The facts

  1. CISA's official catalog lists CVE-2026-111497 as added on 27 October, identifying it as a vulnerability known to have been exploited. Its entry records use in ransomware campaigns as unknown. [4]

  2. CVE-2026-111497 is an out-of-bounds write in Brotli decompression. Google’s Brotli 1.2.1 release identifies it as a remote-code-execution vulnerability. [3]

  3. Node.js says attacker-controlled Brotli data passed to its zlib decompressor can corrupt memory, potentially causing a crash, memory disclosure or code execution. Its 22.x, 24.x and 26.x lines are affected. [1]

  4. Fixed Node.js releases are 22.23.4, 24.22.1 and 26.12.1. The project published its security release on 21 October 2026. [1]

  5. On 26 October, PHP released Windows packages 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 with Brotli 1.2.1. The -1 suffix marks a dependency rebuild; the PHP runtime version is unchanged. [2]

  6. PHP says its Windows cURL extension can reach the vulnerable decoder when automatic response decompression is enabled. That option is off by default, but application code or HTTP libraries can enable it. [2]

  7. Broadcom’s VMSA-2026-0008.1, updated 28 October, identifies SDDC Manager in VMware Cloud Foundation as affected. Version 9.1.1 is rated critical; 9.0.x, 9.1.0 and 5.2.x are rated important. [5][6]

  8. Broadcom’s checked response matrix lists patches as pending and links version-specific workarounds. It says an attacker with network access to SDDC Manager could execute code; the advisory does not establish exploitation of that product in the wild. [5][6]

Relevant context

Exposure depends on whether an application decompresses untrusted Brotli input. This is distinct from the two PHP request-handling flaws disclosed on 21 October. [1][2]

Corrections & updates

Update: Added CISA's 27 October classification of CVE-2026-111497 as known exploited, which the earlier report omitted. The catalog records ransomware use as unknown. The release dates, fixed versions and exposure conditions are preserved.

Update: Added Broadcom’s advisory, updated 28 October, confirming SDDC Manager exposure and pending patches with vendor workarounds. The product’s version-specific severity and lack of an established VMware exploitation claim are explicit. The original Brotli, Node.js and PHP fixes remain unchanged.

Sources

References support the numbered facts above. Source checks: 29 Oct 2026, 00:15 UTC.

  1. 21 October 2026 security releases

    Node.js Project · Primary source · 21 Oct 2026

  2. Updated PHP Windows builds for Brotli security fix

    PHP Project · Primary source · 26 Oct 2026

  3. Brotli 1.2.1 security release

    Google Brotli project · Primary source · 21 Oct 2026

  4. Known Exploited Vulnerabilities catalog — Google Brotli CVE-2026-111497

    US Cybersecurity and Infrastructure Security Agency (CISA) · Primary source · 27 Oct 2026

    CISA's official GitHub mirror, catalog version 2026.10.27. The Brotli entry was added on 27 October; it does not identify attack victims.

  5. VMSA-2026-0008.1: SDDC Manager Brotli exposure

    Broadcom · Primary source · 28 Oct 2026

    Advisory initially issued 27 October and updated 28 October; response matrix distinguishes severity by version.

  6. Node2Shell exploitation reports and VMware patch status

    SecurityWeek · Reporting · 28 Oct 2026

Report a factual error