CYBER THREATCAST

Patch or otherwise remediate systems affected by PHP2Shell CVE-2026-109618 and CVE-2026-109619 immediately, then investigate vulnerable servers for credential theft and attempted Active Directory escalation. Attackers are actively exploiting the flaws, have obtained password hashes and MFA secrets, and have pursued Domain Admin access; government, aviation, financial, logistics, manufacturing, and transaction-processing organizations face particular exposure.

Audit ConnectWise-linked Microsoft 365 tenants for unexpected privileged access and invalidate affected integration secrets or sessions where possible. Microsoft linked the compromised ConnectWise API secret to targeting of more than 2,250 customer cloud environments, with some observed activity reaching privileged cloud access in under three hours; ConnectWise customers in government, defense, energy, finance, manufacturing, semiconductor, and technology sectors should treat the exposure as time-sensitive.

Disable Tailscale SSH port forwarding wherever it is not required and apply per-rule forwarding restrictions on hosted Tailscale deployments. Organizations using Tailscale 1.104.2 or headscale 0.29.5 should also limit which authorized devices can reach sensitive servers and account for headscale 0.29.5 lacking the hosted service’s forwarding control. No CVE, advisory, or fixed version was available, while demonstrated chains enabled root-level compromise and, with Tailnet Lock disabled, attacker-controlled device enrollment.

Upgrade Brotli and affected downstream components to patched releases, prioritizing exposed Node.js, Bun, Envoy Proxy, and Python-based services that decompress untrusted Brotli data. CVE-2026-111497 can cause memory disclosure, crashes, corruption, or remote code execution, and researchers demonstrated exploitation in unpatched Node.js environments.

Upgrade affected Next.js applications through version 16.2.3 to an applicable fixed release, including 15.5.16, 15.5.18, or 16.2.5 and later. The vulnerabilities can enable authentication or authorization bypass, SSRF, sensitive server-rendered data exposure, and XSS across affected release branches. No active exploitation was reported, but internet-facing applications should receive priority because several impacts cross trust boundaries.