HTTP2Shell Brotli RCE - CVE-2026-111497 CVSS 9.2
CVE-2026-111497 Brotli RCE hits Node.js, .NET, PHP, Python. PHP2Shell CVE-2026-109618 on CISA KEV with Thursday deadline. Gheist steals GitHub secrets.
Posts tagged: Cybersecurity
Brotli RCE Hits Node.js, .NET, Python - Patch Now
Brotli compression library RCE affects Node.js, .NET, PowerShell, and Python. Gheist steals GitHub secrets via Actions.
M365 Token Replay Hits 79 Orgs - MFA Bypassed
M365 AitM token replay campaign breached 97 accounts across 79 orgs. Gheist steals GitHub secrets via Actions logs. AI agent hijacked by AGENTS.md file.
Storm-0940 AI Agent OAuth Breach - 3 Hours
Storm-0940 used ARTEX AI agent to breach ConnectWise OAuth in under 3 hours. Railway PaaS secrets exposed. VeloCloud zero-day patched.
VeloCloud Third Zero-Day - SD-WAN Under Siege
VeloCloud Orchestrator hit by third zero-day in four months. Storm-0940 used AI to breach 2,200 MSPs in 3 hours. PHP discloses second unpatched RCE.
Storm-0940 AI Attack Hits Hundreds in 3 Hours
Storm-0940 used agentic AI for a 3-hour supply chain breach via ConnectWise. Plus GitLab CVSS 10.0 RCE and PHP2Shell exploited pre-patch.
Critical PHP RCEs Leaked Pre-Patch - CVE-2026-109618
CVE-2026-109618 and CVE-2026-109619 PHP RCE details leaked before patch. Plus Tor exit node hijacking and eMudhra CA key compromise forces cert reissuance.
eMudhra CA Keys Compromised - Forged Certs Now Possible
eMudhra CA private keys recoverable - forged certificates possible. ConnectWise resets all OAuth credentials after 173-tenant breach.
OVHcloud CLI Backdoored - 94 Minutes of Stolen Secrets
OVHcloud CLI hijacked via compromised GitHub account for 94 minutes. Qilin and Inc ransomware exploit PAN-OS CVE-2026-0257.
Broadcom Wi-Fi RCE Needs Zero Auth - Just Proximity
Unpatched Broadcom Wi-Fi chipset flaw gives root via radio range. ConnectWise Cloud Backup MSP supply chain compromise. SiteGuard WAF zero-day exploited.