# Tech Brief

> A daily tech newsletter for engineers and SaaS builders: AI, programming, security and e-commerce.

## Daily editions (markdown)

- [PHP2Shell, deadline tomorrow, and a third PHP RCE with no fix (Oct 28, 2026)](https://digests.aiocean.dev/2026-10-28.md): PHP2Shell is exploited, the federal deadline is tomorrow, and a third PHP RCE has no patch.
- [PHP2Shell is now exploited, and CISA says patch by Thursday (Oct 27, 2026)](https://digests.aiocean.dev/2026-10-27.md): PHP's RCE bugs now have working shells behind them, while the AI industry argues about trust: Qwen's odd network calls, Anthropic's S-1 and Claude's usage…
- [PHP2Shell, and why patching is only step one (Oct 26, 2026)](https://digests.aiocean.dev/2026-10-26.md): AI vendors are tightening what their models will help with while AI-found bugs like PHP2Shell flood in, and your patch window is the thing that shrinks.
- [Brotli decoder RCE (CVE-2026-111497, "Node2Shell" / "HTTP2Shell") (Oct 25, 2026)](https://digests.aiocean.dev/2026-10-25.md): A compression library nobody audits became the week's remote-code-execution bug, and the real argument is about how fast you can patch.
- [Node2Shell, an RCE in the Brotli decoder that reaches Node, Bun and Python (Oct 24, 2026)](https://digests.aiocean.dev/2026-10-24.md): The week the runtime layer got audited by machines: PHP and Node both shipped emergency RCE fixes within a day of each other.
- [PHP2Shell, two RCEs and an embargo that did not hold (Oct 23, 2026)](https://digests.aiocean.dev/2026-10-23.md): The day the embargo broke: PHP's two critical RCEs, a Node Brotli RCE and a CA with single-byte keys landed in the same 48 hours, and the supply chain…
- [PHP2Shell, two critical RCEs in the PHP runtime (Oct 22, 2026)](https://digests.aiocean.dev/2026-10-22.md): PHP's runtime got two critical RCE bugs on a day when three other pieces of trusted infrastructure, a CA, a Python package and a hosting platform, also lost…
- [PHP2Shell, two critical RCEs in PHP core (Oct 21, 2026)](https://digests.aiocean.dev/2026-10-21.md): Two trust systems failed in the same 48 hours: the PHP runtime under most of the web, and the CA bundle under every HTTPS client.