PHP, Plex and Nextcloud's Collabora App Under Attack, Plus a Node.js Fix: Patch & Threat Roundup #1

Top 3 to act on this week

1. Update PHP on every web server. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two flaws that PHP says “can allow unauthenticated remote code execution.” CISA added both to KEV on Oct 26. Details
2. Update or check self-hosted Plex and Nextcloud. Plex says its flaws are “actively and widely exploited.” Collabora says simply disabling Nextcloud’s built-in CODE server app doesn’t fix the problem. Both are in KEV. Plex · Nextcloud/Collabora
3. Roll out the Node.js security releases and check for other copies of Brotli. Node.js 22.23.4, 24.22.1 and 26.12.1 fix a Brotli decoder bug that Node.js says can lead to remote code execution. Brotli also ships inside other products. CISA added the Brotli flaw to KEV on Oct 27, citing evidence of active exploitation. Details

CISA KEV additions, Oct 19–27

This week, CISA added 12 flaws to its Known Exploited Vulnerabilities (KEV) catalog, which lists bugs with evidence of real attacks. Several hit software small teams run themselves: PHP, Plex Media Server, the Collabora server that comes built into Nextcloud, Adobe Commerce and Magento online stores, and the Brotli compression library inside Node.js and many other products. Below them is a batch of fixes for developer tools and runtimes. No attacks have been reported on most of those yet, but they’re worth doing while you’re patching.

The due dates below bind only US federal civilian executive branch (FCEB) agencies, which must fix or mitigate each flaw by that date under CISA’s Binding Operational Directive 26-04. CISA’s Oct 26 alert says the directive “applies only to FCEB agencies.” For everyone else, treat the list as a signal that attacks are already happening. Several due dates below have already passed. CISA lists ransomware use as “Unknown” for all 12.

Source: CISA KEV catalog feed, catalog version 2026.10.27, released Oct 28, 2026, 3:00 a.m. Manila.

Exploited: patch now

PHP: two critical flaws now in KEV

• What happened: On Oct 21, PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP says they fix two critical vulnerabilities that “can allow unauthenticated remote code execution.” CISA added both (CVE-2026-109618 and CVE-2026-109619) to KEV on Oct 26.
• A third bug isn’t fixed yet: PHP’s Oct 23 advisory covers CVE-2026-115560, which PHP calls “an unlikely RCE vector.” It needs an unusual setup: an app that switches session.serialize_handler to php at runtime while session upload progress is on. PHP suggests setting session.upload_progress.enabled=0 until the next regular bugfix release, which will come with the full advisory. PHP says apps that never change the serialize handler at runtime can keep the feature enabled.
• Windows builds: On Oct 26, PHP published new Windows builds (8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1). They bundle Brotli 1.2.1, which fixes CVE-2026-111497. PHP says that bug is reachable through the cURL extension when automatic HTTP response decompression is on, which is off by default in cURL but can be turned on by applications and HTTP client libraries.
• Why it matters: PHP runs WordPress, WooCommerce, Laravel and most shared hosting. PHP says the fix applies to “all PHP installations serving web requests.”
• What to do:
  1. Update to a fixed release, or confirm that your host already has.
  2. If your app changes session.serialize_handler at runtime, set session.upload_progress.enabled=0 until PHP’s next release.
  3. On Windows, install the -1 builds.
  4. If you’re on PHP 8.1 or older, see our story for backport options.
• Checklist: PHP patch checklist
• Sources: php.net news archive (Oct 21, Oct 23 and Oct 26 entries) · CISA alert, Oct 26

Plex Media Server

• What happened: Plex says flaws in Plex Media Server 1.43.2 and earlier “are being actively and widely exploited.” It says a public proof of concept was released on Oct 16. Chained together, the flaws allow remote code execution without a login. Plex says version 1.43.3.10861 and later are not affected. CISA added four Plex CVEs to KEV on Oct 20.
• Why it matters: Plex says compromised servers have been used to run cryptocurrency miners and proxy software. Many small offices and home labs leave Plex reachable from the internet.
• What to do:
  1. Update to 1.43.3.10861 or later.
  2. Plex’s advice: “If your server is older than 1.43.3.10861 and reachable from the internet, assume it may be compromised.”
  3. Work through Plex’s signs-of-compromise list.
• Checklist: Plex patch checklist
• Source: Plex forum security update

