Kenya In Focus

[Mike Kipruto @itsMikeKipruto]

🚨 Palo Alto Networks confirms a critical Brotli vulnerability affecting some PAN-OS firewall deployments.

CVE-2026-111497 carries a CVSS score of 9.2.

A crafted compressed stream could trigger memory corruption, expose sensitive data, crash services, or potentially execute code.

No active exploitation reported.

Official advisory: https://t.co/2VTiVvmPJU

[Mike Kipruto @itsMikeKipruto]

180,000 infected computers. One disrupted command-and-control operation.

Australia cut off a cybercriminal's access to Amadey-infected machines, but the malware wasn't removed.

Disrupting the attacker is only half the job. Infected systems still need remediation, and stolen credentials may remain exposed.

[Mike Kipruto @itsMikeKipruto]

OpenAI patched a flaw that let researchers extract hidden AI reasoning through its compaction workflow.

The encryption wasn't broken. The workflow was abused.

A critical AI security lesson: protecting sensitive data means securing every process that handles it, not just encrypting it.

[Sheikh Marghubali 🇰🇪 @sheikhmargub]

I've been a DStv customer for many years, these new packages coming on 5th November are a surprise.
After years of annual price increases, suddenly we have such drastic reductions and much better value?
Have customers finally been heard, or is competition forcing a rethink?
@DStv_Kenya, care to explain?

[Mike Kipruto @itsMikeKipruto]

Learn how to install and use it: https://t.co/QVRGH92ckk

[Mike Kipruto @itsMikeKipruto]

A form submission tells you who contacted your business. WPForms User Journey helps you understand what they did before reaching out.

When someone submits a form, you can see the pages they visited, available referral information, time spent on each page, and URL parameters, all within the form entry details.

That means you can spot patterns, such as leads regularly visiting your pricing page before enquiring, or potential customers reading a specific service page before requesting a quote.

You can use those insights to improve landing pages, refine your content, and understand which parts of your website support conversions.

You can even include journey details in form notification emails using WPForms' Entry User Journey Smart Tag.

Instead of treating every submission as an isolated lead, you get more context to help you decide what to improve next.

[Moe @moneyacademyKE]

Producing a 250ml bottle of spirit costs around Sh185, yet some “legitimate” manufacturers sell theirs at Sh140–160 per bottle.

This raises concerns about authenticity, tax compliance and consumer safety, according to the Alcoholic Beverages Association of Kenya.

[Moe @moneyacademyKE]

Kenyan taxpayers could pay Sh181 billion if the government cancels the 30-year Rironi–Mau Summit highway concession.

The amount is a potential termination liability, not an immediate bill, according to the National Treasury.

[Mike Kipruto @itsMikeKipruto]

Tailscale has confirmed serious privilege-escalation issues in Tailscale SSH.

The Tailworm research describes how a compromised device could potentially lead to root access on other servers, depending on permissions and configuration.

No CVE or patched release yet. Tailscale is targeting a fix within 24 hours.

Mitigate SSH forwarding now.

[Mike Kipruto @itsMikeKipruto]

A researcher who gained root access to a 2025 Samsung Smart TV claims to have uncovered extensive tracking capabilities, including automatic content recognition, screenshot handling, geolocation, network mapping, audio-event telemetry and AI-driven viewer profiling for targeted advertising.

The findings remain unverified on an unmodified TV.

[Nelson Amenya @amenya_nelson]

Wakenya wanangoja wapangwe na pilgrimage za wamunyoro. 🫴🏾

[Mike Kipruto @itsMikeKipruto]

Two critical Wasmtime sandbox escapes, both rated CVSS 9.9:

• CVE-2026-115889 affects all architectures.
• CVE-2026-115893 affects ARM64.
Both flaws are in Cranelift, Wasmtime’s default compiler. A malicious WebAssembly module could escape its sandbox.

If your application embeds Wasmtime, update the dependency. Updating the CLI alone is not enough.

[Mike Kipruto @itsMikeKipruto]

953 online stores compromised, mostly running Magento.

The campaign exploited PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236) to gain access, then injected JavaScript loaders designed to evade security scanners.

One case involved a rogue admin account despite patched Magento core.

Patching matters. So does auditing admin access and unexpected CMS blocks.

[Mike Kipruto @itsMikeKipruto]

PHP2Shell is now a confirmed exploitation issue, not just a theoretical risk.

CVE-2026-109618 and CVE-2026-109619 enable unauthenticated RCE on affected PHP deployments.

If you run PHP in production, verify your version and patch now.

[Mike Kipruto @itsMikeKipruto]

When your primary mailer fails, WordPress emails can stop getting through. WP Mail SMTP Pro’s Backup Connection automatically reroutes emails through a backup mailer when the primary connection fails. Set up a fallback before you need it.

[Kenya In Focus @KenyaInFocus]

PHP has rebuilt its Windows packages to fix CVE-2026-111497, a critical Brotli decompression flaw. The `-1` suffix matters: updated dependencies, same PHP runtime. Windows users should update.

[Kenya In Focus @KenyaInFocus]

A critical Brotli flaw has prompted new PHP Windows builds. The fix is in Brotli 1.2.1, not a new PHP runtime. Check your dependencies and update affected Windows installations.

[Kenya In Focus @KenyaInFocus]

A critical Brotli flaw has prompted new PHP Windows builds. The fix is in Brotli 1.2.1, not a new PHP runtime. Check your dependencies and update affected Windows installations.

[Mike Kipruto @itsMikeKipruto]

PHP has issued updated Windows builds to fix CVE-2026-111497, a critical Brotli decompression vulnerability.

Fixed packages:
• PHP 8.5.12-1
• PHP 8.4.27-1
• PHP 8.3.36-1
• PHP 8.2.35-1

The -1 suffix signals a dependency rebuild, not a new PHP runtime version.

Windows users should update. Linux deployments need to assess their own Brotli packages.

Official notice: https://t.co/ODx7YtXTNf

[Kenya In Focus @KenyaInFocus]

PHP has rebuilt its Windows packages to fix CVE-2026-111497, a critical Brotli decompression flaw. The `-1` suffix matters: updated dependencies, same PHP runtime. Windows users should update.

[Mike Kipruto @itsMikeKipruto]

PHP has issued updated Windows builds to fix CVE-2026-111497, a critical Brotli decompression vulnerability.

Fixed packages:
• PHP 8.5.12-1
• PHP 8.4.27-1
• PHP 8.3.36-1
• PHP 8.2.35-1

The -1 suffix signals a dependency rebuild, not a new PHP runtime version.

Windows users should update. Linux deployments need to assess their own Brotli packages.

Official notice: https://t.co/ODx7YtXTNf

[Mike Kipruto @itsMikeKipruto]

PHP has issued updated Windows builds to fix CVE-2026-111497, a critical Brotli decompression vulnerability.

Fixed packages:
• PHP 8.5.12-1
• PHP 8.4.27-1
• PHP 8.3.36-1
• PHP 8.2.35-1

The -1 suffix signals a dependency rebuild, not a new PHP runtime version.

Windows users should update. Linux deployments need to assess their own Brotli packages.

Official notice: https://t.co/ODx7YtXTNf