https://kagesecuritylab.com/intel/ Threat intelligence, offensive security and Microsoft cloud protection. https://kagesecuritylab.com/intel/node2shell-cve-2026-111497/ https://kagesecuritylab.com/intel/node2shell-cve-2026-111497/ Sat, 31 Oct 2026 00:00:00 GMT An out-of-bounds write in Google's Brotli decoder lets a single compressed HTTP request crash or potentially take over Node.js apps that accept Brotli bodies, including Express 5 by default. CISA lists it as exploited. What to patch, what else ships Brotli, and how to check. https://kagesecuritylab.com/intel/php2shell-cve-2026-109618-109619/ https://kagesecuritylab.com/intel/php2shell-cve-2026-109618-109619/ Sat, 31 Oct 2026 00:00:00 GMT Two memory-safety bugs in the PHP engine allow unauthenticated remote code execution through ordinary web requests. Exploitation started within hours of disclosure and CISA has added both to KEV. What is affected, what to patch and how to hunt. https://kagesecuritylab.com/intel/aitm-phishing-conditional-access/ https://kagesecuritylab.com/intel/aitm-phishing-conditional-access/ Tue, 20 Oct 2026 00:00:00 GMT AiTM kits proxy the real Microsoft sign-in page and steal the session cookie after MFA completes. Here is what actually stops them. https://kagesecuritylab.com/intel/spf-dkim-dmarc-field-guide/ https://kagesecuritylab.com/intel/spf-dkim-dmarc-field-guide/ Tue, 06 Oct 2026 00:00:00 GMT Three DNS records decide whether anyone can send email as your domain. What each one does, the common mistakes, and a safe rollout path.