DAILY BRIEFING
Node2Shell RCE, Unpatched PHP Advisory, and Python Pillow Flaw
Today's briefing covers remote code execution risks in Node.js and Python Pillow, an unpatched PHP configuration advisory, and a mesh-network backdoor used in Ukraine.
5 stories2 min read
Web application runtimes and popular dependencies are taking center stage today, with newly demonstrated code execution vectors emerging across Node.js, PHP, and Python's Pillow image library. Organizations maintaining web platforms must audit these core server components and apply updates promptly.
At the same time, targeted cyber operations show advancing persistence tactics. Threat actors Sandworm and UAC-0099 utilized a novel mesh network backdoor alongside data wipers, emphasizing the need to monitor non-traditional command-and-control channels within critical infrastructure.
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
A critical vulnerability in Python's Pillow library (CVE-2026-112900) allows remote code execution when processing EPS images. Pillow passes filenames to Ghostscript without validation, enabling command injection via crafted filenames. The flaw was fixed in Pillow version 13.0.0.
- Why it matters
- Pillow is extensively used across web applications, image processing workflows, and machine learning pipelines, exposing systems processing untrusted images to command execution.
Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
Russian state-sponsored threat group Sandworm collaborated with UAC-0099 in a destructive attack against a Ukrainian logistics firm. UAC-0099 deployed the MATCHWOK backdoor and a new mesh network backdoor, MythicRatatoskr, communicating over Yggdrasil before handing off access to Sandworm to execute a data wiper.
- Why it matters
- Attackers are utilizing novel C2 infrastructure over mesh networks like Yggdrasil to evade detection prior to launching destructive data wipers.
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Researchers demonstrated a working Node2Shell remote code execution exploit against official Node.js 24.22.0 Linux arm64 builds. The exploit targets a Brotli decoder flaw (CVE-2026-111497) by passing malicious compressed data to run arbitrary code. Fixed versions, including Node.js 24.22.1, reject the payload.
- Why it matters
- Applications decoding untrusted Brotli compressed data using vulnerable Node.js builds are susceptible to remote code execution.
PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
PHP warned of CVE-2026-115560, an unpatched RCE vulnerability affecting setups with session.serialize_handler set to php_binary or php_serialize. It follows emergency patches for CVE-2026-109618 and CVE-2026-109619. PHP is not issuing an emergency patch and advises disabling session upload progress.
- Why it matters
- Web applications with specific PHP session configuration options remain vulnerable to remote code execution until the next routine update.
HPE patches eight max severity RCE and auth bypass AOS flaws
BleepingComputer's verification page served a Cloudflare security challenge, preventing retrieval of story details regarding HPE's patch release for AOS flaws.
Key takeaways
- Update Node.js to version 24.22.1 to prevent remote code execution via the Brotli decoder flaw CVE-2026-111497.
- Russian-linked actors used the MythicRatatoskr backdoor communicating over the Yggdrasil mesh network prior to a data-wiping attack.