PHP and Brotli under active exploitation: October 2026 criticals

We checked CISA's KEV catalogue and the NIST database on 1 November 2026 to write this. This is not a «vulnerabilities of the month» list copied from a headline: these are the ones with confirmed exploitation in the wild, and the ones that, given the product affected, are likely sitting in your infrastructure without you knowing.

Start with the first two. The rest is context.

What it means for a CVE to be in KEV

CISA's Known Exploited Vulnerabilities catalogue does not list everything published: only what someone is actually exploiting, with evidence. Being on it means two things:

• Attackers are already using it. It is not a lab proof of concept.
• CISA sets a deadline to patch across US federal agencies. It is a good urgency gauge even if your company is not public sector: if they allow three days, you do not get a month.

CVE-2026-109618: remote code execution in PHP

The most urgent item, and not only because of its severity, but because of where it lives.

• Severity: 9.8 out of 10 (critical).
• Impact: memory corruption leading to unauthenticated remote code execution. The flaw is in how out-of-memory errors are handled: the context is not properly cleaned and the later cleanup routine reads memory it should not.
• Fixed versions: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The declared range reaches back to 7.3.0, so if you are carrying an old version, check the vendor advisory.
• Status: added to KEV on 26 October 2026, remediation deadline 29 October. That deadline has already passed.

Why does it matter to an SME? Because PHP is not a program you install and forget: it is the engine behind your company website, your content management system, the old forum nobody maintains and the intranet a supplier built in 2019. Often there are several PHP versions side by side on the same host, and only the one in use gets updated.

What to do: identify what version runs on each site (a phpinfo page or the hosting panel will tell you), update to the latest of your branch, and if your CMS cannot support that branch, the CMS is the problem, not the patch.

CVE-2026-111497: overflow in the Brotli decoder

This is the one that will be underestimated, because the product name sounds like nothing.

• Severity: 9.8 (critical).
• What Brotli is: the compression algorithm almost every web server and browser uses to send HTML, CSS and JavaScript faster. It sits inside Nginx, CDNs, Python libraries and Node.js.
• The flaw: a crafted compressed stream causes a buffer overflow in the decoder. It can corrupt adjacent memory, disclose sensitive contents, crash the process or allow code execution.
• Fixed versions: 1.0.10, 1.1.1 and 1.2.1. Everything from 1.0.3 upwards before those is affected.
• Status: added to KEV on 27 October 2026, deadline 10 November.

The detail that makes it dangerous: Node.js also shipped patches, because its Brotli decoder is reachable from compressed HTTP requests. If your site or API runs on Node, that is the entry path. The 22 branch needs at least 22.23.4.

What to do: do not look for «Brotli» in your hosting panel, it will not be there. Ask your provider for the system's libbrotli version, update Node if you use it, and check whether your CDN has already fixed it on their side.

Other October criticals worth reviewing

Not (yet) in KEV, but 9.x and affecting products common in corporate environments:

• Traefik before 2.11.58 and 3.7.13 — 9.3. A flaw in !Host() rules lets clients skip client-certificate verification and reach services you believed were protected by mTLS. If you expose internal panels behind Traefik, check it.
• Authlib (Python, OAuth and OpenID Connect) — 9.1. Several flaws allow forging JWT tokens and impersonating any user. If you built your own login with this library, it is a priority.
• Pillow before 13.0.0 (Python) — 9.8. Four separate flaws when processing crafted TIFF, FlashPix or JPEG files. Critical in any application that accepts image uploads and resizes them.
• IBM MQ — 9.8. Stack overflow when processing TLS certificates with malformed distinguished names during channel setup.
• Oracle Enterprise Manager for Oracle Database 13.5 and 24.1 — 9.9. Allows taking over the manager with low-privilege credentials.
• Incus 7.0.0 to 7.0.1 and 7.1.0 to 7.4.x — 9.9. Path traversal when importing a crafted backup; compromises the host.
• Silicon Labs EmberZNet 9.1.1 and earlier — 9.8. Out-of-bounds write in the Zigbee protocol. Relevant if you build or deploy connected devices.

How to prioritise without a team of twenty

The temptation is to start with the highest score. That is a mistake. The right order has three filters:

1. Is it exposed to the internet? A 9.8 on an internal server with no outbound path is less urgent than a 7.5 on the public portal.
2. Is there confirmed exploitation? KEV first, always. A flaw nobody uses yet gives you days; one already being exploited gives you hours.
3. Is it reachable without authenticating? Unauthenticated issues come before authenticated ones.

With those three filters, this month's order is clear: PHP and Brotli first (active exploitation), then Authlib and Traefik if you use them (they break authentication), then the rest by exposure.

Patching is not enough

A patch arrives too late if the attacker is already in. After updating, check two things:

• That nobody was there before. Odd access logs, processes you do not recognise, new accounts with permissions. In PHP, a .php file with a random name in an uploads folder is the classic webshell signature.
• That no old copy remains. The staging server, the test environment and the backup restored «just in case» still run the vulnerable version. It is the most repeated finding we see in audits.

Your next step

If you have no inventory of what versions run in your company, you cannot prioritise any of the above. And that inventory starts with what is visible from outside.

Our free OSINT audit tells you which domains, subdomains and services you have exposed —including the ones you forgot— and delivers a report within 72 hours without touching your systems. If you want to test whether those versions hold up to a real attack, we do that with penetration testing authorised in writing.

Sources checked on 1 November 2026: CISA KEV catalogue, NVD — CVE-2026-109618, NVD — CVE-2026-111497 and NVD — CVE-2026-114656.