PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
Linked advisories
- CVE-2026-111497Google Brotli — Google Brotli Unchecked Return Value Vulnerability
- CVE-2026-111497Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder
- CVE-2026-111497Brotli vulnerability
- CVE-2026-111497Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
- CVE-2026-111497OSV-Eintrag
- CVE-2026-111497Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
- CVE-2026-111497Debian LTS brotli: security update
- CVE-2026-111497Google Brotli: Schreiben außerhalb des zugewiesenen Speichers (Out-of-bounds Write)
- CVE-2026-111497Out-of-bounds write in the brotlicffi decoder ("Node2Shell") also affects the PyPI Brotli package
- CVE-2026-111497Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products
- CVE-2026-111497Critical Vulnerability in Node.js
- CVE-2026-111497OSV-Eintrag
- CVE-2026-111497Debian brotli: security update
- CVE-2026-111497Multiple Node.js CVEs
- CVE-2026-111497Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- CVE-2026-111497Node.js Multiple Vulnerabilities
- CVE-2026-111497Node2Shell / HTTP2Shell: Brotli RCE (CVE-2026-111497) in Node.js, Python, Envoy and Istio + Node.js October releases
- CVE-2026-111497Node.js: Mehrere Schwachstellen
Affected vendors and products
More on Execution
Other advisories
- CriticalCVE-2026-116692MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules
- CriticalCVE-2026-116692MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules
- CriticalCVE-2026-114053vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution
- CriticalCVE-2026-114053vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution
- CriticalCVE-2026-110858GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution
- Highghsa:GHSA-f9j4-qggq-h239GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution
- Not ratedCVE-2026-78845Remote Code Execution (RCE) (CVE-2026-78845)
- MediumCVE-2026-114608Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME
Other news entries
- Code-execution flaw in UEFI firmware affects most servers on planet EarthNewsArs Technica — Security
- HPE Patches Dozens of Critical Flaws in Networking ProductsNewsSecurityWeek
- CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code ExecutionNewsThe Hacker News
- Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python PackagesNewsSecurityWeek
- PHP shares mitigation for new RCE vulnerability with no patchNewsBleepingComputer
- HPE patches eight max severity RCE and auth bypass AOS flawsNewsBleepingComputer
- Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted ImageNewsThe Hacker News
- PHP2Shell exploit bypasses protections designed to stop remote code executionNewsThe Register — Security
Source: https://thehackernews.com/2026/10/php-issues-second-windows-security.html
ID