Aruba patches 72 flaws, including eight enabling remote code execution

The SANS Internet Storm Center’s 26 October 2026 podcast reports on several notable vulnerability developments. In PHP, discussion centres on PHP2Shell exploits that remain unreliable in public-ready form due to ASLR on modern Unix/Linux systems, memory_limit settings, and version/build-specific offsets.

Even so, there have been targeted exploits observed in the wild aimed at high‑value systems, with researchers advising organisations to keep patching notes and anticipate additional changes in coming weeks, as some protections (such as session upload progress settings) can help mitigate exposure even after updates are applied.

In the Node.js arena, a Brotli decoder out-of-bounds write vulnerability has been highlighted as a remote code execution risk. Brotli’s decoder, used for compressing HTML and JavaScript, relies on a fixed dictionary; the flaw has broad impact because many products depend on the library. OpenAI Codex is credited with identifying this vulnerability, continuing a trend of AI-assisted security discoveries.

The briefing also flags several Tailscale mesh VPN vulnerabilities that bypass trust assumptions if an attacker gains access to a tailnet, potentially enabling unauthorised systems to join a user’s network.

HP Enterprise’s Aruba product line receives a substantial patch update: ArubaOS 8 and 10 are addressed in a fix covering 72 vulnerabilities, eight of which permit unauthenticated remote code execution. Organisations using Aruba gear are urged to apply the update promptly and to monitor forthcoming advisories. The report closes with caution that large, AI-assisted security updates may become more common as vendors respond to newly discovered flaws.