Brotli, a London power cut and a bad CA: what Moodle servers should check

php2shell took the headlines in October. Three other incidents in the same two weeks got less attention, and each one reaches a Moodle server in a different way. None of them needs a crisis. All three need someone to check something this week.

1. Brotli: an exploited bug your Moodle can reach

Brotli is a compression format, used mostly to make web pages smaller in transit. On 27 October, CISA added CVE-2026-111497, an out-of-bounds write in Google’s Brotli decoder, to its list of vulnerabilities being exploited in the wild, and told US federal agencies to patch by 10 November.¹1 BleepingComputer, CISA warns of hackers now exploiting critical Node2Shell flaw, 28 October 2026. A crafted Brotli stream can crash the process, leak memory and in some cases run code. Coverage calls it Node2Shell, because it was first found through Node.js.¹

Affected Brotli versions are 1.0.3 to 1.0.9, 1.1.0 and 1.2.0. The fixes are 1.0.10, 1.1.1 and 1.2.1.²2 Canadian Centre for Cyber Security, AL26-027: critical vulnerability impacting Google Brotli, 28 October 2026.

Here is why it matters to Moodle. Moodle makes outgoing HTTP requests through its own curl class: fetching RSS feeds, talking to LTI tools and repositories, checking for updates, calling web services. When that class resets its options it sets CURLOPT_ENCODING to an empty string.³3 Moodle source, public/lib/filelib.php, curl::resetopt(), branch MOODLE_503_STABLE, checked 4 November 2026. In libcurl that means “accept every compression format I support”, so responses are decompressed automatically. On a typical Linux server libcurl is built with Brotli, so a Moodle site that fetches a URL from a hostile server runs the vulnerable decoder.

PHP said as much for its own Windows builds. On 26 October it shipped rebuilt packages (8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1) with Brotli 1.2.1, noting that the decoder “can be reached through the cURL extension when automatic HTTP response decompression is enabled.”⁴4 PHP, news of 26 October 2026: updated PHP Windows builds for Brotli security fix. Moodle enables it.

What to check:

• Linux: run curl -V. If the first line lists brotli/, your libcurl uses it. Update the system Brotli library. On Ubuntu 24.04 the fixed package is libbrotli1 version 1.1.0-2ubuntu0.1, released 26 October. Ubuntu 16.04 to 20.04 only get the fix through Ubuntu Pro.⁵5 Ubuntu, libbrotli1 updates for 24.04 and USN-8956-2, 26 and 27 October 2026.
• Restart PHP-FPM or Apache afterwards. A running process keeps the old library loaded until it restarts.
• Windows: install the -1 PHP builds above.
• Docker images: rebuild them. An image built in September still has the old library.

2. Google Cloud London: the generators never started

On 20 October, zone europe-west2-b in London lost power for about six hours, from 07:00 to 13:08 UK time.⁶6 Google Cloud, incident report for europe-west2, final report of 27 October 2026. Google’s report is worth reading in full, because the chain of events is so ordinary:

• One of the two utility feeds was switched off for repairs after a generator test six days earlier.
• An underground cable fault outside the building cut the other feed.
• The controllers that should start the generators were wired to sense voltage on the feed that was switched off. They saw nothing wrong and never started them.
• The batteries lasted about five minutes.⁶

Single-zone virtual machines, non-HA Cloud SQL and zonal disks went down with the zone. The other two London zones stayed up but got slow and threw errors as everyone tried to move into them at once.⁶

Plenty of Moodle sites run exactly like that: one VM, one database, one zone. That is a reasonable choice for many schools. It is not a reasonable choice to make without knowing it. Ask your host three questions:

1. Is my database in more than one zone, or does a zone failure take it down?
2. Where are my backups, and are they in a different zone or region?
3. Who restores the site, and how long did it take the last time anyone tried?

If nobody has ever restored your Moodle from backup onto a new server, you don’t know whether you can.

3. eMudhra: eight certificates that could vouch for anyone

On 19 October, Cloudflare learned that the private keys of eight intermediate certificates belonging to eMudhra, a certificate authority, had been compromised.⁷7 Cloudflare, eMudhra certificate compromise, October 2026. With those keys an attacker could issue a valid-looking certificate for any domain and sit in the middle of a TLS connection. Browsers revoked them quickly. Cloudflare had patched its clients and its network by the next evening and reported no exploitation on its services.⁷

Browsers update fast. Servers don’t. A Moodle server trusts whatever is in its operating system’s certificate store, and so do the PHP processes, cron jobs and containers around it. Cloudflare’s advice to developers applies directly: check the trust store your application actually uses, rebuild container images, and never switch off certificate checks to make an error go away.⁷

For a Moodle server that means: keep the ca-certificates package and the OS up to date, rebuild images, and if a plugin’s outgoing calls start failing with certificate errors, find out why before anyone sets CURLOPT_SSL_VERIFYPEER to false.

While you’re in there

Moodle’s own October security release fixed a serious missing access check on H5P content files (MSA-26-0044), in 5.2.4, 5.1.8, 5.0.11 and 4.5.15.⁸8 Moodle, security announcements, MSA-26-0044, 15 October 2026. If you are not on those versions yet, do it in the same maintenance window. The next planned Moodle releases are on 7 December.⁹9 Moodle, releases.

The short version

One library update with a restart, three questions for your host, and a current certificate store. None of it shows up on the Moodle admin page, which is exactly why it gets missed. If outgoing calls from your custom plugins are part of the picture, we check and fix those.