Search: CVE-2026-111497

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Since the public disclosure of two critical PHP vulnerabilities on October 21, 2026, exploitation attempts leveraging the PHP2Shell mechanism have been monitored. Although no successful full exploit chains have been observed, private exploits exist and some tools attempt to exploit these vulnerabilities. Challenges such as request-size limits, memory exhaustion, and PHP configuration differences have hindered successful exploitation. Some tools labeled as PHP2Shell exploits actually use unrelated session poisoning techniques requiring separate vulnerabilities. Telemetry indicates a significant reduction in exposed vulnerable machines and affected organizations within one week. Despite limited success so far, PHP2Shell remains a significant security risk requiring immediate attention.

Since September 15, 2026, the Gheist campaign has been abusing stolen GitHub tokens to commit a malicious workflow named sync-check to accessible repositories. This workflow attempts to print repository secrets into logs, which are then exfiltrated via GitHub's API before the logs are deleted. The campaign has affected over 850 compromised accounts and more than 13,500 planted branches, impacting both personal and enterprise private repositories. GitHub's approval controls have prevented exploitation in public repositories, but private and enterprise repositories remain vulnerable. The campaign operates without a command-and-control server, uses the user agent 'gheist', and has multiple evolving variants. Approximately two-thirds of affected accounts have been removed by GitHub, likely as a response measure.