Multiple Critical RCE Vulnerabilities and Supply-Chain Incident Reported in Weekly Recap
Security researchers and threat actors exploit remote code execution flaws; leaked key compromises software supply chain

Key Takeaways
- Multiple critical remote code execution vulnerabilities are currently being scanned and exploited in the wild.
- A software supply-chain incident involving a leaked signing key has been reported, compromising distribution integrity.
- Patching urgency is high; however, specific CVE numbers and affected products are not listed in the source summary.
Related Security News

Emergency patches issued for critical Brotli 'HTTP2Shell' memory corruption flaw
A critical memory corruption vulnerability in the Brotli C decoder library, tracked under the name 'HTTP2Shell', has prompted emergency patches from Google and Node.js maintainers. The flaw could allow attackers to corrupt memory and access sensitive data via crafted HTTP/2 requests. Users are advised to update to patched versions immediately.
CISA Adds Two PHP Vulnerabilities to Known Exploited Catalog, Issues Urgent Patching Advisory
The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. CVE-2026-109618, a PHP memory corruption vulnerability, and CVE-2026-109619, a PHP stale internal request-state vulnerability, have been identified as frequent attack vectors for malicious cyber actors. CISA also issued a PHP Alert emphasizing immediate patching. These additions are reinforced by Binding Operational Directive (BOD) 26-04, which requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets.



