Whole-of-state defense: How SLED agencies can secure critical infrastructure in the AI era

Tenable reports on multiple cybersecurity topics, with the most urgent involving actively exploited critical remote-code-execution vulnerabilities in PHP (PHP2Shell: CVE-2026-109618 and CVE-2026-109619) and a critical out-of-bounds write in Google Brotli (CVE-2026-111497). The PHP flaws affect widely deployed PHP web infrastructure, have public working exploitation and broad attempts in the wild, and are listed in CISA KEV. Brotli2Shell also has public PoCs, affects numerous runtimes and proxies, and is listed in KEV. Additional posts address shadow AI governance, multilingual AI threat deteอ,