Today’s briefing covers active exploitation of critical vulnerabilities in PHP and Brotli libraries, an AI model that chains exploits across major platforms, major infrastructure expansions for AI compute, a new real-time world simulation model, factory-validated liquid-cooled racks for NVIDIA Vera Rubin, and an open multilingual speech transcription model.
Listen to today’s briefing (podcast)
Key takeaways
PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) are under active attack in network infrastructure, with 32.5 million internet-facing PHP services still potentially vulnerable.
CISA added the critical Brotli Node2Shell flaw (CVE-2026-111497) to its KEV catalog, giving federal agencies until November 10 to patch.
An unreleased Anthropic AI model autonomously discovered and chained vulnerabilities in Chrome, Safari, Android, Windows, and Linux into working exploits, all now patched.
NVIDIA and Oracle are scaling OCI Superclusters with Vera Rubin NVL72 systems to multi-gigawatt capacity for AI training and agentic workloads.
Google DeepMind’s Genie 4 introduces real-time interactive world simulation with integrated audio and Gemini-powered planning, available to select testers.
PHP2Shell Critical Vulnerabilities Actively Exploited in Network Infrastructure
Two critical PHP vulnerabilities dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution and were fixed by the PHP project on October 21, according to BleepingComputer InfraTrust report and The Hacker News CISA. The flaws affect the open-source language behind roughly 70% of websites and also embed in management interfaces of firewalls, VPNs, application delivery controllers, and network-attached storage devices, as reported by TechCrunch and BleepingComputer InfraTrust report.
Attackers are actively exploiting PHP2Shell vulnerabilities across critical network infrastructure, with CISA adding both flaws to its Known Exploited Vulnerabilities catalog on October 26, per BleepingComputer InfraTrust report and The Hacker News CISA. Researchers at Calif and Wiz discovered the flaws in August with help from OpenAI and Google models, and disclosed them jointly with OpenAI; the flaws had existed in PHP code since 2012, according to BleepingComputer blast radius. Amazon observed an exploitation attempt on October 17, four days before public disclosure; watchTowr saw exploitation attempts in the wild on October 21, the same day PHP shipped patches, per BleepingComputer blast radius.
Cloudflare observed attack traffic escalating rapidly after disclosure, and by October 27 Censys counted 32.5 million internet-facing PHP services still running potentially vulnerable versions, plus over 60 million not reporting a version, according to BleepingComputer blast radius. Because vendors compile PHP directly into appliance firmware, customers cannot install PHP security updates themselves and must wait for each vendor to release updated firmware; Palo Alto Networks, F5, NetScaler, Check Point, and QNAP confirmed affected products and are developing fixes, per BleepingComputer InfraTrust report. InfraTrust recommends administrators ensure PHP-backed management interfaces are not exposed to the Internet while waiting for patches, and prioritize patching NetScaler and Ivanti Connect Secure, followed by Fortinet’s October 22 FortiOS, FortiManager, and FortiAnalyzer updates, according to BleepingComputer InfraTrust report.
Why it matters: Active exploitation of PHP2Shell in network infrastructure devices requires urgent assessment, vendor firmware patches, and segmentation of management interfaces, while legacy PHP versions remain unpatchable, risking data breaches and service disruptions.
Brotli Node2Shell Flaw Exploited; CISA Adds to KEV
CISA confirmed on Tuesday that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell, according to BleepingComputer. The vulnerability, tracked as CVE-2026-111497, is a critical-severity flaw stemming from an out-of-bounds write weakness in the Brotli decoder used to expand data compressed with Google’s Brotli lossless compression algorithm, per BleepingComputer. Unprivileged attackers can use a maliciously crafted Brotli-compressed stream to trigger crashes or memory leaks and potentially gain remote code execution on devices with vulnerable Brotli libraries or binaries, according to BleepingComputer.
The security issue was first identified in the Node.js JavaScript runtime environment but also affects HTTP servers and clients that rely on vulnerable Brotli implementations, per BleepingComputer. On Sunday, Microsoft pushed an emergency .NET security update warning that attackers could exploit the flaw to escalate privileges on systems with a vulnerable .NET version, according to BleepingComputer. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog on Tuesday and ordered US government agencies to patch their systems within two weeks, by November 10, as mandated by Binding Operational Directive (BOD) 26-04, per BleepingComputer.
