Brotli-compressed payload to an application that processes such data (e.g., via HTTP requests where Brotli compression is enabled) .
* **MITRE ATT&CK Alignment (T1190):** This is a classic exploitation of a public-facing application. Because the decoder is often invoked automatically when an application handles incoming traffic, an attacker can achieve RCE without prior authentication by simply sending a crafted request to an endpoint that parses the malicious Brotli input .

### Affected Versions
The flaw affects Google Brotli versions **1.0.3 through 1.2.0**, which are embedded in multiple versions of Node.js . Specifically, active Node.js versions identified include:
* **Node.js 22.x**
* **Node.js 24.x**
* **Node.js 26.x**
* *Note: End-of-Life (EOL) versions of Node.js that are no longer receiving security updates are also affected and remain vulnerable.*

### Threat Actors and Campaigns
As of late October 2026, the security community has observed active interest in this vulnerability given its critical RCE nature. While specific attribution to APT groups is evolving, the "Node2Shell" nickname highlights the high risk of widespread exploitation by opportunistic threat actors targeting unpatched infrastructure .

### Immediate Defender Actions
1. **Patch Immediately:** Update Node.js to the latest version released on or after **October 21, 2026**, which includes the fix for the Brotli decoder .
2. **Audit EOL Software:** Identify any systems running EOL versions of Node.js; these will not receive patches and must be upgraded to supported versions as a priority.
3. **Monitor Traffic:** Look for abnormal or oversized Brotli-encoded requests in web logs that may indicate attempts to trigger the memory corruption, though detection may be difficult due to the nature of binary compressed traffic .
4. **WAF/IPS Implementation:** Ensure Web Application Firewalls (WAFs) or Intrusion Prevention Systems (IPS) are configured to identify and block malformed Brotli compression headers or payloads if possible.
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 25) - "We have retracted our previous update from October 23." - Palo Alto Networks

The discovery of **CVE-2026-109618** and **CVE-2026-109619**, collectively dubbed **PHP2Shell**, highlights a significant risk for the vast number of web environments relying on PHP. Below is a detailed precis of the situation based on the report from Palo Alto Networks’ Unit 42.

### What Happened
Unit 42 identified two critical Remote Code Execution (RCE) vulnerabilities in PHP. While early reports suggested these might be linked to a specific compromise at a European government agency, Unit 42 has retracted this claim, noting they cannot confirm the vulnerabilities were the initial access vector in that specific case. Both vulnerabilities are rated as **Critical** with a CVSS 4.0 score of **9.2**.

### Who is Affected
Given PHP’s ubiquity in powering web servers and various content management systems, the potential impact is global. According to telemetry data from Palo Alto Networks' Cortex Xpanse, there are over **22.6 million exposed, potentially vulnerable instances** identified globally.

### Security Implications
These vulnerabilities allow for remote code execution, which grants attackers the ability to run arbitrary commands on a server. This level of access typically results in full system compromise, data exfiltration, or the deployment of further malicious payloads. Because these flaws exist in the core memory handling of PHP, they represent a fundamental security risk to any application running on affected versions.

### Technical Details
Both vulnerabilities involve improper error handling within `longjmp()` operations:

* **CVE-2026-109618**: This flaw arises from improper control flow management when handling "out-of-memory" (OOM) errors. Because the `longjmp()` process fails to properly initialize request memory, an attacker can trigger OOM conditions to reliably achieve remote code execution.
* **CVE-2026-109619**: This vulnerability involves the handling of fatal errors. During these errors, `longjmp()` causes global memory pointers to reference freed memory regions. Attackers can exploit this to read from or branch into these regions during subsequent requests, leading to arbitrary code execution.

### What Defenders Should Know
Organizations are advised to prioritize the following actions to secure their environments:

* **Patching**: The primary defense is to update PHP installations immediately. Organizations should consult the official [PHP Group security advisory](https://www.php.net/index.php) for specific patching guidance.
* **Visibility**: Use security tools such as Cortex XDR, XSIAM, and Prisma Cloud to audit and identify vulnerable versions of PHP across your infrastructure, including endpoints, servers, containers, and registry images.
* **Network Protections**: Palo Alto Networks Next-Generation Firewall (NGFW) customers can utilize Threat ID **543004** and signatures **97622**, **97623**, **97624**, and **97625** to detect and block exploitation attempts.
* **Threat Hunting**: Security teams should leverage the Managed Threat Hunting queries provided by Unit 42 within Cortex XDR to proactively search for indicators of compromise or exploitation attempts in their logs.
* **Incident Response**: If an organization suspects their environment has been compromised, they should engage an incident response team immediately.
Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA

The summary provided accurately captures the core technical findings and security implications detailed in the Cyfirma threat advisory. To supplement this, here is an additional synthesis of the defensive strategy and strategic context provided by the report:

### Strategic Context
The campaign reflects a sophisticated adaptation by DPRK-nexus actors to capitalize on high-impact, zero-day or N-day vulnerabilities with extreme speed. By leveraging AI to accelerate the weaponization phase, the threat actors significantly reduce the "window of exposure" that organizations typically rely on to apply patches.

