Cyber Daily

Executive Summary

The last 24-36 hours have been dominated by a wave of critical remote code execution vulnerabilities in the Brotli compression library (dubbed HTTP2Shell, Broccoli2Shell, Node2Shell, PHP2Shell), affecting Node.js, .NET, PHP and industrial products. In parallel, major security incidents have targeted GMO Internet Group (Japan), the University of Copenhagen (525,000 individuals), the UNM hospital in New Mexico and the provider Genesys, while active campaigns are compromising hundreds of online stores and GitHub repositories.

Critical Threats

• Brotli vulnerability (HTTP2Shell / Broccoli2Shell / Node2Shell / CVE-2026-111497) — Critical flaw in the Brotli library, included in Node.js, .NET and PHP, allowing memory corruption and remote code execution. Action: immediately apply patches for Node.js, Microsoft .NET and PHP for Windows (8.2-8.5) and audit all exposed services that decode Brotli content.
• GMO Internet Group incident (Japan) — An attacker compromised the cloud virtual desktop service used for foreign exchange trading; clients were instructed to back up data and disconnect computers. Action: for affected clients, isolate systems, rotate credentials and verify unauthorized transactions.
• ARTEX AI campaign (South Korea) — A former penetration tester used the ARTEX AI framework to steal 8.2 million records from more than 90 organizations. Action: monitor data access, enforce network segmentation and restrict unsupervised automated testing tools.
• Infection of 953 online stores (Magento) — Scanner-evading JavaScript, active since July 2025, is compromising payment forms and customer data. Action: audit scripts loaded at checkout, enforce a strict Content Security Policy and verify the integrity of Magento extensions.
• Gheist campaign (GitHub tokens) — Supply chain attack stealing cloud credentials from thousands of repositories. Action: revoke exposed GitHub tokens, rotate cloud secrets and enable secret scanning in CI/CD pipelines.

Vulnerabilities & Patches

The CVE-2026-111497 Brotli vulnerability requires emergency patching: Microsoft released urgent .NET updates, PHP republished Windows packages for versions 8.2-8.5 (the second update in five days), and Node.js received critical fixes. Industrial manufacturers Siemens, Schneider Electric and ABB confirm that some products are affected by the PHP2Shell vulnerabilities and have initiated checks. Ukraine reports exploitation of Dahua cameras via unauthorized accounts created by attackers, and DreamHost forced password resets for email and FTP/SFTP following an incident.

Trends & Observations

There is a concentration of RCE vulnerabilities in core components (compression, web frameworks), exploited rapidly through automated scanning. Attacks against AI infrastructure are increasing: AI agents are being manipulated through prompt injection in Markdown files, and the reasoning of an OpenAI model was extracted for distillation. Targeted sectors include healthcare, education, e-commerce, cloud services and industry. Social engineering campaigns via Microsoft Teams (fake IT support) are delivering malware and ransomware in hundreds of cases. State actors and financially motivated groups are active simultaneously, and investment scam campaigns with money laundering (the Zheng Zhao case, extradited from the Netherlands) indicate links to transnational networks.

Recommendations

• Immediately inventory all systems using Brotli (Node.js, .NET, PHP, industrial products) and apply emergency patches, prioritizing externally exposed services.
• Revoke and rotate GitHub tokens, API keys and cloud credentials, enabling secret scanning and access monitoring in development environments.
• Strengthen identity controls for AI agents and automated applications: define limited authorities, log actions and prepare response plans for incidents generated by agents.