The Node2Shell vulnerability in the Brotli decoder, CVE-2026-111497, is now being exploited, with exposure extending beyond the affected Node.js releases. Node.js published fixes on 21 October, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 27 October. Two honeypot operators have recorded exploitation attempts, although one involved a broken exploit. The flaw resides in Google's Brotli library, leaving any product that bundles a vulnerable version potentially affected. Microsoft and PHP have issued their own updates for affected software. Qualys telemetry indicates that only 42,000 of approximately three million Node.js installations have been patched, while 1.7 million run end-of-life versions that will not receive a fix. Depending on the affected implementation and exploitation path, the vulnerability can result in memory disclosure, denial of service or remote code execution. The telemetry suggests that remediation remains limited, while a substantial number of installations are running unsupported versions.

Oracle's PeopleSoft and E-Business Suite vulnerabilities have emerged in parallel, but involve distinct attack paths. CVE-2026-35273 covers three weaknesses reported by researchers and addressed by Oracle under a single identifier in June. The attack chain begins with server-side request forgery in the Integration Gateway, allowing access to the Environment Management Hub, which trusts loopback connections by default. An attacker can then write a JSP web shell to an arbitrary path or plant a malicious XML file that is deserialised when the hub next initialises. The latter route does not require a web shell, potentially making detection more difficult. ShinyHunters has reportedly exploited the vulnerability as a zero-day since May, and Mandiant has observed continued mass exploitation. Grouping the three weaknesses under one CVE may complicate vulnerability identification and reporting, and researchers are coordinating efforts to obtain separate identifiers. A second flaw, CVE-2026-101767, is an unauthenticated SQL injection in E-Business Suite that can be chained to remote code execution. Decoy systems recorded probing on 27 October, days after Oracle's October patch. For organisations affected by the PeopleSoft attacks, applying the patch alone will not remove web shells already installed on compromised systems.

New research into a PHP2Shell intrusion illustrates how a compromised firewall management interface can provide a route into an internal network. According to artefacts analysed by Dream, the campaign scanned approximately 19,000 firewalls and fingerprinted around 5,000 live devices. The attackers narrowed their targets to 240 devices in the United States, Japan, Taiwan and South Korea, gained root access to 24, and later added a 25th server. Twenty-two of the initial 24 were left with web shells, while two belonging to a US government-affiliated organisation were used to establish a reverse SSH tunnel into the internal network. From the firewall management server, the attacker recovered a decrypted LDAP service-account password and enumerated the Active Directory domain. It remains unclear whether subsequent attempts at password spraying, backdoor account creation or SAML key extraction succeeded: the relevant results remained on the server and were not recovered by researchers. No named threat actor has been attributed to the campaign. The researchers cite indicators suggesting a possible Chinese nexus, including FOFA use, UTC+8 timestamps and Chinese-language prompts. AI tooling found during the investigation suggests that development may have been AI-assisted, but does not establish that the operation was autonomous.

Oracle patched CVE-2026-35273 under a single identifier, though researchers reported three separate PeopleSoft vulnerabilities to the company. A server-side request forgery in the Integration Gateway lets attackers send requests from the localhost address, which the Environment Management Hub trusts by default. This access allows arbitrary file writes and deserialisation of untrusted data, leading to remote code execution exploited by ShinyHunters.

Artem Stryzhak, 36, received a 70-month prison sentence for conspiracy to commit computer fraud as an affiliate of the Nefilim and Hive ransomware groups. Hive attacked approximately 1,500 victims worldwide between June 2021 and January 2023, with the combined attacks causing more than $100 million in losses. Stryzhak was arrested in Spain in June 2024, extradited in April 2025 and pleaded guilty in December 2025.

An attacker chained the PHP2Shell remote code execution flaw with the Fragnesia kernel vulnerability to gain root on 25 servers. The targets were firewalls with exposed management interfaces in the United States, Japan, Taiwan and South Korea. In one US government-affiliated environment, the attacker created a reverse SSH tunnel and launched Active Directory attacks.

US authorities seized virtualine.net, the website of Virtualine, a bulletproof hosting provider that advertised its services to criminals on cybercrime forums. Court records say it knowingly hosted a forum selling sexually explicit images of minors despite notices from law enforcement agencies and NCMEC. Virtualine also accepted unhosted bitcoin payments from criminal customers and laundered the funds to conceal their origin.

CVE-2026-97631 is a buffer overflow in the PXE Base Code driver of TianoCore EDK II, the open source codebase behind most server UEFI firmware. An attacker with local network access can send an oversized ICMP error message during network boot to execute code in ring 0 before Secure Boot loads. The advisory was published after a pull request exposed the fix ahead of a coordinated disclosure planned for January.

UAT-11473 exploited CVE-2026-20127, an authentication bypass in Cisco Catalyst SD-WAN Controller, to install a custom malware framework called KeyDrift. Its PolyFlame module injects into vdaemon processes, while LittleFilch intercepts decrypted control traffic to extract data-plane keying material. Observed targets include space and satellite services, defence and aerospace technology, and policy research organisations.

CVE-2026-111497, known as Node2Shell, is a critical buffer overflow in the Brotli decoder affecting multiple Google Brotli versions and products that rely on them. Successful exploitation can lead to memory disclosure, denial of service or remote code execution. Node.js released fixes on 21 October, and CISA added the flaw to its Known Exploited Vulnerabilities Catalog on 27 October.

Doorway is a Rust-based exploitation engine with 59 modules that targets routers, cameras, optical network units and Java services. Its scans between September and October 2026 recorded 11,363 compromised devices and 58,920 second-stage payload downloads. Exposed operator files also showed 7,369 successful MikroTik authentications and 20 Jenkins servers with confirmed remote code execution.