Podcast Detail

SANS Stormcast Monday, October 26th, 2026: PHP2Shell Exploit Reliability; Node.js Brotli Decoder RCE (CVE-2026-111497); Tailscale "Tailworm" Vulnerabilities; HPE ArubaOS 8/10 Patches 72 Flaws

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10150.mp3

previous
Podcast Logo
PHP2Shell Exploit Reliability; Node.js Brotli Decoder RCE (CVE-2026-111497); Tailscale "Tailworm" Vulnerabilities; HPE ArubaOS 8/10 Patches 72 Flaws
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

In this episode: why a reliable PHP2Shell exploit is still hard to build, a Node.js Brotli decoder remote code execution flaw, publicly disclosed Tailscale mesh VPN vulnerabilities, and an HPE update fixing 72 vulnerabilities in ArubaOS 8 and 10.

Reliable PHP2Shell Exploitability
Bojan Zdrnja found that building a reliable, universal exploit for the PHP2Shell vulnerabilities is difficult: address space layout randomization (ASLR) requires a second leak to find the base address, a larger PHP memory limit makes exploitation harder, and the offsets depend on the exact PHP version and Linux distribution. Targeted exploitation has been reported, so finish patching and keep session.upload_progress.enabled set to 0 even after applying the update.
https://isc.sans.edu/diary/%28Reliable%29%3F%20php2shell%20exploitability/33452

Node.js Brotli Decoder Out-of-Bounds Write (CVE-2026-111497)
The Node.js October 2026 security releases fix several vulnerabilities, including an out-of-bounds write in the bundled Brotli compression library's decoder that permits remote code execution when an application decompresses attacker-supplied data. OpenAI Codex Security is credited with the discovery; watch for Brotli decoder fixes in other products that use the library.
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Tailscale "Tailworm" Vulnerabilities
Researchers made a set of vulnerabilities in the Tailscale mesh VPN public without coordinated disclosure. Exploitation requires access to the tailnet, but critical issues bypass Tailscale's trust model, for example by letting an attacker join their own systems to your tailnet; watch for Tailscale updates.
https://tailworm.com/

HPE Aruba Networking Update for ArubaOS 8 and 10 (AOS-8/AOS-10)
Hewlett Packard Enterprise (HPE) bulletin HPESBNW05162 fixes 72 vulnerabilities in the ArubaOS 8 and 10 wireless operating systems, eight of which allow unauthenticated remote code execution. Apply the update; expect more large updates like this as vendors use AI tools to find vulnerabilities.
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US

My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Podcast Transcript

 Hello and welcome to the Monday October 26, 2026 edition
 of the SANS Internet Storm Center's Stormcast. My name is
 Johannes Ullrich, recording today from Denver, Colorado.
 And this episode is brought to you by the SANS.edu Graduate
 Certificate Program in Cyber Security Engineering. Well, we
 are not quite done with PHP2Shell yet, the PHP
 vulnerabilities that kept us busy last week. Now on Friday,
 Bojan did post a diary summarizing his own
 experiences trying to develop a reliable exploit for this
 vulnerability. We don't at this point have a reliable
 exploit available yet reliable, meaning that it
 works just using this one vulnerability and also that it
 works across different configurations of PHP. Bojan
 outlined some of the issues here. First of all, if you
 have address space layout randomization enabled in your
 operating system, which pretty much all modern Unix versions
 or Linux versions do have enabled. Well, in that case,
 you need a second vulnerability in order to get
 a hold of the base address. The other problem is the
 memory limit setting in PHP. The larger this memory limit
 is set, the more difficult it becomes to reliable exploit
 this vulnerability. Not impossible, but more
 difficult. And then there are a couple other offsets that
 you need to know that highly depend on the specific version
 of PHP that you have. Even like the same version, but
 compiled for different Linux distributions may have some
 small changes here. So that's why we haven't really seen a
 reliable sort of public exploit yet. Individual
 exploits that work more targeted, that target for
 example specific organization that works. And there have
 been a couple different reports from different
 organizations stating that they have seen some of these
 exploits in the wild being used that they have seen some
 of these specific high-value systems. So again, the summary
 here is we still have a little bit more time to protect
 systems if you haven't gotten around to it yet. The other
 issue that came up when this vulnerability was first
 announced is the session upload progress
 which is laid
 out the session uploadetric would have been intact. And
 then that we all feel like
 if it didn't work well over and they're on social use them
 in a patch and they recommend to leave this setting in place
 even if you have applied the latest update because it does
 prevent or make more difficult exploitation of some of these
 vulnerabilities that are still in the queue so as always keep
 good notes about what you did to patch PHP you may have to
 do it again in a month or maybe sooner well if you're
 listening to this and saying hey all that hoopla about PHP
 I don't really use PHP well before you get too relaxed
 last week there was also code execution vulnerability in
 Node.js and now Node.js last week published a couple
 different vulnerabilities or patches for a couple different
 vulnerabilities but there's one that particular sort of
 stuck out and that's a Brotli decoder out of bounds write
 vulnerability and that one permits a remote code
 execution Brotli is a compression library and that's
 actually sort of the larger issue here it's a
 vulnerability in this library that's being addressed here
 and apparently this is affecting a large number of
 different products that are using this Brotli library the
 Brotli decoder was specifically developed for
 compressing things like JavaScript and HTML it has
 sort of a fixed dictionary of strings that show up like in
 HTML that can be effectively compressed with this algorithm
 so fonts for example apparently use sometimes
 sometimes this particular compression scheme definitely
 watch out for other Brotli decoder vulnerabilities that
 are being patched in other products but Node.js is
 certainly one of the things that you want to pay attention
 to and yes this was also a vulnerability found via AI in
 this particular case OpenAI Codex is being given credit
 for discovering this vulnerability and continuing
 the trend of AI discovered vulnerabilities we also have a
 set of vulnerabilities that affect Tailscale, the
 mesh VPN that has become quite a popular tool for
 remote access now these vulnerabilities do require
 access to the tailnet in order to exploit the
 vulnerabilities but there are some critical issues here that
 really sort of bypass the trust model of a Tailscale by
 for example allowing attacker then to have their own systems
 join your tailnet so definitely be aware of these
 vulnerabilities sadly they were not released or reported
 responsibly they were just made public however not with a
 ton of detail at this point and watch out for respective
 updates from a Tailscale and not wanting to be left behind
 we do have a massive update from HP Enterprise for their
 Aruba product line affecting ArubaOS 8 and 10 I believe
 it's 72 vulnerabilities total that are being addressed in
 this update 8 of which do allow unauthenticated remote
 code execution so definitely apply this patch and watch out
 for more similar advisories from HP and others that's the
 new normal as people sometimes say that we have now these
 companies using AI tools which is a good thing finding these
 vulnerabilities and are now releasing these relatively
 large updates as a result well and that's it for today thanks
 for listening thanks for liking thanks for recommending
 this podcast and talk to you again tomorrow bye