PHP2Shell now has clearer evidence of successful exploitation. Perplexity researcher Adel Karimi's honeypots recorded 35 shell executions on 24 October across three honeypots, originating from two IP addresses. The attackers used a four-stage request chain: some requests exhausted PHP's memory, others leaked its contents, and the final request executed a shell command. The traffic closely matched a public proof of concept and was consistent with CVE-2026-109618. Karimi cautions that the results reflect an intentionally favourable setup using a single-worker mod_php configuration on PHP 8.4.26, and do not establish how reliably the exploit works in other environments. No second-stage payload download was observed. On 26 October, CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalogue, following a statement on 23 October that it had not observed successful exploitation. Earlier reports differed, with Sophos confirming one compromise and CrowdStrike finding none, making Karimi's results the clearest evidence so far of the full exploit chain reaching shell execution. Separately, the PHP Foundation has published mitigations for CVE-2026-115560 rather than a patch, citing the unusual combination of configuration and application code required for exploitation.

The patching footprint for Brotli CVE-2026-111497 continues to expand, although the conditions for exploitation and the impact remain subjects of debate. On 25 October, Microsoft released out-of-band fixes covering .NET 8, 9 and 10, .NET 11 Release Candidate 3, Visual Studio and PowerShell. Microsoft assigns the flaw a CVSS v3.1 score of 8.1, classifies it as an elevation-of-privilege vulnerability and rates exploitation as “More Likely”. PHP also rebuilt its official Windows packages for versions 8.2 to 8.5 after identifying the vulnerable Brotli 1.2.0 library in earlier x64 Non Thread Safe builds. Because the version number remains unchanged, the -1 filename suffix and published SHA-256 hash distinguish the fixed packages. Exposure depends on cURL automatically decompressing responses, a behaviour that is disabled by default but enabled by Guzzle by default, according to The Hacker News, which has not tested the behaviour on Windows. Imperva has demonstrated code execution in one Node.js image, while some researchers assess the flaw as limited to denial of service. No exploitation in the wild has been reported.

The testmetest campaign has proved substantially larger than initial findings suggested. SafeDep reported on 22 October that it had found no compromised third-party packages or victims. JFrog subsequently identified 42 armed repositories belonging to 11 legitimate owners, with account hijackings dating back to July. The payload files, ranging from 12.9 to 13.7 MB, exceeded the limits of GitHub code search indexing and the contents API, causing the initial sweep to misclassify them as empty. Each file decodes to the same publisher, which uses stolen GitHub and npm credentials to publish malicious packages. Execution hooks target Claude, Gemini, Cursor and VS Code. JFrog also found that September commits copied or forged legitimate author dates. A later group of packages uses a native addon to decrypt a hidden .napi_cache file, then exits when running in CI systems, containers or debuggers. JFrog has linked shellpanel workflows scanning for the cPanel vulnerability CVE-2026-41940 to the same hijacked owners, but has found no confirmed downstream compromises of cPanel systems.

A researcher reported that attackers successfully exploited PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, to execute shell commands on honeypots running PHP 8.4.26 under Apache mod_php. On 24 October, sensors recorded 35 shells across three honeypots, using a four-stage request chain that leaked memory and then ran a command. CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalogue on 26 October.

PHP rebuilt its official Windows packages for versions 8.2 to 8.5 to fix CVE-2026-111497, a Brotli flaw that can corrupt memory and potentially allow code execution. The flaw is reachable through the cURL extension when automatic decompression of HTTP responses is enabled. The earlier builds shipped Brotli 1.2.0, while the new packages include fixed version 1.2.1.

Arctic Wolf analysed more than 400 incidents in which attackers used Microsoft Teams external chat, which is enabled by default, to pose as IT helpdesk staff. Many cases began with email bombing, followed by a chat or call from a throwaway tenant, leading victims to install remote access tools such as Quick Assist. Payload execution followed in under 15 minutes, and roughly half of paid attacker domains used the .top domain.

Google's Brotli decoder contains CVE-2026-111497, an out-of-bounds write that a crafted compressed stream can use to corrupt memory, with Imperva demonstrating code execution on a Node.js 24.22.0 image. Node.js and the Python Brotli and brotlicffi packages were patched last week, and Microsoft issued fixes for .NET, Visual Studio and PowerShell on 25 October. A proof-of-concept exploit has been published, but no exploitation in the wild has been reported.

JFrog identified 42 armed GitHub repositories across 11 legitimate owners tied to the testmetest npm campaign, each containing hooks for AI coding assistants and IDEs and a polymorphic wrapper of 12.9 to 13.7 MB. The wrappers decode to the same hidden CI publisher, which uses stolen tokens to publish malicious npm releases. Later packages use a native addon that decrypts a hidden file and refuses to run in CI systems, containers and debuggers.

Infoblox identified two unrelated operations that used unauthorised DNS access to host illegal gambling content beneath school and government domains. The actor Hidden Hawk added CNAME records pointing to Cloudflare Pages, with more than 850 entry points across eight domains in Bangladesh, India and Mexico. A separate actor delegated subzones of an Indian government domain to third-party nameservers and used a wildcard record.