Whole-of-state defense: How SLED agencies can secure critical infrastructure in the AI era

Tenable reports active exploitation and public exploit availability for two critical unauthenticated PHP remote code execution vulnerabilities (PHP2Shell, CVE-2026-109618 and CVE-2026-109619), which CISA added to its Known Exploited Vulnerabilities catalog. It also describes Brotli2Shell (CVE-2026-111497), a critical out-of-bounds write in Google’s Brotli decoder that can enable remote code execution when processing attacker-controlled compressed data. Patches are available for affected PHP, Brotli, and dependent runtimes, but bundled copies require separate remediation. Additional posts cover