Daily and weekly analysis of enterprise cybersecurity, identity, cloud, AI, vulnerabilities, ransomware, nation-state activity, and operational technology.
CISA added CVE-2026-111497 on 27 October. Due 10 November. Catalog 2026.10.27 / 1760. The row is Google Brotli. Every decoder that still inflates attacker-controlled br is the asset.
CONFIRMED On 27 October 2026 CISA added CVE-2026-111497 — Google Brotli, circulating as Node2Shell / HTTP2Shell / Broccoli2Shell — to the Known Exploited Vulnerabilities catalog. Catalog version is 2026.10.27 / 1760, dateReleased 2026-10-27T19:00:02Z. Vendor/product: Google / Bro
CISA added CVE-2026-109618 and CVE-2026-109619 on 26 October. Both due 29 October. Forensic triage Yes on both. Catalog 2026.10.26 / 1758. A CMS update still does not patch the interpreter.
Read →Wiz 25 October. Stolen GitHub tokens plant sync-check.yml on every reachable repo. Secrets leave as base32 in Actions logs through GitHub's own API. The July hold does not cover private repositories or GitHub Enterprise Server. Deleting the branch is not the rotation.
Read →Vendor RCA 23 October. An unrevoked May master key minted an org-owner GitHub token on 10 October. 1.107.0 wheels and latest Docker tags shipped a credential stealer. cook.pth is outside the package directory. Pinning 1.106.2 is not the hunt.
Read →CISA added CVE-2026-110447 on 23 October. Unauthenticated OS command injection in richdocumentscode proxy.php when the local CODE server is down. Floor is 26.4.303. Due Monday. Forensic triage Yes. Standalone Collabora is out of scope.
Read →Security Advisory 0199, 22 October, is CVE-2026-114625 (CVSS 9.9). Enterprise Read Only is enough to become local superuser operator. Hosted is patched. On-prem needs 5.2.3.18 / 6.1.3.10 / 6.4.2.12. 5.2.3.16 closed September’s 93952, not this. Two IPs. Catalog 2026.10.21 still 1754.
Read →PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 closed CVE-2026-109618 and CVE-2026-109619 on 21 October. CISA and the UK NCSC say take unpatched internet-facing PHP offline. Amazon’s MadPot saw an attempt on 17 October. Neither CVE is on KEV.
Read →Latest
19–26 October 2026. Eight new KEVs, catalog 2026.10.23 / 1,756. PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 — neither CVE is on KEV. Plex assume-compromise. Collabora 110447 and Arista 114625 due today. Storm-0940 named on last week’s SkyKick.
Latest
16–23 October 2026. ProductCERT 19 Oct — CVE-2026-110936 in Software Center exploited via ClickFix; KEV 20 Oct due 3 Nov; ICSA-26-295-03 22 Oct. Same week: WAGO PFC/CC100 8.8 root from a low-priv WBM login until 4.10.0; Moxa AIG-302 1.4.1; Hitachi SYS600 10.8. CISA’s 22 Oct Siemens pack is last Tuesday’s ProductCERT, not a new finding. Edge tickets are Arista VCO and Plex, not a PLC.
RWP Intelligence publishes defensive analysis. RWP Ventures helps organizations assess, architect, implement, and operate cybersecurity and technology programs — principal-led, threat-informed, documented against the frameworks boards and auditors expect.
Open, vendor-neutral defensive knowledge for operational technology and cyber-physical systems, supporting the OT practice at RWP Ventures.
Explore OT Atlas ↗