Security news.
Critical remote code execution flaws in PHP have officially entered active exploitation, prompting urgent catalog additions and federal patching directives from CISA. Meanwhile, vendors and platform operators are responding to high-severity infrastructure threats, ranging from emergency Brotli library updates to credential resets and massive hardware recalls. System administrators and developers should prioritize patching core web software and reviewing access controls across edge services.
CISA Adds Actively Exploited PHP2Shell Flaws to KEV Catalog
CISA confirmed active exploitation of two critical PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2), issuing a strict patch mandate for federal agencies. Industrial control vendors and web infrastructure operators globally are scrambling to secure exposed deployments against ongoing attacks.
Critical 'HTTP2Shell' Brotli Flaw Triggers Emergency Ecosystem Updates
A critical memory corruption flaw in the Brotli C decompression library (CVE-2026-111497) has forced emergency security updates across Node.js, Microsoft .NET, and Windows PHP distributions. The bug can lead to code execution and sensitive data access, specifically when automated HTTP response decompression is triggered via components like cURL.
Microsoft Authenticator Android Bug Let Unprivileged Apps Steal Work Tokens
Microsoft patched CVE-2026-80097 in Authenticator for Android, resolving a flaw where malicious, permissionless apps could masquerade as trusted services like Teams to hijack corporate sign-in tokens. Administrators should ensure mobile users update to Authenticator version 6.2606.4246 or later.
Apple Patches Over 280 Flaws, Backports Exploited CoreGraphics Zero-Day
Apple issued comprehensive security updates across iOS and macOS 27.2 while backporting fixes for an actively exploited CoreGraphics zero-day to older iPhone and iPad models. The targeted flaw had previously been weaponized in sophisticated, highly tailored attacks against iOS hardware.
Keystone Destroys 18,835 Hardware Wallets Following Device Key Theft
Hardware wallet manufacturer Keystone announced the destruction of nearly 19,000 units after attackers breached its web infrastructure and stole the private key used to authenticate physical devices. While existing customer funds were not directly impacted, the stolen key could have enabled attackers to manufacture undetectable counterfeit hardware.
DreamHost Forces Email and FTP Password Resets Following System Incident
Hosting provider DreamHost initiated mandatory password resets across webmail and FTP/SFTP accounts following an unresolved security incident that disrupted File Manager access. Details regarding the intrusion's scope remain limited as the company works to secure customer environments.
Australian Authorities Neutralize Amadey Botnet Controller Spanning 180,000 Hosts
Operators from the Australian Signals Directorate breached the backend infrastructure of a major cybercriminal operation, severing access to over 180,000 endpoints worldwide compromised by the Amadey infostealer. The coordinated disruption halts active data theft operations targeting infected hosts across multiple continents.
Lazarus Group Deploys Post-Quantum Encrypted Malware in South Korea
North Korea's Lazarus Group compromised South Korean security software to deploy malware leveraging post-quantum encryption algorithms in an espionage campaign dubbed Operation FlashHole. The intrusions targeted critical manufacturing, construction, and telecommunications equipment sectors.