Nextcloud: Collabora built-in CODE server

• What happened: Versions of the “Collabora Online – Built-in CODE Server” app for Nextcloud before 26.4.303 have an OS command injection flaw (CVE-2026-110447). 26.4.303 fixes it. CISA added it to KEV on Oct 23.
• Who is affected: Collabora says standalone Collabora Online servers are not affected. Only the built-in app is.
• Why it matters: Small teams often use the built-in app to edit documents in Nextcloud without running a separate office server.
• What to do:
  1. Update the app to 26.4.303 or remove it. Collabora says disabling it is not sufficient.
  2. Check for web shells. Our story lists what to look for.
• Checklist: Nextcloud/Collabora patch checklist
• Source: Collabora advisory GHSA-g3vx-3m76-fghh

Arista VeloCloud Orchestrator (SD-WAN)

• What happened: In an Oct 22 advisory, Arista says CVE-2026-114625 is “known to be actively exploited.” Any signed-in user, down to the Enterprise Read Only role, can gain superuser operator access. Arista rates it CVSS 3.1 9.9.
• Who needs to act: Arista says hosted and dedicated VeloCloud Orchestrators are already patched. On-premises customers need to update.
• What to do:
  1. Update to 5.2.3.18, 6.1.3.10 or 6.4.2.12.
  2. Block the two IP addresses listed in Arista’s advisory.
  3. Preserve logs before making changes.
• Source: Arista Security Advisory 0199

Node.js and Brotli (CVE-2026-111497)

• What happened: On Oct 21, Node.js released 22.23.4, 24.22.1 and 26.12.1, fixing 10 CVEs. One is an out-of-bounds write in the bundled Brotli decoder. Node.js says an attacker “who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution.”
• Now in KEV: CISA added CVE-2026-111497, which it lists under Google Brotli, to KEV on Oct 27, citing evidence of active exploitation. CISA doesn’t say which product was attacked.
• Brotli in other products:
  • Ubuntu shipped fixed Brotli packages on Oct 26 for 22.04, 24.04, 26.04 and 26.10 (USN-8956-1).
  • Palo Alto Networks says PAN-OS is exposed only when Brotli inspection and TLS decryption are both on. It released hotfixes on Oct 27 (11.2.10-h17, 12.1.7-h11, 12.2.4-h1) and Oct 28 (11.2.7-h23, 11.2.13-h4, 11.2.16-h1). It lists 12.1.4-h13 as due Oct 29, and 12.1.10-h3 and 11.2.4-h23 as due Oct 30, with a CLI workaround until then. Its advisory, updated Oct 28, still says it is “not aware of any malicious exploitation of this issue.”
  • Fortinet says it is investigating FortiOS and has confirmed many other products are not affected (FG-IR-26-187).
• What to do:
  1. Update Node.js on servers, in CI and in container base images, then redeploy.
  2. Run your OS updates so system Brotli libraries are patched.
  3. On PAN-OS, check show system setting brotli. Install Palo Alto’s hotfix for your version, or follow its workaround until that hotfix ships.
• Checklist: Node.js patch checklist
• Sources: Node.js October 2026 security releases · Palo Alto Networks CVE-2026-111497 advisory · USN-8956-1 · FG-IR-26-187

Also added to KEV this week

• Adobe Commerce and Magento Open Source: CISA added CVE-2026-48356, a file upload flaw, on Oct 27. Adobe fixed it on July 14 in bulletin APSB26-73 and rates it Critical (CVSS 3.1 9.6). Adobe’s bulletin still says Adobe “is not aware of any exploits in the wild.” Our advice: install Adobe’s July 2026 update for your release line (versions ending in -2026-jul); Adobe says Adobe Commerce Events needs 1.21.0. Checklist · Adobe APSB26-73
• SiteGuard Server Edition (EG Secure Solutions): EG Secure Solutions has confirmed exploitation. Affected installs are Ver2.20 and later with the statistics feature on, which it is by default. The fixed versions are Ver8.00 Update5 for Apache, Nginx and IIS, and Ver7.00 Update6 for FreeBSD. Download and keep the 診断情報 (diagnostic information) before updating, because updating may erase traces of an attack. Vendor alert (Japanese)
• Siemens Software Center: This is a local flaw that needs high privileges, rated CVSS 3.1 6.7. Version V4.0.9.8 fixes it and installs automatically on the next startup. Siemens’ advisory references current known active exploitation. Siemens SSA-580366 (V1.2, updated Oct 19)

Patch soon: fixes for builders and self-hosters

None of these was added to KEV in this window. Apart from the Apple fix at the end, which backports a fix for a flaw already in KEV, none has a vendor report of attacks. Most are in software that small teams self-host or build with.

