#PHP

Brotli CVE-2026-111497 extends beyond Node.js to Python, .NET and PHP dependencies

Brotli's CVE-2026-111497 is now in CISA's exploited-vulnerability catalogue. Exposure depends on the decoder and data path, with distinct fixes for Node.js, Python, .NET and PHP Windows builds.

PHP2Shell enters the KEV catalogue: exploitation, patching and verifying runtime coverage

CISA lists PHP's CVE-2026-109618 and CVE-2026-109619 as exploited. Complete remediation requires patched serving runtimes, worker restarts and checks for distribution backports.

PHP session upload progress notice: identifying the exposed configuration

PHP's 23 October notice identifies a narrow session configuration exposed to a further code execution vector and recommends disabling upload progress pending a regular bugfix release.