Two cross-ecosystem remote code execution vulnerabilities are being actively exploited as of this morning. CVE-2026-111497 - dubbed HTTP2Shell - turns a Brotli decompression bug into unauthenticated RCE across Node.js, .NET, PHP, Python, and PowerShell. Meanwhile, CISA added the PHP2Shell pair (CVE-2026-109618 and CVE-2026-109619) to the Known Exploited Vulnerabilities catalog with a Thursday deadline. If you run HTTP/2 endpoints or PHP-based applications of any kind, patching is the only conversation that matters today.

In the News

HTTP2Shell: Brotli Decoder Bug Enables RCE Across Every Major Runtime

CVE-2026-111497 is a heap-based memory corruption flaw in the Brotli decompression library - the same library that nearly every modern web server and runtime uses to handle HTTP/2 content encoding. A crafted HTTP/2 response containing a malicious Brotli-compressed payload triggers the corruption and gives an attacker remote code execution on the receiving system. No authentication is required. The attack surface is any service that decompresses Brotli content: web applications, API gateways, reverse proxies, CLI tools that make HTTP/2 requests, and development tooling.

Microsoft shipped emergency out-of-band patches for .NET on Friday. The Node.js project released patched versions across all active LTS lines. PowerShell 7.4.x and 7.5.x updates are available. Palo Alto Networks confirmed impact on its products and issued an advisory.

The core problem is that Brotli is a shared dependency - it is not something most organizations track as a discrete software component. It is embedded in runtimes, linked into compiled binaries, and bundled into container images. Patching requires identifying every instance, which means organizations need functioning software composition analysis or SBOMs to respond at the speed this vulnerability demands.

What defenders should do: Enumerate all services using Brotli decompression - this includes any HTTP/2 endpoint, not just public-facing web servers. Apply runtime-specific patches immediately. As a compensating control, deploy WAF or IPS rules that inspect HTTP/2 content-encoding headers for malformed Brotli payloads.

PHP2Shell: CISA KEV Deadline Thursday for CVE-2026-109618 and CVE-2026-109619

CISA confirmed active exploitation of both PHP2Shell vulnerabilities and set a remediation deadline of Thursday, October 30 for federal agencies. Both flaws - CVE-2026-109618 and CVE-2026-109619 - are unauthenticated remote code execution vulnerabilities affecting every PHP version since 5.4. An out-of-memory condition in the PHP interpreter can be triggered remotely, leading to code execution.

The blast radius extends far beyond standalone PHP websites. Palo Alto Networks, Siemens, and Schneider Electric have each issued advisories confirming that their products include affected PHP components. Network management consoles, OT/ICS monitoring dashboards, and internal tooling built on PHP frameworks are all in scope. Organizations that cannot enumerate their PHP-based applications within 72 hours have an asset visibility problem that predates this specific vulnerability.

What defenders should do: Inventory all PHP-based applications including appliance-based network management tools. Apply PHP patches. Review vendor advisories from Palo Alto, Siemens, and Schneider Electric for product-specific update guidance. Monitor IPS/IDS for exploitation attempts targeting PHP deserialization and memory-handling functions.

Gheist Campaign Targets GitHub Enterprise - Steals Secrets via Actions Logs

A multi-enterprise campaign tracked as Gheist is automating the theft of secrets from private GitHub repositories. The attackers use stolen personal access tokens to authenticate to GitHub, then inject malicious GitHub Actions workflows into target repositories. When these workflows execute, they dump environment secrets - cloud provider credentials, API keys, code-signing certificates - into the Actions run logs. The attacker downloads the logs, then deletes them, removing the evidence trail.

The technique is effective because many organizations store sensitive credentials as GitHub Actions secrets and grant personal access tokens broad repository scopes without expiration dates. The attack works in GitHub Enterprise environments, which means air-gapping from public GitHub does not mitigate it.

What defenders should do: Audit all GitHub personal access tokens for excessive scope and missing expiration. Enable and forward GitHub audit logs to a SIEM - specifically monitor for workflow file creation or modification events from unexpected actors. Rotate any cloud credentials stored as GitHub Actions secrets. Implement IP-based access restrictions on personal access tokens where GitHub Enterprise supports it (MITRE ATT&CK: T1528 Steal Application Access Token, T1588.002 Obtain Capabilities: Tool).

DreamHost Forces Password Resets Without Disclosure

DreamHost - a hosting provider serving millions of websites - forced password resets across email and FTP accounts over the weekend without disclosing the root cause. Service disruptions affected customers through Sunday. The absence of a public incident report means that organizations with any assets hosted on DreamHost infrastructure cannot currently assess their own exposure.

What defenders should do: If your organization hosts any applications on DreamHost, rotate all associated credentials immediately - not just the ones DreamHost reset. Review access logs for any anomalous activity during the incident window. Evaluate whether your third-party hosting risk program includes breach notification SLAs and credential compromise response triggers.

Defender Action Items

  • CVE-2026-111497 (HTTP2Shell): Patch .NET, Node.js, PowerShell, and any other runtime using Brotli decompression. Deploy IPS/WAF rules for malformed HTTP/2 content-encoding. Use SBOM tooling to identify embedded Brotli instances in container images.
  • CVE-2026-109618/109619 (PHP2Shell): Patch all PHP installations. Enumerate PHP-based network management tools and OT appliances. Review Palo Alto, Siemens, and Schneider advisories for product-specific guidance. CISA KEV deadline is Thursday October 30.
  • Gheist (GitHub Actions): Audit personal access token scopes and expirations. Forward GitHub audit logs to SIEM. Rotate cloud credentials stored as Actions secrets. Monitor for unexpected workflow file creation.
  • DreamHost: Rotate all credentials on DreamHost-hosted assets. Review hosting vendor risk SLAs.

Detection Spotlight

Organizations should monitor for HTTP2Shell exploitation attempts by alerting on anomalous HTTP/2 responses with oversized or malformed Brotli content-encoding payloads. The following Splunk SPL query surfaces HTTP/2 transactions where the content-encoding header specifies Brotli and the response body size exceeds expected decompression ratios - a signature of exploitation attempts:

index=proxy OR index=web sourcetype=stream:http
| where http_version="2.0" AND content_encoding="br"
| eval ratio=content_length / bytes_out
| where ratio > 100 OR content_length > 10485760
| stats count by src_ip, dest_ip, uri_path, content_length, ratio
| where count > 3
| sort -ratio

This query targets HTTP/2 traffic where Brotli-encoded responses exhibit a decompression ratio exceeding 100:1 or a raw content length over 10 MB - both indicators of a malicious payload designed to trigger the memory corruption in CVE-2026-111497. Expect false positives from legitimate high-compression content (large JSON APIs, media transcoding services); tune the ratio threshold based on your environment’s normal Brotli usage.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.