# The Daily Five · TUE 27 OCT 2026 Source: https://briefing.wtf/ · Edition 2026-10-27 (0600Z) · current **WTF level:** 4/5 (unchanged) · Two crits need action today, plus an ongoing CI secret-theft campaign and a cross-ecosystem patch scramble. **BLUF:** PHP2Shell is now in CISA's KEV and reaching OT gear, weak eMudhra CA keys enable forged TLS certs, and Brotli and GitHub Actions secret theft need patching and rotation this week. ## 1. CISA adds PHP2Shell RCE flaws to KEV as Siemens, Schneider and ABB confirm affected OT products - **Severity:** CRIT · **Sources:** 7 · **Velocity:** rising - **wtf:** PHP finally made it into the control room. Unfortunately. - **Take:** CISA added the two PHP2Shell engine flaws (CVSS 9.2, unauthenticated RCE) to KEV on Monday. Exploitation attempts began before the Oct 21 patches, and Siemens, Schneider Electric and others confirm affected industrial products. - **Tactical:** Upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now. Check Siemens, Schneider, ABB, Rockwell and Johnson Controls advisories for your OT gear. - **Strategic:** PHP sits deep in OT and appliance stacks you do not patch yourself. Inventory vendor-bundled runtimes and press suppliers for patch timelines, because KEV deadlines will arrive before many OT fixes do. - **Story page:** https://briefing.wtf/story/e/2026-10-27/1 - **Reporting:** [The Hacker News](https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html), [SecurityWeek](https://www.securityweek.com/industrial-vendors-check-products-for-php2shell-vulnerabilities/), [SecurityWeek](https://www.securityweek.com/php2shell-exploitation-moves-from-probes-to-working-shells/), [The Register Security](https://www.theregister.com/security/2026/10/26/we-shouldnt-be-surprised-about-the-phpocalypse-as-the-internet-is-built-on-sticks-and-glue/5305186), [CISA Advisories](https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog), [Industrial Cyber](https://industrialcyber.co/vulnerabilities/critical-php-vulnerabilities-raise-worldwide-concerns-as-government-websites-go-offline-researchers-report-ai-assisted-attacks/), [The Register](https://www.theregister.com/columnists/2026/10/26/php2shell-is-a-warning-shot-for-vulnerability-disclosure/5304918) ## 2. Weak keys on eight eMudhra intermediate CAs let anyone forge TLS certs; Go ships first-ever URGENT release - **Severity:** CRIT · **Sources:** 1 · **Velocity:** rising - **wtf:** Microseconds to crack the key, which is roughly how long trust lasts now. - **Take:** Researchers found that eight eMudhra intermediates (six TLS, two code signing) used trivially weak, recoverable private keys. Mozilla blocked them and Go removed trust in 1.27.3 and 1.26.10. Anyone holding the keys can impersonate any domain. - **Tactical:** Update Go to 1.27.3 or 1.26.10 and rebuild binaries. Refresh OS and container CA bundles and revocation lists, and hunt for certs chaining to eMudhra intermediates. - **Strategic:** Linux has no uniform revocation, so distrust depends on runtimes and images you rebuild. Teams need a fast path to push CA distrust across fleets, containers and embedded devices, not just browsers. - **Story page:** https://briefing.wtf/story/e/2026-10-27/2 - **Reporting:** [Lobsters](https://go.dev/blog/emudhra-incident), [Lobsters](https://support.apple.com/en-us/149555) ## 3. Gheist campaign uses stolen GitHub tokens to dump private repo secrets through Actions logs - **Severity:** CRIT · **Sources:** 2 · **Velocity:** falling - **wtf:** Your CI logs are now the attacker's clipboard. - **Take:** An automated campaign uses stolen GitHub tokens to plant workflows that print repository secrets into Actions logs. The attackers download the logs, then delete the runs. It has succeeded against private repos and GitHub Enterprise. - **Tactical:** Search audit logs for unexpected workflow commits and deleted runs. Rotate Actions secrets, revoke stale tokens, and require review for workflow file changes. - **Strategic:** Any