Whole-of-state defense: How SLED agencies can secure critical infrastructure in the AI era
2026-10-28T08:52:11Z•2a884429942c33ccd40ad3a698c58cd6ffd9d4c05639532f8f128d9056bea9b1
CVE-2026-109618CVE-2026-109619CVE-2026-111497.NETBrotliBrotli2ShellBunCISA KEVEnvoy ProxyIstioNode.jsPHPPHP2ShellSLEDactive exploitationcritical infrastructureout-of-bounds writepublic PoCremote code executionshadow AIunauthenticated attack
What happened
Tenable reports active exploitation and critical risk from two unauthenticated PHP remote code execution vulnerabilities (PHP2Shell) and a critical out-of-bounds write in Google Brotli (Brotli2Shell). CVE-2026-109618, CVE-2026-109619, and CVE-2026-111497 have public exploitation evidence or proof-of-concept code, and all were added to CISA's Known Exploited Vulnerabilities catalog. Affected software includes PHP deployments, Windows PHP builds, Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients, and other software embedding Brotli. Immediate asset inventory, patching, service restarts
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- tenable_blog
- Record identifier
- 2a884429942c33ccd40ad3a698c58cd6ffd9d4c05639532f8f128d9056bea9b1
- Enrichment time
- 2026-10-28T08:52:11Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.