What you need to know today.
Active exploitation of critical PHP and Brotli vulnerabilities, alongside new Android and Apache OFBiz flaws, demands urgent attention.
PHP Vulnerabilities Lead to Active Exploitation: Two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, are being actively exploited in the wild. CVE-2026-109618, a critical flaw with a CVSS score of 9.8, allows for remote code execution by attackers who can manipulate memory due to improper handling of out-of-memory errors. CVE-2026-109619, also critical, involves global state not being correctly reset, leading to potential memory corruption. These flaws have been chained with other exploits, such as those targeting Linux kernels, to gain root access on compromised servers, as reported by multiple security outlets including The Hacker News and Cyber Security News. Palo Alto Networks firewalls with exposed management interfaces have been specifically targeted, with attackers leveraging a custom PHP2Shell exploit.
Critical Brotli Decoder Vulnerability Affects Multiple Platforms: A critical buffer overflow vulnerability (CVE-2026-111497) in the Brotli decoder component of Google Brotli versions 1.0.3 through 1.2.0 poses a significant risk. This flaw allows remote, unauthenticated attackers to corrupt decoder state memory and potentially disclose sensitive information. While WordPress does not ship Brotli by default, sites using it are exposed, as detailed by Wordfence and Patchstack. SecurityWeek and Help Net Security also highlighted this vulnerability, with some reports suggesting it could be exploited for remote code execution, potentially impacting various applications and systems that utilize Brotli compression.
Android and Apache OFBiz Face Critical Exploits: Google has released patches for over 200 Android vulnerabilities, including a critical remote code execution flaw (CVE-2026-58868) in FrameDecoder.cpp that requires no user interaction for exploitation, as reported by Cyber Security News and The Hacker News. Separately, Apache OFBiz versions prior to 24.09.08 are affected by critical vulnerabilities including code injection (CVE-2026-83542) and authentication bypass via capture-replay (CVE-2026-82907). These flaws allow unauthenticated attackers to execute arbitrary code or bypass authentication mechanisms, posing a severe risk to systems running the affected Apache OFBiz versions.