Security news.
Critical software components and network edge appliances are facing active threats today, headlined by widespread memory corruption issues in Brotli decompression libraries and new CISA KEV additions. At the same time, fallout continues from a major supply chain compromise affecting LiteLLM, alongside active exploitation attempts targeting newly disclosed PHP core vulnerabilities.
Brotli Decoder Buffer Overflow Exposes Multiple Runtimes to RCE
A critical memory-corruption flaw (CVE-2026-111497) in Google's Brotli decoder impacts Node.js, Bun, Python packages, and Envoy proxies, enabling remote code execution via malformed compressed payloads.
CISA Adds Actively Exploited Collabora and Arista Flaws to KEV Catalog
CISA warned of in-the-wild exploitation for Collabora Online CODE Server (CVE-2026-110447) and an Arista VeloCloud Orchestrator SQL injection bug (CVE-2026-114625).
LiteLLM Master Key Leak Leads to Malicious PyPI Package Injection
A leaked Agent Platform key allowed attackers to hijack the LiteLLM release pipeline and push compromised packages that stole developer tokens and environment variables.
PHP Releases Workarounds for New Unpatched RCE Risk
Following emergency patches for the "PHP2Shell" flaws, the PHP project disclosed an unpatched RCE risk (CVE-2026-115560) affecting non-default configurations and provided defensive mitigations.
Mirai Botnet Mounts Exploitation Campaigns Targeting PHP2Shell
Threat actors have begun scanning and targeting systems vulnerable to recent critical PHP core bugs (CVE-2026-109618 and CVE-2026-109619) using newly developed ASLR bypass techniques.
HPE Patches Eight Maximum-Severity RCE and Auth Bypass Bugs in ArubaOS
Hewlett Packard Enterprise issued critical updates fixing 72 vulnerabilities across ArubaOS, including multiple flaws allowing unauthenticated remote code execution.
Ruby Patches Regex Bugs Tied to Critical GitLab Remote Code Execution
Ruby published security releases resolving three Onigmo regular expression engine flaws that previously enabled remote code execution chains inside GitLab.