This brief covers the trailing ~48 hours (October 23–25, 2026). Every item below was checked against its primary source — the CISA KEV catalog (via NVD’s KEV fields), CVE.org/NVD records, and vendor or project advisories — and only developments dated inside the window are included in the main section.

CISA KEV: Arista VeloCloud Orchestrator SQL injection (CVE-2026-114625) actively exploited, federal deadline October 26

CISA / Arista · October 23, 2026

CISA added CVE-2026-114625 to the Known Exploited Vulnerabilities catalog on October 23 with a three-day remediation deadline of October 26. The flaw is a SQL injection (CWE-89) in on-premises Arista VeloCloud Orchestrator (VCO) rated CVSS 3.1 9.9 / CVSS 4.0 9.4; an attacker with network access to the VCO web interface and any authenticated session (Enterprise Read Only is sufficient) can reach internal-only functionality and masquerade as a local “superuser operator.” Affected trains are VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, and 6.4.x before 6.4.2.12; fixed releases are available and Arista’s hosted and dedicated VCO instances were patched earlier. Arista’s advisory (SA-0199, published October 22) says the issue was detected internally and is under active exploitation, and publishes two attacker IPs, 74.82.197[.]86 and 38.54.50[.]151. This is the third VCO flaw to reach KEV since July 2026.

“This issue was detected by Arista and is known to be actively exploited.” — Arista Networks Security Advisory 0199

Source: Arista Security Advisory 0199 · NVD CVE-2026-114625 · CISA alert · The Hacker News

CISA KEV: Collabora Online Built-in CODE Server command injection (CVE-2026-110447) used to backdoor Nextcloud servers

CISA / CVE.org · October 23, 2026

Also added to KEV on October 23 (due October 26) is CVE-2026-110447, a CVSS 4.0 9.2 OS command injection (CWE-78) in the Collabora Online Built-in CODE Server Nextcloud app (richdocumentscode) before 26.4.303. The bug lives in proxy.php and is reachable by unauthenticated attackers when the bundled CODE server is not running, for example right after a restart; standalone Collabora Online deployments are not affected. The CVE record states the flaw was exploited in the wild in September and October 2026 and is distinct from the earlier CVE-2025-66208. Reported intrusions have planted web shells on Nextcloud hosts and gone after credential stores, password-manager artifacts and cryptocurrency wallets. The fix (26.4.303) shipped in September; administrators who cannot update should remove the app.

“Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026.” — CVE-2026-110447 record (MITRE)

Source: CVE.org CVE-2026-110447 · NVD · CISA alert · Security Affairs

PHP flags a third RCE vector (CVE-2026-115560) with no patch as PHP2Shell exploitation attempts reach the millions

PHP Project · October 23, 2026

Two days after shipping emergency fixes for the “PHP2Shell” pair (CVE-2026-109618 and CVE-2026-109619, both CVSS 4.0 9.2 per PHP, with NVD scoring CVE-2026-109618 at 9.8 under CVSS 3.1; fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35), the PHP project published an informational advisory for CVE-2026-115560, an additional, unpatched remote code execution vector it rates unlikely. It is reachable only when an application configures session.serialize_handler as php_binary or php_serialize, switches it to php at runtime via ini_set() before session_start(), and leaves session upload progress enabled. The fix will arrive in the next regular bugfix release; the mitigation is session.upload_progress.enabled=0, which was already recommended on October 21. Meanwhile exploitation of the original pair is widespread: Cloudflare reported millions of attempts within a day of disclosure, Cisco Talos and others see mostly scanning plus uncoordinated payload delivery including a Mirai-derived botnet, and Amazon Threat Intelligence says its honeypots first observed exploitation on October 17, four days before the patches. Neither PHP2Shell CVE carried CISA KEV fields in NVD as of October 24.

“We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector.” — PHP project, informational advisory

Source: PHP announcement (Oct 23) · PHP security advisory (Oct 21) · NVD CVE-2026-109618 · The Hacker News · BleepingComputer

LiteLLM traces its poisoned 1.107.0 release to a master key leaked in May and never revoked

LiteLLM · October 23, 2026

LiteLLM published the root-cause analysis of the October 21 supply-chain compromise that pushed a malicious litellm==1.107.0 to PyPI and poisoned Docker Hub and GHCR images (tags v1.107.0, latest, main-latest, main-stable) for roughly two hours before PyPI quarantined the release. The chain started on May 27, 2026, when a configuration file holding an internal Agent Platform master key was committed to a public repository and force-pushed over without the key being revoked. On October 10 the attacker used it to extract a GitHub CLI OAuth token tied to an organization owner, ran malicious workflows to harvest maintainer secrets, then on October 21 overrode branch protection and pointed the release pipeline at a lookalike “Berri-AI/litellm” repository. The payload executes on Python startup even if LiteLLM is never imported, exfiltrates credentials to litellm[.]dev, and installs an hourly backdoor on Unix hosts. LiteLLM is rotating every token tied to its internal and vendor systems; users who ran the affected artifacts should rebuild hosts rather than only remove the package, and rotate any credentials present.