CISA stated that Google Brotli contains an unchecked return value vulnerability allowing remote unauthenticated attackers to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause denial of service, or potentially execute arbitrary code, according to BleepingComputer. CISA urged all network defenders to prioritize patching, and recommended blocking incoming Brotli-compressed requests at the proxy or firewall level or disabling Brotli decoding until updates can be applied, per BleepingComputer. After patching, administrators must restart affected processes and rebuild and redeploy affected container images, according to BleepingComputer. The flaw impacts Brotli versions 1.0.3 through 1.2.0, as reported by SecurityWeek. The bug was reported by researchers at OpenAI, and Node.js and Google released fixes on October 21, per SecurityWeek. Microsoft, maintainers of two Python packages, Bun, Envoy, and Istio have also released fixes, and Palo Alto Networks is rolling out hotfixes for PAN-OS, according to SecurityWeek.
Why it matters: Active exploitation of the critical Brotli Node2Shell flaw across Node.js, .NET, and HTTP servers requires immediate patching, mitigation, and container redeployment to prevent compromise and data breaches.
Anthropic Unreleased AI Model Chains Vulnerabilities into Working Exploits
An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, according to The Hacker News. The exploits were built in the lab after the model was prompted, not seen in any real attack, per the same report.
Anthropic reported every flaw to the vendor first, so all of them are already patched, according to The Hacker News. The findings were disclosed in Anthropic’s latest report, per The Hacker News.
Why it matters: This demonstrates AI’s advancing ability to autonomously discover and chain complex vulnerabilities across major platforms, requiring updated threat modeling and defense strategies.
NVIDIA and Oracle Expand Vera Rubin to Multi-Gigawatt Scale on OCI
NVIDIA and Oracle announced plans to expand Oracle Cloud Infrastructure (OCI) Superclusters with NVIDIA Vera Rubin NVL72 systems to multi-gigawatt scale, according to NVIDIA Newsroom Multimedia. The expansion supports growing customer demand for AI training, inference and agentic applications, per the same announcement.
Why it matters: This delivers unprecedented AI compute density on OCI for large-scale model training and inference workloads, accelerating development of more capable AI agents and services.
Google DeepMind Unveils Genie 4 Real-Time Interactive World Model
Genie 4 is a new world model from Google DeepMind that unlocks unprecedented realism in real-time simulation, according to Google DeepMind’s blog. Described as the most realistic and interactive world model yet, Genie 4 can build environments and simulate worlds on command, keep prompting to work out what happens next, and explore and reshape them in real time, per the DeepMind YouTube overview. It can transform a picture into a dynamic environment ready to explore, complete with ambient sound, and allows creating a scene, moving the camera, directing every detail, and watching the world change live, according to the same source.
Genie 4 can describe an interactive experience; a few seconds later the user is inside it with full control over their character, per the DeepMind YouTube overview. It can simulate scenarios like helping robots practice tasks virtually so they might carry out work in the physical world, and turns ideas into worlds you can hear, see, and shape for stories, simulations, and interactive experiences, according to the same source. Genie 4 is the successor to Genie 3, which was shown in August 2025, per The Decoder. Genie 3 was released in January 2025, according to Google Cloud Press Corner.
Genie 4 simulates interactive worlds in real time, including sound and talking characters, with Gemini models planning in the background what happens next in the simulation, per The Decoder. Only select testers can try the world model for now, according to The Decoder. Genie 4 calculates a scene frame by frame, reacting to input as it goes; users move through the scene with the keyboard and steer events with text prompts, per The Decoder. It is DeepMind’s first real-time world model that generates sound directly, with each world having its own background audio and handling dialogue with characters that talk to each other and react in real time, according to The Decoder. The biggest gain in realism is in rendering people: characters move naturally, react to surroundings, and users can control them directly, per The Decoder.
Why it matters: Genie 4 represents a leap in real-time interactive world simulation with integrated audio and Gemini-powered planning, enabling new training grounds for robotics and AI agents and a step toward hybrid world models.
