Bravura Security Team

October 2026: Brotli, PHP2Shell and Java CVEs

No Bravura Security product update required

In October 2026, Google, the PHP project, and Oracle disclosed vulnerabilities in three widely used third-party components. We reviewed all three against the Bravura Security Fabric solution. None requires an update to your Bravura Security products. Here is a short summary and a few routine recommendations.

What we reviewed

• Brotli decoder (CVE-2026-111497). A flaw in the Google Brotli decompression code used by Node.js, .NET, and some Python packages. Bravura Security Fabric is not directly affected, because it does not decompress Brotli data from users or networks. We recommend the routine runtime updates below. Read the Brotli advisory.
• PHP2Shell (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560). Flaws in the PHP runtime. The Bravura Security Fabric solution does not use PHP and ships no PHP runtime, so it is not affected. If you installed PHP on a Bravura Security Fabric server for another application, update it to a fixed version or remove it. Read the PHP advisory.
• Java runtime (CVE-2026-91403). A flaw in the Java runtime. Bravura Security Fabric is not directly affected, because its Windows installer does not include a Java runtime. If you use optional Java-based connectors or the Guacamole remote desktop gateway, update the Java runtime those features use. Read the Java advisory.

What we recommend

These updates keep the third-party runtimes on your server current. They are routine maintenance, not a fix required to secure Bravura Security Fabric, which is not directly affected.

• .NET: Update the .NET runtime on each Bravura Security Fabric server to 8.0.33 or later (10.0.14 or later on releases that use .NET 10), then restart the Bravura Security Fabric services.
• Node.js: If you run your own Node.js programs, update them to 22.23.4, 24.22.1, or 26.12.1, or later. We will update the Node.js bundled with Bravura Security Fabric in an upcoming release.
• Python: If you installed the Brotli or brotlicffi package in the Python used by Bravura Security Fabric, upgrade it (Brotli 1.2.1, brotlicffi 1.2.1.0 or later) or remove it.
• PHP: Our products do not use PHP. If it is installed on a Bravura Security Fabric server, we recommend removing or disabling it. If another application on that server needs PHP, update it to a fixed version.
• Java: If you use Java-based connectors or the Guacamole gateway, update the Java runtime those features use to a build that includes the Oracle or OpenJDK fix. For Docker installs of the gateway, rebuild the image to pick up a patched Java runtime.

Where to read the details

These are third-party runtime issues that are not within the Bravura Security code. The vendor severity scores you may have seen, for example 9.2 for Brotli and for PHP2Shell, rate those components, not Bravura Security products.

Full advisories are posted below. Each advisory has the technical detail and the exact fixed versions.

Questions you might have

Do I need to patch or upgrade my Bravura Security products?

No. None of these require a Bravura Security product update. The recommended updates are to third-party runtimes you manage.

How do I know if anything applies to me?

The .NET, Node.js and Python maintenance applies to any Bravura Security Fabric server. The Java update applies only if you use Java-based connectors or the Guacamole gateway. The PHP note applies only if you installed PHP yourself on a Bravura Security Fabric server.

Which versions did you review?

Bravura Security Fabric 12.7, 12.8, 12.9 and 12.10. Older versions are expected to be affected in the same manner as the currently supported versions, but were not explicitly investigated.

Who can I ask?

Contact support@bravurasecurity.com and we will help.

We review third-party vulnerabilities that touch your environment, not just our own code. If anything changes, we will let you know.