---
title: Tip: KEV clocks this fortnight: PHP2Shell due Oct 29; Magento PolyShell and Brotli due Nov 10. Find the hidden copies of Brotli first, since they take longest | ctxsec
url: https://ctxsec.com/items/tip-kev-deadlines-oct-29-nov-10
description: ""
status: "guidance (based on CISA KEV catalog, Oct 26-27)"
published: 2026-10-27
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-kev-deadlines-oct-29-nov-10.md)

guidance (based on CISA KEV catalog, Oct 26-27)

2026-10-27

### Tip: KEV clocks this fortnight: PHP2Shell due Oct 29; Magento PolyShell and Brotli due Nov 10. Find the hidden copies of Brotli first, since they take longest

Federal agencies must meet these dates under BOD 26-04; everyone else can use them as a priority list.

- **Oct 29:** [PHP2Shell](/items/cisa-kev-php2shell-cve-2026-109618-109619-due-oct-29) (CVE-2026-109618/109619). Update PHP and restart PHP-FPM or Apache; check appliances that embed PHP, such as PAN-OS management UIs.
- **Nov 10:** [Magento/Adobe Commerce PolyShell](/items/kev-oct-27-magento-polyshell-brotli-due-nov-10) (CVE-2026-48356). Apply the July 2026 security release and look for files already uploaded to `pub/media/custom_options/`.
- **Nov 10:** [Brotli decoder](/items/kev-oct-27-magento-polyshell-brotli-due-nov-10) (CVE-2026-111497). It is in Node.js, .NET, Bun, Envoy/Istio, Python Brotli bindings, PHP on Windows, FFmpeg via libjxl, ClickHouse and Apache Arrow. Search SBOMs and images for `brotli`, `libbrotli`, `brotlicffi` and Node.js versions below 22.23.4, 24.22.1 and 26.12.1, then rebuild container images and self-contained binaries. Upgrading the host does not fix the copy inside an image.

Sources: [CISA alert: CISA Adds Two Known Exploited Vulnerabilities to Catalog (Oct 27)](https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog) · [CISA KEV catalog (JSON feed, Oct 27 entries)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) · [CISA KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)