PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw

The feed reports multiple significant cybersecurity developments, including active exploitation of critical vulnerabilities, supply-chain compromises, token theft, ransomware operations, malware campaigns, and sandbox or boot security bypasses. Key issues include the Brotli decoder memory-corruption flaw CVE-2026-111497 affecting PHP, Node.js, Bun, Python and other software; actively exploited Collabora Online and Arista VeloCloud flaws tracked by CISA KEV; Microsoft 365 adversary-in-the-middle token replay; stolen GitHub token abuse; and ransomware and state-sponsored intrusion activity.