Cybersecurity

Tuesday’s brief: PHP2Shell attacks now work, then GitHub secret dumps, a Linux root exploit and .NET Brotli fixes

Tuesday’s brief: PHP2Shell attacks now work, then GitHub secret dumps, a Linux root exploit and .NET Brotli fixes

PHP2Shell CVE-2026-109618 exploited and on CISA KEV, Gheist GitHub secret dumps, a Linux skb_zerocopy root exploit and .NET fixes for Brotli CVE-2026-111497, with first steps.
Microsoft rushed out .NET and PowerShell fixes for the Brotli bug. Rebuild the apps that carry their own copy

Microsoft rushed out .NET and PowerShell fixes for the Brotli bug. Rebuild the apps that carry their own copy

Microsoft released out-of-band .NET 8.0.33, 9.0.22 and 10.0.14, plus PowerShell and Visual Studio fixes, for Brotli CVE-2026-111497. PHP rebuilt its Windows packages too.
A public Linux exploit turns any local user into root on Ubuntu, Debian and AlmaLinux. Close the path now

A public Linux exploit turns any local user into root on Ubuntu, Debian and AlmaLinux. Close the path now

A public exploit for Linux kernel bug ZDI-CAN-33367 in skb_zerocopy gets root on Ubuntu 24.04, Debian 12 and AlmaLinux 8-10. Patched AlmaLinux kernels, user namespace mitigation.
Stolen GitHub tokens are dumping secrets from private repositories. Search for ci-sync branches today

Stolen GitHub tokens are dumping secrets from private repositories. Search for ci-sync branches today

Wiz found 13,500+ Gheist ci-sync branches from 850+ stolen GitHub accounts dumping Actions secrets in private repos and GitHub Enterprise Server. Indicators, hunts and fixes.
PHP2Shell attacks now open working shells. Patch every PHP server and check it for intruders by Thursday

PHP2Shell attacks now open working shells. Patch every PHP server and check it for intruders by Thursday

CISA added PHP2Shell CVE-2026-109618 and CVE-2026-109619 to KEV on Oct 26, due Oct 29, after honeypots logged working shells. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then hunt.
No Featured Image

Incident Response Certifications Compared: GCIH, ECIH, CySA+ and GCFA (2026)

Incident response certifications compared: GCIH, ECIH, CySA+ and GCFA exam formats, prerequisites, DoD 8140 role 531 levels, and which to take first.
Monday’s brief: ConnectWise Cloud Backup comes back, then Aruba Wi-Fi fixes, a Brotli update and Nextcloud’s KEV deadline

Monday’s brief: ConnectWise Cloud Backup comes back, then Aruba Wi-Fi fixes, a Brotli update and Nextcloud’s KEV deadline

ConnectWise Cloud Backup restores, Aruba AOS CVE-2026-79844, Brotli CVE-2026-111497 in Node.js and Python, and Collabora CVE-2026-110447 on CISA KEV, with first steps.
CISA confirms attacks on Nextcloud’s Collabora CODE app. The federal fix date is today

CISA confirms attacks on Nextcloud’s Collabora CODE app. The federal fix date is today

CISA added CVE-2026-110447 in Nextcloud’s Collabora Built-in CODE Server app to KEV on Oct 23, due Oct 26. Update richdocumentscode to 26.4.303 or remove it, then hunt for web shells.
A Brotli decoder bug sits inside Node.js, Python and Envoy. Update each one, then restart

A Brotli decoder bug sits inside Node.js, Python and Envoy. Update each one, then restart

CVE-2026-111497 in Google Brotli 1.0.3-1.2.0 reaches Node.js, Bun, Envoy and Python Brotli packages. Update to Node.js 22.23.4, 24.22.1 or 26.12.1, Brotli 1.2.1, then restart.
Aruba wireless controllers and access points have eight 10.0 flaws. Plan the AOS upgrades this week

Aruba wireless controllers and access points have eight 10.0 flaws. Plan the AOS upgrades this week

HPE advisory HPESBNW05162 fixes 72 AOS-8 and AOS-10 flaws, eight rated 10.0 (CVE-2026-79844 to 79851). Upgrade to 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 or 8.10.0.24.
ConnectWise Cloud Backup starts coming back Monday. Check your Microsoft 365 tenants before you reconnect

ConnectWise Cloud Backup starts coming back Monday. Check your Microsoft 365 tenants before you reconnect

ConnectWise targets Oct 26 to start restoring Cloud Backup (SkyKick) after its app credential was abused in Microsoft 365 tenants. App IDs, IOCs and checks before reconnecting.
Best AI Security Certifications (2026): Which One Fits Your Role

Best AI Security Certifications (2026): Which One Fits Your Role

Best AI security certifications in 2026: CompTIA SecAI+, ISACA AAISM, GIAC GAIPS, GOAA and GASAE, IAPP AIGP and more, by role, prerequisite and exam format.
How to Develop a Data Destruction Policy

How to Develop a Data Destruction Policy

Build a data destruction policy that covers asset inventory, data classification, NIST 800-88 destruction methods, vendor chain of custody and certificates of destruction.