Skip to main content

Search Trends Ads Appearances Podcasts API

We value your privacy

We use cookies to understand how you use our platform and to improve your experience. Click “Accept All” to consent, or “Decline non-essential” to opt out of non-essential cookies. Read our Privacy Policy.

Cybersecurity Headlines

Cybersecurity Headlines

HTTP2Shell emergency updates, PHP2Shell attacks, GitHub worm

Oct 27, 2026 · 8 min · 10 segments

HTTP2Shell sparks emergency patches…

HTTP2Shell sparks emergency patches https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/ PHP2Shell: patch, then investigate https://www.securitymagazine.com/articles/102693-php2shell-exploited-in-the-wild GitHub worm hides in oversized files https://www.theregister.com/security/2026/10/26/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail/5305570 Cathedral gets inside Anthropic https://www.washingtonpost.com/technology/2026/10/26/researchers-cybersecurity-start-up-cathedral-got-inside-anthropic/?pwapi\_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyZWFzb24iOiJnaWZ0IiwibmJmIjoxNzkyOTg3MjAwLCJpc3MiOiJzdWJzY3JpcHRpb25zIiwiZXhwIjoxNzk0MzczMTk5LCJpYXQiOjE3OTI5ODcyMDAsImp0aSI6ImI1M2RjZmEzLThkNTItNGE3NC05ZjI4LWU1ZGJkZTIyZDFmOSIsInVybCI6Imh0dHBzOi8vd3d3Lndhc2hpbmd0b25wb3N0LmNvbS90ZWNobm9sb2d5LzIwMjYvMTAvMjYvcmVzZWFyY2hlcnMtY3liZXJzZWN1cml0eS1zdGFydC11cC1jYXRoZWRyYWwtZ290LWluc2lkZS1hbnRocm9waWMvIn0.k3b70wv6ePisrPvCYfDOPAjt5vHweVxm4rBnhcnDU-M Ukraine's satellite service returns https://therecord.media/ukraine-disputes-musk-claims-of-starlink-misuse Gheist raids GitHub secrets https://www.darkreading.com/cyberattacks-data-breaches/gheist-stolen-github-tokens-cloud-secrets Fake Teams support delivers ransomware https://thehackernews.com/2026/10/attackers-use-microsoft-teams-it.html Scam laundering suspect extradited https://therecord.media/dutch-police-extradite-chinese-national-money-laundering-scams Get the show notes here: https://cisoseries.com/cybersecurity-news-october-27-2026/ **Huge thanks to our sponsor, Guardsquare** ![Guardsquare: Uncompromising mobile app security](https://hubs.la/Q04sv5qF0) *Your backend is only as secure as your frontend. Research shows that client-side compromise is now a primary driver of API risk. With sixty-three percent of leaders detecting mobile app tampering or cloning last year, don't leave your mobile app security to chance. Get multilayered protection for your entire mobile app ecosystem from the outside in. Learn more at Guardsquare.com.*

HTTP2Shell sparks emergency patches…

Spotify Apple Podcasts YouTube Amazon Music Website

Speakers: Sarah LaneHost

Top entities: GitHub×15 JFrog×4 Starlink×3 Ukraine×12 PHP2Shell×2

Show signals: SuitabilitySafeBiasNot politicalPopularityVery Populartop 5%Audience≈12k followers

HTTP 2 Shell and PHP 2 Shell0:14 – 1:46

S

0:14

HTTP 2 Shell sparks emergency patches.

S

0:19

HTTP 2 Shell, also called Node 2 Shell, affects broadly Google's compression library used in Node.js, some Python HTTP clients, .NET, and other software.

S

0:32

Malicious compressed data can crash apps, expose memory, or run code.

S

0:37

which cybersecurity company Imperva confirmed.

S

0:40

Exploit code is public, but no malicious attacks have been reported.

S

0:44

Fixes include Brotli 1.2.1 and Node.js 22.23.4, 24.22.1, and 26.12.1. Also, restart affected processes and rebuild containers.

S

1:00

Apps with bundled copies need their own updates, and blocking incoming compressed requests won't stop malicious responses.

S

1:10

PHP 2 Shell.

S

1:12

Patch, then investigate.

S

1:14

An update on PHP 2 Shell.

S

1:17

Perplexity captured successful code execution on a decoy server using the two flaws patched October 21st.

S

1:25

That's separate from yesterday's third lower risk bug.

S

1:29

Cybersecurity firm Exabeam warns that patching won't remove existing intruders.

S

1:35

Admins should also check for unusual outbound connections and service accounts logging in from new locations.

S

1:41

Signs attackers may be using stolen credentials to move beyond the web server.