Vertiv Ships Factory-Validated Liquid-Cooled Racks for NVIDIA Vera Rubin
Vertiv announced SmartIT, a pre-engineered rack architecture that packages the rack, DC power conversion and distribution, direct-to-chip liquid cooling, in-rack coolant distribution, and monitoring into a factory-validated unit for NVIDIA MGX and OCP ORV3 systems, according to StorageReview. The supported systems list includes NVIDIA GB300 NVL72, Vera Rubin NVL72, DGX Rubin NVL8, and HGX Rubin NVL8, and the product is available now worldwide, per the same article.
Vertiv’s enterprise configuration delivers 120 to 142kW per compute rack with 242kW of N+1 direct-to-chip cooling in the adjacent support rack, according to StorageReview. The compute rack is the Vertiv Open Rack for NVIDIA MGX, measuring 2,291.8mm tall including castors, 600mm wide, 1,068mm deep (or 1,200mm with extension), and weighing 189kg empty, per StorageReview. Power is delivered as 50VDC from PowerDirect 33kW shelves over a DC busbar rated to 1,400A, with in-rack manifolds carrying coolant to cold plates, according to StorageReview.
The support rack houses three CoolChip CDU 121 units at 121kW each for 242kW N+1 cooling, plus two PowerDirect shelves, network switches, facility water loop isolation valves and actuators, an Avocent ACS 804 leak detection gateway, two Avocent RM1048P rack managers, and two PowerIT rack transfer switches, per StorageReview. Each of the three racks receives a Liebert DCD47 rear door heat exchanger rated at 47kW room-neutral, providing 141kW of supplemental air cooling alongside the liquid loop, according to StorageReview. A Liebert APM2 modular UPS with battery cabinet is optional, offering up to 97.5% double-conversion efficiency, per StorageReview. Installation, commissioning including flush and fill, and project management are included, with Vertiv Global Services handling lifecycle support, according to StorageReview. Vertiv has not published a power or cooling envelope for a Vera Rubin NVL72 build, though Rubin systems appear on the supported list and were demonstrated in an HGX Rubin NVL8 unit at NVIDIA GTC Berlin, per StorageReview. Scott Armul, Vertiv’s Chief Product and Technology Officer, stated that AI is fundamentally changing data center infrastructure demands and Vertiv SmartIT brings disciplines together in a factory-validated architecture, according to StorageReview.
Why it matters: Vertiv’s factory-validated SmartIT racks dramatically simplify deploying high-density NVIDIA Vera Rubin systems by integrating power, liquid cooling, and monitoring into a pre-tested unit, reducing on-site work to just facility connections.
Nvidia Releases Open Nemotron 3.5 Transcribe Multilingual Speech Model
Nvidia on Wednesday released Nemotron 3.5 Transcribe, a free, open-weight model that transcribes audio in up to 40 languages, according to TechCrunch. Nvidia also released version 2 of Granary, its open source speech dataset, per TechCrunch. Nemotron 3.5 can translate 31 languages to and from English, handle recordings up to an hour long, and tell up to eight speakers apart, according to TechCrunch. Nvidia claims Nemotron 3.5 beats rivals on benchmarks, including Hugging Face’s Open ASR Leaderboard, per TechCrunch.
The tools target developers building apps for business meetings and medical transcription, two of AI’s most established footholds in the workplace, according to TechCrunch. Developers can use the model, the updated Granary dataset, and tools like NeMo Speech to customize apps to recognize an industry’s jargon in each language, per TechCrunch. Transcribe works with recorded audio, not livestreams, according to TechCrunch. Transcribe, at 30 billion parameters, can run on a single chip, from the Jetson AGX Thor robotics controller and DGX Spark chip powering new laptops, to Blackwell datacenter chips, per TechCrunch. Nemotron 3.5 Transcribe joins Nvidia’s open-weight voice models, including Parakeet (1.1 billion parameters), according to TechCrunch.
