Vulnerability Briefs

Plain-language briefs on new vulnerabilities: what is affected, how the bug works, how to check your own site and what to patch first, with primary sources.

• CVE-2026-111497

  HTTP2Shell (CVE-2026-111497): Is Your App Affected, and What to Patch

  A memory-corruption bug in the Brotli decoder, disclosed on 21 October 2026, reaches Node.js, Python HTTP clients, curl and proxies. How it works, how to check your own app in five minutes, and which versions fix it.

• CVE-2026-109618

  PHP2Shell (CVE-2026-109618, CVE-2026-109619): What Happened and What to Patch

  Two unauthenticated remote code execution bugs in PHP itself sent governments offline on 21 October 2026. What went wrong inside PHP, why a third of PHP sites have no official fix, how to check your own servers, and what to do today.