The Canadian Cyber Centre warns that CVE-2026-111497, a remotely exploitable out-of-bounds write in the Google Brotli decoder, could cause memory corruption, information disclosure, crashes or code execution. CISA added it to its KEV database.
Canada’s Cyber Centre warns that vishers impersonate IT staff and relay credentials and MFA responses through lookalike sign-in pages. The actor has reportedly used authenticated sessions to access Microsoft 365 and SaaS data; the alert recommends phishing-resistant MFA
Canada’s Cyber Centre warns that two PHP use-after-free vulnerabilities could allow unauthenticated code execution. A PoC is reportedly available, but no active exploitation had been identified; organizations should update affected installations and prioritize internet-