### Supplemental Defensive Guidance

| Focus Area | Key Defensive Requirements |
| :--- | :--- |
| **Patching Lifecycle** | Beyond applying patches, ensure **PHP process isolation** (e.g., using `chroot` or containers) to limit the impact of an RCE, as these exploits specifically manipulate internal memory state. |
| **Egress Filtering** | Implement strict egress controls on web servers. Since the exploit aims to fetch external payloads (e.g., web-shells or secondary scripts), blocking unauthorized outbound connections (specifically to non-standard ports or known malicious IPs) is a critical mitigation. |
| **Log Integrity** | Because the vulnerability can cause crashes, prioritize monitoring for **frequent process restarts or core dumps** in the PHP error logs, which may indicate failed or repeated exploitation attempts. |
| **Detection Strategy** | Shift focus toward **EDR/Sysmon telemetry** rather than relying solely on WAF signatures. Focus detection logic on the *child processes* spawned by PHP-FPM or Apache processes (e.g., `php-fpm` spawning `sh`, `bash`, `python`, or `perl`). |

### Recommended Action Plan
1. **Inventory:** Identify all internet-facing assets running PHP immediately, regardless of the version, to ensure a complete audit of the attack surface.
2. **State Sanitation:** It is critical to note that simply patching may not suffice if a malicious process is already resident in memory; **a hard restart of all PHP service workers is mandatory** to flush the exploited state.
3. **Credential Rotation:** If an indicator of compromise (IoC) is identified on a host, treat all administrative and service credentials stored on that machine as **compromised**. Initiate a full rotation of these credentials immediately following remediation.
ABC wipes staff devices exposed to new, sophisticated cyber attack - Australian Broadcasting Corporation

This report provides a summary of the cybersecurity incident involving the targeting of ABC staff, based on reports of an "adfection" (advertising-based infection) campaign.

### Overview of the Incident
ABC staff members were targeted by a sophisticated cyber operation that leveraged the global digital advertising ecosystem to distribute spyware. Unlike traditional phishing attacks that require a user to interact with a malicious link, this "adfection" campaign used legitimate advertising platforms to deliver malware silently 【1】.

### Who is Affected
While the report specifically highlights the targeting of ABC staff, the underlying technology used by the entity—identified as Discover-Tech—is indiscriminate in its reach. By exploiting standard digital advertising auctions, the attackers targeted devices associated with various organizational networks, extending the risk far beyond a single media outlet 【1】.

### Technical Details
The attack model relies on the automated, high-speed nature of real-time bidding (RTB) in digital advertising:
* **Auction Exploitation:** Attackers participate in split-second advertising auctions to ensure their malicious ads are served to specific devices connected to targeted organizational networks 【1】.
* **Zero-Click Infection:** The most critical technical capability is the ability to install spyware upon a user simply viewing an advertisement, requiring no user interaction or click 【1】.
* **Passive Profiling:** Even when a full spyware infection is not triggered, the ads serve as data-collection tools, allowing attackers to profile users and map network assets based on ad "impressions" alone 【1】.

### Security Implications
This incident demonstrates the weaponization of essential internet infrastructure. Key implications include:
* **Bypassing Traditional Defenses:** Because the delivery mechanism uses legitimate advertising networks, traditional email or link-based security filters are ineffective.
* **Pervasive Surveillance:** The ability to profile millions of devices through passive impressions allows for large-scale reconnaissance, which can be used to identify high-value targets for more intensive follow-up attacks 【1】.
* **Regulatory Need:** Experts emphasize that this activity highlights an urgent need for privacy reform and the inclusion of advertising technology in government-level "digital duty of care" frameworks 【1】.

### What Defenders Should Know
* **Recognize the Threat Vector:** Security teams must acknowledge that online advertising is now a viable attack vector for sophisticated actors. It is no longer just a privacy issue; it is a critical security vulnerability 【1】.
* **Vigilance is Essential:** Attacks of this nature are designed to be "silent," meaning they often go unnoticed by standard monitoring tools. Regular audits and forensic checks of sensitive devices (particularly those belonging to journalists or high-value personnel) are vital to detect compromises 【1】.