[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

guidance (based on CISA KEV catalog, Oct 26-27)

Tip: KEV clocks this fortnight: PHP2Shell due Oct 29; Magento PolyShell and Brotli due Nov 10. Find the hidden copies of Brotli first, since they take longest

Federal agencies must meet these dates under BOD 26-04; everyone else can use them as a priority list.

  • Oct 29: PHP2Shell (CVE-2026-109618/109619). Update PHP and restart PHP-FPM or Apache; check appliances that embed PHP, such as PAN-OS management UIs.
  • Nov 10: Magento/Adobe Commerce PolyShell (CVE-2026-48356). Apply the July 2026 security release and look for files already uploaded to pub/media/custom_options/.
  • Nov 10: Brotli decoder (CVE-2026-111497). It is in Node.js, .NET, Bun, Envoy/Istio, Python Brotli bindings, PHP on Windows, FFmpeg via libjxl, ClickHouse and Apache Arrow. Search SBOMs and images for brotli, libbrotli, brotlicffi and Node.js versions below 22.23.4, 24.22.1 and 26.12.1, then rebuild container images and self-contained binaries. Upgrading the host does not fix the copy inside an image.

Sources: CISA alert: CISA Adds Two Known Exploited Vulnerabilities to Catalog (Oct 27) · CISA KEV catalog (JSON feed, Oct 27 entries) · CISA KEV catalog