GitHubCompanyCompany
99%15 mentions
JFrogCompanyChain
96%4 mentions
StarlinkBrand
93%3 mentions
UkraineCountryCountry in Europe
90%12 mentions
PHP2ShellEntity
88%2 mentions
AnthropicCompanyArtificial intelligence company
85%9 mentions
MicrosoftCompanyTechnology company
82%4 mentions
application programming interfaceEntityType of software
79%5 mentions
JPEGEntityFile format
76%1 mention
Guardsquare NVCompanyCompany
74%8 mentions
Steve PrenticePersonSpeaker
71%2 mentions
HTTP/2Software Application
68%6 mentions
Visual Studio CodeSoftware ApplicationSoftware
65%2 mentions
ImpervaCompanyCompany
63%2 mentions
Money launderingEntity
60%1 mention
cPanelSoftware ApplicationSoftware
57%3 mentions
AnyDeskSoftware ApplicationSoftware
54%2 mentions
CambodiaCountryCountry in Asia
51%3 mentions
CaliforniaAdministrative AreaUS state
47%2 mentions
NetherlandsCountryCountry in Europe
47%2 mentions
TetherEntityCryptocurrency
42%2 mentions
The BahamasCountryCountry in the Caribbean
42%2 mentions
United StatesCountryCountry in North America
38%3 mentions
ClaudeSoftware ApplicationSoftware
33%2 mentions
GeminiEntity
33%2 mentions
SlackSoftware ApplicationMobile application
29%2 mentions
GoogleCompanyTechnology corporation
26%2 mentions
Wiz, Inc.CompanyIT security company
24%2 mentions
Elon MuskPersonBusinessman and former Senior Advisor to the President of the United States
21%2 mentions
SpaceX StarshieldEntitySpace rocket
18%2 mentions
BrotliSoftware Application
15%1 mention
PythonBrandHigh-level programming language
13%1 mention
ExabeamCompanyCompany
10%1 mention
ChineseEntitySpoken language
7%1 mention
Artificial intelligenceEntityProfessional field
4%1 mention
The Washington PostPeriodicalAmerican newspaper
1%1 mention

Software Supply Chain SecurityTechnology > Cybersecurity
Cloud and Repository SecurityTechnology > Cybersecurity
Compression Library VulnerabilitiesTechnology > Cybersecurity > Software Vulnerabilities
HTTP 2 Shell and Node.js/Brotli Emergency PatchingTechnology > Cybersecurity > Software Vulnerabilities > Compression Library Vulnerabilities
Malicious Package and Repository CampaignsTechnology > Cybersecurity > Software Supply Chain Security
Credential and Secret TheftTechnology > Cybersecurity > Cloud and Repository Security
Remote Access Ransomware ScamsCrime > Cybercrime > Social Engineering
Cryptocurrency LaunderingFinance > Financial Crime
Investment Scam ProceedsFinance > Financial Crime > Cryptocurrency Laundering
CybersecurityTechnology
Software VulnerabilitiesTechnology > Cybersecurity
Financial CrimeFinance
CybercrimeCrime
Social EngineeringCrime > Cybercrime
Technology
Crime
Finance

HTTP 2 Shell and PHP 2 Shell0:14 – 1:46

S

0:14

HTTP 2 Shell sparks emergency patches.

S

0:19

HTTP 2 Shell, also called Node 2 Shell, affects broadly Google's compression library used in Node.js, some Python HTTP clients, .NET, and other software.

S

0:32

Malicious compressed data can crash apps, expose memory, or run code.

S

0:37

which cybersecurity company Imperva confirmed.

S

0:40

Exploit code is public, but no malicious attacks have been reported.

S

0:44

Fixes include Brotli 1.2.1 and Node.js 22.23.4, 24.22.1, and 26.12.1. Also, restart affected processes and rebuild containers.

S

1:00

Apps with bundled copies need their own updates, and blocking incoming compressed requests won't stop malicious responses.

S

1:10

PHP 2 Shell.

S

1:12

Patch, then investigate.

S

1:14

An update on PHP 2 Shell.

S

1:17

Perplexity captured successful code execution on a decoy server using the two flaws patched October 21st.

S

1:25

That's separate from yesterday's third lower risk bug.

S

1:29

Cybersecurity firm Exabeam warns that patching won't remove existing intruders.

S

1:35

Admins should also check for unusual outbound connections and service accounts logging in from new locations.

S

1:41

Signs attackers may be using stolen credentials to move beyond the web server.

Sign up to see more

The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode

Create an account Already have an account? Log in

No account is needed to search Radar.