Postiz (self-hosted social scheduler)

• What happened: Postiz published three critical advisories on Oct 23–24:
  • CVE-2026-115933 (CVSS 9.9): forged signed tokens let any registered user take over other users and organizations. Affects 2.15.0 through 2.25.2.
  • CVE-2026-115932 (CVSS 9.6): path traversal lets any registered user read server files. Affects 2.23.0 through 2.25.2.
  • CVE-2026-115931 (CVSS 9.9): arbitrary file read through unrestricted provider method calls. Affects 2.23.0 through 2.25.1; 2.25.2 fixed it.
  • v2.25.3 fixes all three. It was released Oct 24 at 10:16 p.m. Manila.
• Why it matters: Postiz holds the tokens for your connected social accounts. Server files can include the environment file, which holds its secrets.
• What to do:
  1. Update to 2.25.3.
  2. Rotate JWT_SECRET and any secrets in the server environment.
  3. Turning off registration with DISABLE_REGISTRATION reduces the number of people who could exploit these bugs. It does not close them.
• Our story: Postiz fixes 3 critical flaws: update to 2.25.3, rotate secrets
• Sources: CVE-2026-115933 · CVE-2026-115932 · CVE-2026-115931 (CNA: Postiz) · Postiz v2.25.3 release

OpenHands Software Agent SDK (CVE-2026-112346)

• What happened: The CVE record, published Oct 26 by VulnCheck as CNA, covers versions before 1.52.0. It says the Docker and Apptainer workspace launchers bound the sandbox agent server to all network interfaces with authentication off by default. Anyone who could reach the port could run shell commands as root in the sandbox and access the mounted workspace. VulnCheck rates it CVSS 4.0 9.3.
• The fix: OpenHands’ v1.52.0 release notes include “publish Docker ports on loopback” (PR #5209).
• What to do:
  1. Update to 1.52.0 or later.
  2. Make sure agent sandbox ports aren’t reachable from your network or the internet.
  3. Rotate any secrets the sandbox could read.
• Our story: OpenHands SDK and Google’s MCP Toolbox fix critical flaws: update now
• Sources: CVE-2026-112346 · OpenHands SDK v1.52.0 release · PR #5209

Google MCP Toolbox for Databases (CVE-2026-93328)

• What happened: Google Cloud, the CNA, published the CVE record on Oct 26. It says the cloud-storage source in versions 1.2.0 through 1.4.0 lets an unauthenticated remote attacker copy host files out to external Cloud Storage buckets and overwrite local files. Google lists versions from 1.2.0 up to, but not including, 1.5.0 as affected. It rates the flaw CVSS 4.0 9.3.
• The fix adds settings, but they’re open by default: The linked fix (PR #3454) adds allowedBuckets and allowedLocalRoots settings, which, per the PR, “Defaults to allow all.”
• What to do:
  1. Update. The current release is 1.15.0. Updating alone doesn’t restrict anything, because the new settings default to allowing all.
  2. Our advice: if you use the cloud-storage source, set allowedBuckets and allowedLocalRoots explicitly.
• Our story: OpenHands SDK and Google’s MCP Toolbox fix critical flaws: update now
• Sources: CVE-2026-93328 · PR #3454 · MCP Toolbox releases

Laravel TokenGuard (CVE-2026-114509)

• What happened: In an advisory published Oct 19, Laravel says its built-in TokenGuard, used as a standard token-based API guard, “may be bypassed to authenticate as an arbitrary existing user” on some MySQL or MariaDB setups. An attacker does this by sending a crafted non-string credential.
• What to do: Update laravel/framework to 12.68.0 or later on 12.x, or 13.29.0 or later on 13.x.
• Source: Laravel advisory GHSA-f9x3-7vq9-cph6

Parse Server (CVE-2026-116163)

• What happened: Parse Server didn’t run the validation methods of custom authentication adapters built as subclasses of AuthAdapter. Instead it used a default that accepts any authentication data, so an attacker could log in as an existing user without valid credentials for that provider.
• Who is affected: Parse says only apps with such a subclassed adapter are affected. Built-in adapters and adapters defined as plain objects are not.
• What to do: Update to 8.6.102 or later on 8.x, or 9.10.5 or later on 9.x. Parse’s advisory names the pre-release 9.10.5-alpha.2 as the first fixed 9.x build, and the stable 9.10.5, released Oct 16, includes the fix. Parse also lists workarounds.
• Sources: Parse Server advisory GHSA-rq3w-5c6f-p7wr (vendor advisory published Oct 10; CVE published Oct 25) · Parse Server 9.10.5 release notes

