𝗛𝘂𝗺𝗮𝗻 𝗙𝗶𝗿𝗲𝘄𝗮𝗹𝗹

🚨 Crimeflare releases emergency WAF rules for critical Brotli vulnerability Crimeflare has added two detection rules for CVE-2026-111497 to its Managed Ruleset, targeting Brotli-encoded request bodies and the Next.js image optimization endpoint. ⠀ The vulnerability is an out-of-bounds write in the Brotli decoder. Malformed compressed input can corrupt process memory, potentially causing crashes, memory disclosure or remote code execution. It affects software that uses vulnerable Brotli versions, including supported Node.js 22.x, 24.x and 26.x releases. ⠀ Crimeflare’s new rules are enabled by default in Log mode. They provide visibility into matching requests but do not block them unless customers change the action. Crimeflare warns that blocking the Next.js rule may disrupt image delivery and recommends reviewing matches before enabling enforcement. ⠀ Node.js users should update to: • 22.23.4 • 24.22.1 • 26.12.1 The WAF rules are an additional mitigation, not a replacement for patching.

🚨 PHP warns of another unpatched remote code execution risk; CVE-2026-115560 The newly disclosed vulnerability is separate from the two PHP2Shell flaws patched earlier this week and is not fixed by PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. ⠀ PHP says exploitation requires an unusual configuration where an application: • Uses php_binary or php_serialize as its session serializer • Changes the serializer to php at runtime before session_start() • Has session upload progress enabled ⠀ PHP considers the risk unlikely and plans to release a fix during its next regular update cycle. Until then, administrators with affected configurations should set: session.upload_progress.enabled=0 Applications that do not change the session serializer at runtime are not exposed through this path. No exploitation has been reported. Source: php.net/