Daily brief
Widespread Brotli Bugs Face Exploitation as Teams Phishing and Store Hacks Surge
Written automatically by AI from the day's headlines. Check the linked sources before you act on it.
Critical Brotli Flaws Trigger Emergency Patches Across PHP, Node.js, and .NET
A severe memory corruption issue in the Brotli compression library—dubbed HTTP2Shell or Broccoli2Shell—has prompted urgent security updates across platforms including PHP, Microsoft .NET, and Node.js. Attackers have reportedly begun moving from initial scans to active exploitation in the wild, launching functional command shells. System administrators and developers should update affected runtime packages immediately to block remote attacks.
Sources: The Hacker News, BleepingComputer, BleepingComputer, SecurityWeek, SecurityWeek, CISA advisories
Stealthy JavaScript Attack Compromises Nearly 1,000 E-Commerce Stores
Threat actors have injected evasive malicious code into 953 online storefronts, primarily those powered by Magento, in an attack campaign active since mid-2025. The hidden loader serves scripts to shoppers while deliberately avoiding automated scanners to evade detection. Merchants running Magento should inspect their site scripts, while consumers should closely monitor credit card statements for fraudulent charges.
Sources: The Hacker News, SecurityWeek
Cyber Incident Forces New Mexico Hospital to Divert Patients and Close Clinics
The University of New Mexico Health System instructed patients to avoid its primary Albuquerque facility and closed more than 30 clinics following a major cybersecurity incident. The disruption forced the hospital system to divert patients requiring care and cancel numerous scheduled appointments. Patients needing non-emergency assistance are advised to check provider announcements before traveling to clinics.
Source: SecurityWeek
Scammers Impersonate IT Support in Microsoft Teams to Deliver Ransomware
Attackers are taking advantage of external chat features in Microsoft Teams to impersonate help desk staff and trick employees into downloading malicious software. Researchers warn that this social engineering technique is recurring across hundreds of incidents to deploy backdoors and ransomware. Workplaces should restrict unsolicited external messaging and verify all technical support requests through trusted internal channels.
Source: The Hacker News
AI Pentesting Framework Abused to Steal Over 8 Million Records
Police in South Korea identified seven suspects linked to an operation that breached over 90 organizations using the ARTEX AI penetration testing tool. The ring, reportedly led by a former security pentester, stole approximately 8.2 million records across affected databases. Organizations using automated security tools should enforce strict credential boundaries and audit the permissions granted to AI agents.
Source: BleepingComputer
What to do this week
- Apply emergency security updates to PHP, Microsoft .NET, and Node.js environments to mitigate active Brotli exploits.
- Restrict external chat permissions in Microsoft Teams and remind staff never to download remote desktop utilities from unverified messages.
- Review online storefront codebases for unauthorized JavaScript injections and enable multi-factor authentication on administrative dashboards.
Stories this brief is based on
- PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw (The Hacker News)
- Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches (BleepingComputer)
- Microsoft releases emergency .NET patches for critical Brotli flaw (BleepingComputer)
- Industrial Vendors Check Products for PHP2Shell Vulnerabilities (SecurityWeek)
- PHP2Shell Exploitation Moves From Probes to Working Shells (SecurityWeek)
- CISA Adds Two Known Exploited Vulnerabilities to Catalog (CISA advisories)
- Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento (The Hacker News)
- 953 Online Stores Infected in Long-Lasting Malware Campaign (SecurityWeek)
- Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics (SecurityWeek)
- Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware (The Hacker News)
- Former pentester used ARTEX AI to steal 8.2 million data records (BleepingComputer)