Kener status page (CVE-2026-116747)

• What happened: In Kener 3.0.0 up to 4.1.10, leaving KENER_SECRET_KEY empty or unset makes Kener fall back to a hardcoded secret. That lets attackers forge admin sessions. v4.1.10, released Oct 26, removes the fallback and warns about example secrets.
• What to do:
  1. Update to 4.1.10.
  2. Set a strong, unique KENER_SECRET_KEY.
• Sources: CVE-2026-116747 · Kener v4.1.10 release

Pillow (CVE-2026-112398)

• What happened: Pillow says a heap overflow in its FlashPix decoder lets a single crafted file run code when an app opens it with Image.open(). This works when the optional olefile package is installed. Pillow identifies the file type by its content, not its extension.
• Why it matters: Pillow says any service that opens or thumbnails untrusted uploads with the optional olefile dependency installed is reachable with no user interaction.
• What to do:
  1. Update to Pillow 13.0.0.
  2. If you can’t update yet, uninstall olefile if you don’t need it.
• Dates: The advisory and 13.0.0 shipped Oct 16–17 (UTC). The CVE was published Oct 19.
• Source: Pillow advisory GHSA-5x8w-8jj5-q52h

nginx on Ubuntu (USN-8955-1)

• What happened: On Oct 26, Ubuntu fixed five nginx CVEs for 22.04, 24.04, 26.04 and 26.10. Ubuntu says three of them, in alias-plus-rewrite, regex map and asynchronous file I/O with Server Side Includes configurations, could possibly let a remote attacker crash nginx “or execute arbitrary code.”
• What to do: Run your normal updates and reload nginx.
• Source: USN-8955-1

Apple iOS and iPadOS 18.7.11

• What happened: On Oct 26, Apple released iOS and iPadOS 18.7.11 for older devices, back to the iPhone XS and XR. It fixes CVE-2026-86950, a CoreGraphics bug. Apple says it “may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.”
• Context: The same CVE was fixed earlier in iOS 26.7.1, and CISA added it to KEV on Sep 29.
• What to do: Update company iPhones and iPads that can’t run newer iOS.
• Source: Apple: security content of iOS 18.7.11 and iPadOS 18.7.11

Supply-chain incidents: updates in the window

Railway: environment variables exposed

• What happened: Railway’s Oct 22 preliminary report says an attacker had access from Oct 20, 13:58 UTC to Oct 22, 03:32 UTC. During that time, the attacker queried encrypted environment variables and decrypted a subset of them. Railway says its forensic investigation “is still ongoing.”
• What Railway recommends: “all customers who signed up prior to October 21 rotate their keys stored on Railway.”
• Deploying again: Railway’s Oct 23 note says commits pushed during the pause weren’t deployed. Redeploy, reconnect GitHub, and recreate CLI and CI credentials.
• Checklist: What to rotate
• Sources: Railway preliminary report · Railway disclosure, Oct 21

LiteLLM 1.107.0: malicious release

• What happened: LiteLLM says a compromised release pipeline published a malicious litellm==1.107.0 to PyPI on Oct 21. It was live from 11:39 to 13:23 UTC. The Docker tags v1.107.0, latest, main-latest and main-stable were also compromised. LiteLLM says the release contained malware “which steals credentials and loads remote-code execution tools.” It published an attack-chain write-up on Oct 23.
• What to do: If any machine installed or ran those artifacts, rotate everything that host could reach.
• Checklist: What to check and rotate
• Sources: LiteLLM incident post · LiteLLM attack-chain post

ConnectWise Cloud Backup (formerly SkyKick) and Storm-0940

• What happened: On Oct 21, Microsoft said Storm-0940 used the AI agent framework ARTEX to try to sign in to more than 2,250 tenants after unauthorized access tied to ConnectWise Cloud Backup. Microsoft says that an affected app or a successful sign-in “does not necessarily indicate that customer data was accessed or exfiltrated.”
• Latest from ConnectWise: Its Oct 27 update says it has finished preparing a phased partner restoration and is waiting on a required third-party validation before it starts. Affected application connections should stay disabled until ConnectWise provides instructions that apply to your service.
• What to do: Review every Microsoft 365 tenant where the affected apps are or were installed. Search by application ID.
• Checklist: What M365 admins should check
• Sources: Microsoft Security blog, Oct 21 · ConnectWise Trust Center advisories (last updated Oct 27, 14:30 UTC; next update promised by Oct 28, 14:00 UTC)

Updates

• Oct 28, 2026, 6:00 p.m. Manila: First published.