Updated October 30, 2026. Exploitation status changes daily, so check the vendor advisory and the CISA KEV catalog before you act.
October 2026 gave defenders very little room to breathe. PHP shipped emergency fixes for two remote code execution flaws that leaked before the patch, and CISA now lists both as exploited. GitLab fixed a second CVSS 10.0 bug in nine days. Palo Alto Networks, Cisco, Fortinet, Citrix and Arista all had edge-device flaws attacked in the wild. A certificate authority also lost the private keys of eight intermediate CAs.
This post lists the month’s most important vulnerabilities, grouped by what you should do about them. Confirmed exploitation comes first. One caveat on the title: a few entries, such as PAN-OS CVE-2026-0322, score below 9.0 but are included because attackers are using them. Read the full CISA KEV catalog for the federal view of what is being exploited.
Status: exploited in the wild, in CISA KEV since October 26 (federal deadline October 29), patches available.
PHP released emergency fixes on October 21 for two flaws that can give an unauthenticated attacker remote code execution on servers that handle web requests. Both are CVSS 4.0 9.2 use-after-free bugs (CWE-416). CVE-2026-109618 is memory corruption during out-of-memory handling. CVE-2026-109619 is stale global state left in a worker.
CVE | Flaw | Severity | Fixed in |
CVE-2026-109618 | Memory corruption during out-of-memory handling | CVSS v4.0 9.2 | PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
CVE-2026-109619 | Stale global state left in a worker | CVSS v4.0 9.2 | PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
Fixed in: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Reports say the affected range goes back as far as PHP 5.4, but watchTowr points out that no official advisory confirms every old version.
Exploitation timeline
Cloudflare reported attempts at very large scale, and Censys estimates more than 32 million PHP services still ran an affected version.
What to do
Update PHP on web servers, PHP-FPM pools, containers and embedded runtimes, then restart the workers. The maintainers say there is no complete mitigation. For CVE-2026-109618 the advisory lists memory_limit=-1 as a stopgap only.
A separate, configuration-dependent PHP issue (CVE-2026-115560, session upload progress) is not fixed by these releases. If you do not use it, consider turning off session.upload_progress.enabled.
CVE-2026-0257, GlobalProtect authentication bypass. An unauthorized attacker can set up VPN connections through the GlobalProtect portal or gateway. Unit 42 continues to see exploitation attempts by ransomware operators, including Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc).
CVE-2026-0322, management interface code injection. Fixes came out on October 14. The CVSS 4.0 score is 8.6 and the attacker needs valid credentials and network access to the management interface, but the code then runs as root. CISA added it to KEV the same day. PA-Series, VM-Series and Panorama are affected. Cloud NGFW and Prisma Access are not. There is no workaround, so restrict management access to trusted internal addresses.
CVE-2026-0322 and the PHP2Shell CVEs are separate bugs. The PHP2Shell activity against PAN-OS is a different attack path that happens to hit the same exposed interface.
Status: patched October 21. No exploitation reported and not in CISA KEV as of October 28.
An integer overflow in GitLab’s regular expression compiler can be triggered by a crafted regex. The attack is network-based, needs no privileges and no user interaction, and has high impact on confidentiality, integrity and availability.
CVE | Severity | Affected | Fixed in | Exploited in the wild |
CVE-2026-110264 | CVSS 10.0 | Self-managed CE/EE, 7.0 onward | 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, 19.5.1 | None reported |
The same release fixes 12 vulnerabilities. The next most serious is CVE-2026-15723 (CVSS 8.2), an authenticated account takeover when OmniAuth SAML and LDAP auto-linking are both enabled.
Secure Email Gateway, CVE-2026-76519 (CVSS 9.8, exploited)
A flaw in the Advanced Malware Protection File Reputation feature lets a remote, unauthenticated attacker write arbitrary files on the OS. It is exploitable when File Reputation is enabled, assigned to a mail policy, and Content Scanner Tools is older than 25.3.0.5525. There is no workaround and CISA has added it to KEV. Press coverage calls this the second exploited Secure Email Gateway zero-day in about 30 days. Fixed AsyncOS releases reported are 15.5.5-014 and 16.5.0-780, so confirm them in Cisco’s advisory.
ASA and FTD SSL VPN, CVE-2026-76418 (CVSS 8.6, exploited)
A logic error when secondary authentication is configured on a tunnel group lets an unauthenticated attacker reload the device with a crafted request. It is a denial of service, not code execution, but Cisco’s October 28 advisory says it is aware of active exploitation. There is no true workaround. A temporary mitigation is no tunnel-group-list enable, or removing secondary authentication from DefaultWEBVPNGroup, which weakens VPN security. Upgrade to a fixed release.
Expressway, CVE-2026-76466 (CVSS 9.8)
Published October 21. Expressway X15.5.3 and earlier are affected, and X15.5.20 is the first fixed release. Customers on X14 or earlier must migrate. It allows command execution as root. No exploitation has been reported. Sources conflict on whether it needs a clustered deployment, so check your own configuration against the advisory.
Unified Communications hardening release (eight CVEs, up to CVSS 9.8)
CVE-2026-76473, -76474, -76475, -76476, -76477, -76478, -76479 and -76481 cover Emergency Responder, Prime Collaboration Deployment, Unified CM, IM&P, Session Management Edition and Unity Connection. The top scores are 9.8 for output neutralization (CWE-74) and improper authentication (CWE-287), and 9.3 for XSS. Each score is the maximum for its CWE group, not a score per CVE. Cisco found these internally and knows of no exploitation. There are no workarounds. Release 15 is fixed in 15SU5 and Release 14 must migrate.
