Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team.

This week, PHP2Shell went from early exploit attempts to working exploits, and CISA added both of its flaws to the Known Exploited Vulnerabilities (KEV) catalog. The brief also covers Brotli2Shell, a flaw in Google's Brotli compression library that CISA added a day later. Microsoft tied the ConnectWise compromise to a China-state aligned actor using AI agents, and SafePay ransomware went after victims' backups.

PHP2Shell moves from exploit attempts to working shells →

Brief: On October 21, PHP fixed PHP2Shell, two critical flaws (CVE-2026-109618 and CVE-2026-109619) that open servers to remote code execution with no login, but exploit attempts had started four days earlier.

Intel: One flaw corrupts memory when a request runs PHP out of memory, and the other lets a later request use memory an earlier one freed. The first known attempt hit Amazon's decoy network on October 17. On October 24, Adel Karimi reported exploit requests opening shells on three PHP 8.4.26 honeypots, in traffic very similar to a public proof of concept and consistent with the first flaw. The report adds that a one-worker Apache setup favored the exploit, so its results aren't a gauge of reliability on other setups. Trail of Bits confirmed working exploits on October 26 against PHP 8.2 to 8.5 releases that predate the fix, with shells on MediaWiki, Symfony, Laravel and phpBB in its demo. CISA added both to KEV that day.

Why it matters: Of servers that reveal their PHP version, VirusTotal counts about 758,000 on 5.4 through 8.1, branches PHP no longer updates, against about 272,000 on supported ones. For 7.4 through 8.1, PHP's fix comes only as source code to build by hand. Anything older gets no fix from PHP.

CISA adds Brotli2Shell to KEV after exploit traffic surfaces →

Brief: CISA added Brotli2Shell (CVE-2026-111497), a memory corruption flaw in Google's Brotli compression library, to its Known Exploited Vulnerabilities catalog on October 27, a day after threat intelligence firm ELLIO reported exploit traffic aimed at Node.js.

Intel: Also known as HTTP2Shell, Node2Shell and Broccoli2Shell, it received a CVSSv4 score of 9.2 from Google. A malformed stream can make the decoder write beyond an eight-byte buffer, which can crash the process or, at worst, allow remote code execution. The decoder can be used by Node.js, .NET, Bun, Envoy, Istio, PHP for Windows and Python HTTP clients, among others. Node.js credits OpenAI Codex Security researchers with the report. ELLIO achieved code execution on an unmodified Node.js 24.22.0 x86-64 build, the same build the captured request targeted, though that attacker's chain never produced a shell in 50 lab attempts. We have not independently confirmed the activity.

Why it matters: Brotli's fix landed in its public source code on February 27, but OpenAI says the bug wasn't recognized as a security flaw then. Brotli shipped no release with the fix until October 21. For nearly eight months, anyone reading the repository could see the change, while defenders had no fixed Brotli release to install.

Microsoft: China-state aligned actor used AI in ConnectWise attack →

Brief: Microsoft assesses that Storm-0940, which it calls "a China-state aligned actor," was behind the ConnectWise Cloud Backup supply chain compromise and used ARTEX, open-source AI software that automates penetration tests, to speed up the attacks that followed.

Intel: The attackers held the Cloud Backup app's own login to customers' Microsoft 365 accounts, so its sign-ins needed no user password or MFA; how they obtained it is still unclear. Microsoft counts sign-in attempts against more than 2,250 tenants, and in some, ARTEX's agents went on to change app credentials and privileged roles. ConnectWise cut off the app's access October 17 and by October 19 had reset every account and credential in the Cloud Backup environment.

Why it matters: Credential changes the agents made inside a tenant can keep working as a backdoor after the ConnectWise app is shut off. In the sweep Sophos tracked, the attacker also hit former backup customers, which Sophos reads as a sign the attacker held the full roster of tenants that had approved the app.

SafePay ransomware exploits old flaws and goes after backups →

Brief: In a joint advisory, six U.S. and European agencies say SafePay ransomware has "impacted at least 600 separate victims from multiple critical infrastructure sectors" since August 2024.

Intel: SafePay gets in with stolen or guessed passwords and with phished accounts. It logs in from addresses that belong to Mullvad, a VPN service, and uses the phished accounts to exploit two Cisco ASA and FTD flaws, CVE-2020-3259 and CVE-2023-20269. Automated scripts hit three more: CVE-2023-27532 and CVE-2024-40711 in Veeam Backup & Replication, plus CVE-2024-40766 in SonicWall SonicOS. A SafePay representative also calls victims to pressure them.

Why it matters: Two of the five flaws sit in Veeam's backup software, so the backup server is itself one way in. Once inside, SafePay resets network storage that holds victims' backups to its factory settings and shuts off Windows' built-in snapshot service. The agencies say both steps aim to block recovery.

Stat of the week: 87 days

How long it takes a typical organization for half of its known exploited vulnerabilities to stop being visible from the internet, according to Moody's, whose analysis of about 9,500 organizations it rates puts flaws tied to ransomware at 59 days and flaws outside the known-exploited list at 107.

Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.