Cybersecurity

Vendor security advisories, patch windows, and Monday checklists for IT and operations teams.

Last updated Oct 26, 2026

Get this beat in your inbox

CybersecurityOct 26, 2026
Broccoli2Shell: a Brotli decoder bug (CVE-2026-111497) puts Node.js, Bun, Envoy and Python on the patch list
An out-of-bounds write in Google's Brotli decoder (CVE-2026-111497, CVSS 4.0 9.2 from the CNA) can be triggered by crafted compressed data. Fixed Brotli, Node.js, Bun, Envoy, Istio and Python releases shipped 21–23 Oct 2026.
CybersecurityOct 25, 2026
PHP php2shell (CVE-2026-109618 / 109619): patch Monday for every web PHP stack
Unauthenticated RCE fixed in PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. CISA urges immediate patching; Cloudflare WAF is mitigation only. Monday checklist for IT/ops.

Broccoli2Shell: a Brotli decoder bug (CVE-2026-111497) puts Node.js, Bun, Envoy and Python on the patch list