FortiMail, CVE-2026-104286 (CVSS 9.8, exploited). A path traversal flaw lets an unauthenticated attacker write arbitrary files through crafted HTTP(S) requests. CISA added it to KEV on October 1. It is fixed in FortiMail 8.0.2, 7.6.7 and 7.4.9, and FortiMail Cloud was fixed on October 5. Interim guidance was to disable identity-based encryption or restrict management-interface access.
FortiSIEM, CVE-2026-106173. Singapore’s CSA rates it CVSS 9.8 and The Hacker News reports 9.4, so quote the score with its source. A public proof of concept exists for unauthenticated RCE. Move to FortiSIEM 7.5.1 or later. I found no confirmed exploitation in the wild.
NetScaler ADC and Gateway took a rough run starting in late September.
The SAML-related flaws only matter if the appliance is configured as a SAML service provider or identity provider, so check that first when you triage.
An out-of-bounds write in the bundled Brotli decoder. Node.js rates it High, while the CVE record gives CVSS 4.0 9.2. Fixed in 22.23.4, 24.22.1 and 26.12.1. Imperva’s demo covered fetch() reading a Brotli response and Express 5 or body-parser 2 decoding a Brotli request body. A bare Node.js HTTP server does not decode request bodies by itself.
How real is the RCE? Imperva’s PoC ran code on the official 24.22.0 arm64 image, but only after several tries on one build. A second PoC from October 22 reached code execution only on a deliberately weakened build and produced a crash on a standard one. Treat it as a serious bug with a narrow public exploit. The same decoder code appears in Python’s Brotli and brotlicffi packages, fixed in Brotli 1.2.1, 1.1.1 and 1.0.10.
Drupal core Field UI, CVE-2026-108097
Drupal rates this critical RCE 19/25 on its own scale, which is not CVSS. Core alone is not exploitable, but contributed modules provide paths and at least one needs no authentication. Fixed in Drupal 11.4.10, 11.3.19 and 10.6.19. Older branches are end-of-life and get no patch. If you cannot update yet, uninstall the field_ui module. A second critical, CVE-2026-108099, affects the contributed Entity List module and is fixed in 3.0.10.
NGINX, CVE-2026-15176, CVE-2026-97205, CVE-2026-93479
F5 shipped out-of-band fixes for three flaws rated CVSS 9.2 each. Two are in the HTTP/3 module and one is in the map directive. They can cause DoS or possibly code execution on non-default configurations. Sources disagree on whether the advisory date is October 14 or 19.
SonicWall SMA 1000, CVE-2026-102255
A pre-authentication SSRF in the Work Place interface, rated CVSS 10.0. SMA 6210, 7210 and 8200v on 12.4.3-03526 and 12.5.0-02952 or earlier are affected. Fixed in 12.4.3-03670 and 12.5.0-03082, with no workaround. At disclosure SonicWall saw no exploitation. A later report claims it confirmed in-the-wild use, which I could not verify, so check the vendor advisory.
LiteLLM, CVE-2026-35029 and CVE-2026-59823
Check Point Research found two flaws in the LiteLLM AI gateway, fixed in 1.83.9. CVE-2026-35029 is an access-control bug that let low-privilege users, including read-only accounts, reach admin functions. CVE-2026-59823 is an SSRF that let users redirect the gateway’s outbound requests and capture AI provider API keys. One source rates the SSRF only CVSS 5.3, so the “critical” label is not uniform. A gateway holds the keys to every model provider behind it, so rotate those keys if you ran an exposed, unpatched instance.
LiteLLM 1.107.0 (no CVE)
A malicious release published on October 21 stole SSH keys, cloud credentials, CI/CD secrets and LLM provider keys. The malicious files could run whenever Python started on the host, even if LiteLLM was never imported. This is separate from the two CVEs above. The last safe version is 1.106.2. Search lockfiles, pip caches and container images for 1.107.0, rebuild from trusted sources, and rotate every credential the host could reach.
eMudhra: eight CA private keys compromised
A researcher reported that the private keys of eight eMudhra intermediate CA certificates were compromised: six for TLS and two for code signing. Mozilla received the report on October 17 and pushed a OneCRL block the same day. The keys may have been recoverable for about 17 months. No malicious use had been confirmed when this was written.
The CA incident has no CVE of its own, but the downstream fixes do:
Chrome and Firefox acted quickly, but anything with its own bundled trust store keeps trusting those intermediates until you update it. That means language runtimes, containers and embedded clients. One source claims eMudhra plans to leave the public TLS business. I could not corroborate that.
There was no single flagship kernel CVE this month, but three items matter on shared hosts, CI runners and container platforms.
Unit 42’s PHP2Shell report shows why these matter: attackers are already pairing a web-facing RCE with a kernel privilege-escalation bug.
October’s list is long, but the order of work is not hard to see. Edge devices that are exposed and already attacked come first, then the unauthenticated RCE bugs that have not been exploited yet, then the incidents that need credential rotation and trust-store updates rather than a patch. The PHP2Shell chain against PAN-OS shows how quickly a “patch next week” item turns into an intrusion.
Fixed versions are easy to list. The harder question is which of your internet-facing assets, build pipelines and dependencies are actually affected, and how fast you will know when that changes. Teams with a current inventory of their external attack surface can answer it the same day.
That is the problem ThreatMon is built for. Its threat intelligence platform helps security teams monitor their external attack surface, follow emerging vulnerabilities and active exploitation, and watch for leaked credentials and supply-chain risks, so a month like this one becomes a prioritized work list. To see how it fits your environment, visit threatmon.io.
More posts
Share this article
Found it interesting? Don’t hesitate to share it to wow your friends or colleagues
Subscribe to our blog newsletter to follow the latest posts
