Daily brief, Oct 26:
- PHP2Shell CVE-2026-109618/-109619 (CVSS 9.2): PAN-OS mgmt UI hotfixes 10.2.18-h13/11.1.16-h4/11.2.10-h16 out, rest Oct 27-30. Patch PHP, session.upload_progress.enabled=0, hunt since Oct 17
- Gheist: hunt ci-sync-* branches, UA gheist; rotate all repo secrets
- Tailscale SSH (no CVE/fix): per-pair grants, no forwarding
- CVE-2026-111497: .NET 8.0.33/9.0.22/10.0.14; rebuild self-contained apps
https://tp-security.com/news/cyber-brief-2026-10-26-panos-gheist-tailscale-brotli
Touchpoint SecurityPHP2Shell Fixes Reach PAN-OS as Stolen GitHub Tokens Drain CI SecretsPAN-OS PHP2Shell hotfixes begin shipping, Gheist abuses GitHub tokens to steal CI secrets, Tailscale SSH flaws go unpatched, and .NET fixes Brotli.