Nvidia says the model transcribes 40 languages, translates 31 of them to or from English, and identifies speakers in 13, according to The Decoder. Users control the model with simple instructions; the same meeting recording can become a transcript with speaker labels, an English translation, or a summary of decisions, per The Decoder. The model has 30 billion parameters, but only about 4 billion are active per processing step, allowing it to run on a single Nvidia GPU from DGX Spark to data center hardware, according to The Decoder. Nvidia says the model processes 100 hours of audio in under three minutes on an RTX PRO 6000 Blackwell Server Edition at NVFP4 precision, per The Decoder. On Hugging Face’s English Open ASR Leaderboard, Transcribe ranks first among open-weight models with an average word error rate of 5.33 percent, according to The Decoder. In Artificial Analysis’ comparison, it scores 2.81 percent, close to the best open model Voxtral Small at 2.77 percent, while using only about a sixth of the active parameters, per The Decoder. VoiceArena tested 14 systems on overlapping conversations; Transcribe took first place in speaker recognition, missing 8.32 percent of words versus a median of about 31 percent, according to The Decoder. On David AI’s benchmark measuring speaker attribution across 21 languages, Transcribe posted the lowest error rate, just ahead of Nvidia’s own dedicated model, per The Decoder. Granary v2 contains about 844,000 hours of speech in 48 languages, up from roughly 643,000 hours in 25 languages in the previous version, according to The Decoder. Each recording comes in several transcription styles: verbatim with filler words and spelled-out numbers, and cleaned up with no fillers and digits instead of words, per The Decoder. Nvidia tested fine-tuning on recordings of Indian doctors and medical students; a precise prompt cut error rate from 30.8 to 23.8 percent, and after fine-tuning to 11.8 percent, according to The Decoder. The fine-tuning process took about 14 GPU hours on a single Nvidia GB300, per The Decoder. The base model has limits: features vary by language, audio question-answering was trained only in English, and it works only on recorded audio; Nvidia advises spot-checking names, speaker changes, and answers, according to The Decoder. Nvidia introduced Nemotron 3 Diarization in September, a dedicated speaker recognition model that handles live conversations but needed a separate model like Parakeet for transcription; Nemotron 3.5 Transcribe combines both jobs and adds translation and audio understanding, but does not support real-time processing, per The Decoder.
Why it matters: Nemotron 3.5 Transcribe offers a free, open-weight multilingual speech model with speaker diarization and translation that runs on a single GPU, enabling customizable transcription apps for meetings and healthcare without cloud dependency.
Claude — The story discusses Anthropic’s unreleased model demonstrating advanced vulnerability discovery and exploit chaining capabilities. Explore Anthropic’s AI assistant Claude for writing, research, document analysis and coding tasks. Try Claude
Runpod — Runpod offers on-demand GPU clusters and serverless endpoints for AI training and inference, providing a scalable alternative to the massive infrastructure expansion covered in this story. Explore Runpod’s serverless GPU endpoints and clusters for scalable AI workloads without managing infrastructure. Try Runpod
NVIDIA RTX GPU on Amazon — The open-source Nemotron 3.5 Transcribe model can be run locally on compatible NVIDIA GPUs. See current options and reviews on Amazon. View on Amazon
Affiliate disclosure: some links in this description are affiliate links. If you sign up through them, SysArticles may earn a commission at no extra cost to you. We only mention tools that are relevant to the story. As an Amazon Associate I earn from qualifying purchases.
These developments highlight the accelerating pace of AI infrastructure deployment and the persistent urgency of vulnerability management across the software supply chain. Stay patched, stay segmented, and watch the compute capacity grow.
Ali YAZICI is a Senior IT Infrastructure Manager with 15+ years of enterprise experience. While a recognized expert in datacenter architecture, multi-cloud environments, storage, and advanced data protection and Commvault automation , his current focus is on next-generation datacenter technologies, including NVIDIA GPU architecture, high-performance server virtualization, and implementing AI-driven tools. He shares his practical, hands-on experience and combination of his personal field notes and “Expert-Driven AI.” he use AI tools as an assistant to structure drafts, which he then heavily edit, fact-check, and infuse with my own practical experience, original screenshots , and “in-the-trenches” insights that only a human expert can provide.
