From PHP to root, and a Brotli bug under attack

This week was about chains. Attackers are pairing last week's PHP flaws with a Linux kernel bug to go from a web request to root, a memory bug in the Brotli compression library moved onto the list of actively exploited vulnerabilities, and two popular self-hosted PHP applications joined it.

Most of the fixes already exist. The work is making sure they are actually running: updated kernels after a reboot, rebuilt container images, and restarted processes.

PHP2Shell now leads to root

On 28 October the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-46300, a Linux kernel bug, to its catalogue of actively exploited vulnerabilities. CISA says it is being chained with the two PHP2Shell flaws from our last issue to plant PHP web shells and run commands as root.

The kernel bug (CVSS 7.8) is not reachable from the network on its own. It lets a local, unprivileged user corrupt files cached in memory, which can be turned into full control of the machine. PHP2Shell supplies that local foothold. So on an unpatched server, a single crafted request no longer stops at the PHP process's permissions.

The fix was published in May and is in these stable kernels:

Distribution kernels carry their own version numbers, so check your distribution's advisory for CVE-2026-46300 rather than comparing numbers. Then reboot: a new kernel package does nothing until the machine boots it. Containers share the host's kernel, so rebuilding an image does not fix this. The host has to be updated.

If you run PHP and had not patched PHP2Shell by the time attacks began, assume the worst. Look for unfamiliar PHP files in your web root, and rotate any database passwords and API keys the server could read.

Brotli: patch Node.js, Python and Go dependencies

CVE-2026-111497 (CVSS 9.2) is an out-of-bounds write in the decoder of Brotli, the compression format behind Content-Encoding: br. A crafted compressed stream can crash the process, leak memory or, potentially, run code. CISA added it to its exploited list on 27 October.

It affects Brotli 1.0.3 through 1.2.0, fixed in 1.0.10, 1.1.1 and 1.2.1. Anything that decompresses Brotli data it did not produce is in scope, such as a server that accepts compressed request bodies or a client that fetches compressed responses. Brotli is bundled in many places, so check each:

• Node.js bundles it. The October security release fixes it in 26.12.1, 24.22.1 and 22.23.4, along with nine other issues, three of them also rated high. Release lines that have reached end of life get no fix.
• Python: the Brotli package on PyPI is fixed in 1.2.1.
• Go: the CVE record also points to v1.2.7 of github.com/andybalholm/brotli, a widely used pure-Go port.
• System libraries: update your distribution's brotli packages, which web servers and image tools often link against.

For an app on Cosmoner or any other platform, redeploy so the build picks up the fixed Node.js release and your lockfile's updated packages. For your own container images, rebuild on an updated base image.

Nextcloud Office and Magento, both exploited

Two more PHP applications that teams host themselves were added to CISA's list this week.

Nextcloud with the built-in Collabora server. CVE-2026-110447 (CVSS 9.2) is a command injection in the Collabora Online - Built-in CODE Server app (richdocumentscode), versions before 26.4.303, and it was exploited in September and October. Nextcloud's community notice explains what to do. Standalone Collabora servers, Docker or package installs, and hosted Collabora are not affected. Update the app to 26.4.303, which needs Nextcloud 30 or newer, or remove it if you do not use it. Users in that thread found backdoor PHP files under apps/richdocumentscode/, so check for files the integrity check reports as extra, and look for requests to proxy.php?status in your access logs.

Adobe Commerce and Magento Open Source. CVE-2026-48356 (CVSS 9.3) is a file upload flaw that can lead to code execution. Adobe fixed it in July in APSB26-73, and CISA added it to its exploited list on 27 October. If your shop has not applied the July 2026 security patches, do it now.

Update your certificate stores

On 17 October Mozilla received a report that the private keys of eight intermediate certificates belonging to eMudhra, a certificate authority, had been compromised. With those keys an attacker could issue HTTPS certificates for sites they do not control. Browsers blocked them within days, and Mozilla removed the root that signed them from its NSS trust store in version 3.131.1.

Your servers do not get browser updates. Code that makes outbound HTTPS calls trusts whatever certificate store it was built with, and that is usually your runtime or your operating system's ca-certificates package:

• Python released 3.14.10, 3.13.18 and others on 25 October with the eMudhra certificates distrusted (CVE-2026-115557). Python 3.10 reached end of life on 1 October and gets no further fixes.
• Node.js included the same change in its October security release above.
• Your operating system's ca-certificates package should be updated as soon as your distribution ships the change.

There is nothing to configure. Update, rebuild and redeploy, and the bad certificates stop being trusted.

PostgreSQL 14 ends in two weeks

PostgreSQL 14 reaches end of life on 12 November, the same day as the next scheduled round of minor releases. After that it gets no security fixes. Moving to a newer major version takes pg_upgrade or a dump and restore, so test it on a copy of your data before you plan the switch.

If you are choosing where to go, PostgreSQL 19 is planned for 19 November, with a second release candidate on 12 November. For a production move this month, PostgreSQL 18 is the safer target; 19 is worth testing your workload against now.

On Cosmoner this week

• Every PostgreSQL database now has a public host, so you can connect over TLS from your laptop, CI or another platform.
• Apps now stop gracefully on deploys, with a SIGTERM that reaches your server.
• Create an app with its database in one step, connected and linked for you.
• A free DNS lookup tool that shows whether a change has propagated.
• The Cosmoner Terraform provider is on the Terraform Registry.
• Pull request previews give every pull request its own running copy of your app.