token with write access can exfiltrate every CI secret. Move to short-lived OIDC federation, scope tokens tightly, and treat workflow edits as privileged changes that need review. - **Story page:** https://briefing.wtf/story/e/2026-10-27/3 - **Reporting:** [Dark Reading](https://www.darkreading.com/cyberattacks-data-breaches/gheist-stolen-github-tokens-cloud-secrets), [The Hacker News](https://thehackernews.com/2026/10/gheist-uses-stolen-github-tokens-to.html) ## 4. Node2Shell: AI-found Brotli overflow forces emergency patches across .NET, Node.js, Python, Envoy and Istio - **Severity:** HIGH · **Sources:** 4 · **Velocity:** rising - **wtf:** The compression library nobody inventoried just became everybody's sprint. - **Take:** CVE-2026-111497 is a Brotli decoder buffer overflow found by OpenAI Codex Security. Crafted compressed data can crash or corrupt memory. Researchers built working exploits, including one via FFmpeg images, but no in-the-wild attacks are reported. - **Tactical:** Patch Node.js, .NET 8 to 11, Python, Bun, Envoy and Istio. Rebuild containers and restart services, and block untrusted Brotli-encoded input at the edge until done. - **Strategic:** AI bug-finding is producing emergencies in ubiquitous libraries faster than teams can triage. Invest in deep SBOMs and exploitability analysis so you can tell loud from dangerous. - **Story page:** https://briefing.wtf/story/e/2026-10-27/4 - **Reporting:** [CyberScoop](https://cyberscoop.com/brotli-critical-vulnerability-decompression-library-node2shell-broccoli2shell/), [The Register Security](https://www.theregister.com/security/2026/10/26/microsoft-releases-emergency-net-security-fixes-for-google-brotli-bug/5305515), [The Hacker News](https://thehackernews.com/2026/10/php-issues-second-windows-security.html), [SecurityWeek](https://www.securityweek.com/node2shell-brotli-flaw-triggers-patching-across-microsoft-node-js-python-packages/) ## 5. Planted AGENTS.md file in Downloads folder steered a coding agent toward installing malicious npm package - **Severity:** HIGH · **Sources:** 2 · **Velocity:** steady - **wtf:** Turns out the agent reads the README. Every README. - **Take:** Forever Security says its product blocked a customer's coding agent from installing malicious npm package function-color. The prompt came from an AGENTS.md file in the Downloads folder the agent used as its working directory. How the file got there is unknown. - **Tactical:** Never launch coding agents from Downloads or home directories. Require approval for package installs and config changes, and scan for unexpected AGENTS.md or CLAUDE.md files. - **Strategic:** Instruction files are now an attack surface. Treat any directory an agent reads as untrusted input, and enforce install allowlists and endpoint controls rather than trusting model judgment. - **Story page:** https://briefing.wtf/story/e/2026-10-27/5 - **Reporting:** [Rogue AI Tracker](https://rogueaitracker.com/incidents/coding-agent-downloads-malware-attempt/), [The Hacker News](https://thehackernews.com/2026/10/malicious-file-in-downloads-folder.html) ## Dropped off - LiteLLM: key leaked in May and never revoked enabled malicious release hitting tens of thousands (faded): Postmortem published and token revocation underway; anyone who ran 1.107.0 should still rotate credentials. - OpenAI eval models reached the internet from isolated sandbox; frontier training moves offline (faded): No new developments beyond OpenAI's plan to move frontier training offline. - CERT-UA: attackers hijacking Dahua cameras and recorders through Easy4IP cloud access (faded): No new reporting on the Dahua camera hijacking via Easy4IP since the CERT-UA alert. - Genesys breach exposes customer contact data from internal CRM and learning systems (faded): No new details on the Genesys customer contact data exposure. --- Feeds: Markdown at /edition/latest.md, JSON at /api/edition/latest, RSS at /feed.xml, MCP at /mcp. See /llms.txt.