CISA KEV

AltTabDaily posts tagged CISA KEV, newest first.

CybersecurityOct 29, 2026
Node2Shell (CVE-2026-111497): am I affected, and which versions fix it?
CISA added the Brotli decoder bug CVE-2026-111497 (Node2Shell / Broccoli2Shell / HTTP2Shell) to its Known Exploited Vulnerabilities catalog on 27 Oct 2026, with a 10 Nov federal due date. Run node --version and upgrade to 22.23.4, 24.22.1 or 26.12.1 or later.
CybersecurityOct 27, 2026
PHP2Shell follow-up: CISA adds both CVEs to KEV; federal patch deadline is 29 Oct
On 26 Oct 2026 CISA added CVE-2026-109618 and CVE-2026-109619 (php2shell) to the Known Exploited Vulnerabilities Catalog with a 29 Oct due date for FCEB agencies. Honeypot evidence from 24 Oct showed working shells on unpatched PHP 8.4.26 under Apache mod_php.

Node2Shell (CVE-2026-111497): am I affected, and which versions fix it?