“However, key revocation did not occur for the master key.” — Oliver Jensen and Mateo Wang, LiteLLM

Source: LiteLLM: The attack chain behind the v1.107.0 release · LiteLLM incident post · The Hacker News · BleepingComputer

Ruby 4.0.9, 3.4.12 and 3.3.13 fix the Onigmo regex bugs behind four critical GitLab RCEs, including CVSS 10.0 CVE-2026-110264

Ruby Project · October 23, 2026

The Ruby core team released 4.0.9, 3.4.12 and 3.3.13 to fix three regular-expression compilation bugs in the Onigmo engine that underlie GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. The newest, CVE-2026-110264 (CVSS 3.1 10.0, CWE-190 integer overflow), lets an unauthenticated attacker execute arbitrary code on a GitLab server via a crafted regular expression and affects every GitLab CE/EE release from 7.0 up to the October 21 patch releases (18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, 19.5.1). Ruby has not requested its own CVE IDs and notes that the exposure is not GitLab-specific: any application that compiles a regex from attacker-controlled text is affected, and Regexp.timeout offers no protection. Ruby 3.2 and earlier are end-of-life and will not be fixed. None of the four GitLab CVEs is in CISA KEV; GitLab has published detection rules for self-managed administrators.

“Regexp.timeout does not protect against these bugs.” — Ruby project announcement

Source: Ruby: Regexp compilation fixes · CVE.org CVE-2026-110264 · GitLab 19.5.1 patch release · The Hacker News

Brotli decoder overflow (CVE-2026-111497) behind the Node.js “Node2Shell” RCE spreads to Bun, Python, Envoy and Istio

Google / Node.js / NVD · October 24, 2026

The CVSS 4.0 9.2 out-of-bounds write in Google’s Brotli decoder (versions 1.0.3 through 1.2.0; fixed in 1.0.10, 1.1.1 and 1.2.1) that Node.js patched on October 21 (22.23.4, 24.22.1, 26.12.1) is now confirmed to reach far beyond Node. Downstream advisories published inside the window cover Bun (fixed in 1.4.4), the Python Brotli and brotlicffi packages (PYSEC-2026-4322/4323, fixed in 1.2.1 and 1.2.1.0), Envoy and Istio when Brotli decompression is enabled, Debian 13 (brotli 1.1.0-2+deb13u1) and the oss-security list. Imperva’s Red Team has demonstrated code execution against an unmodified Node.js 24.22.0 Linux arm64 build via both the request-body path (Express 5 / body-parser 2) and fetch() of a br response, though it has not released exploit code and the result is build-specific. NVD’s CISA SSVC assessment still records exploitation as “none” and the CVE is not in KEV. Where updating is not yet possible, reject Content-Encoding: br at the edge and disable automatic Brotli decoding in HTTP clients; in Python, uninstalling the packages removes the exposure.

“Imperva Red Team demonstrated remote code execution against the official vulnerable Node.js build.” — Ron Masas, Imperva

Source: Node.js October 2026 security releases · NVD CVE-2026-111497 · Google Brotli releases · Imperva: Node2Shell · The Hacker News

Still developing

HPE patches eight CVSS 10.0 unauthenticated RCE and auth-bypass flaws in Aruba AOS-8 and AOS-10

HPE · October 22, 2026

HPE’s advisory HPESBNW05162 fixes 72 ArubaOS vulnerabilities across mobility conductors, controllers, gateways and access points, eight of them rated CVSS 3.1 10.0: CVE-2026-79844, -79845, -79847 and -79851 (authentication bypass and unauthenticated buffer overflows leading to RCE in AOS-10, including the PAPI protocol) and CVE-2026-79846, -79848, -79849 and -79850 (unauthenticated command injection, SQL injection and auth bypass in AOS-8). CVE-2026-79844 affects AOS-10 10.8.0.0–10.8.1.1, 10.7.0.0–10.7.2.6 and 10.4.0.0–10.4.1.13. HPE says it is not aware of public exploit code or in-the-wild exploitation; none of the CVEs is in KEV. Interim guidance is to confine CLI and web management interfaces to a dedicated management VLAN behind layer-3 firewall policy.

“HPE Networking is not aware of any public discussion or exploit code that targets the listed vulnerabilities.” — HPE, as quoted by BleepingComputer

Source: HPE Security Bulletin HPESBNW05162 · CVE.org CVE-2026-79844 · BleepingComputer

Quest Diagnostics reports unauthorized access to Quanum LSM with patient records believed accessed

Quest Diagnostics (SEC Form 8-K) · October 22, 2026

Quest Diagnostics filed an 8-K (Item 8.01) disclosing that on October 21 it learned of unauthorized access to Quanum LSM, the platform clients use to order tests and view results, and that it believes an unauthorized party accessed certain patient records. Quest took the system offline and temporarily paused Essential Insights and LabHQ, directing customers to paper requisitions or Quanum eLabs. The scope and data types remain under investigation, no count of affected individuals has been given, and no threat group has claimed the intrusion. Quest says business operations and its ability to serve patients were not materially disrupted.

“…the Company believes that an unauthorized party accessed certain patient records.” — Quest Diagnostics, Form 8-K

Source: Quest Diagnostics Form 8-K · BleepingComputer

Kaspersky: APT41 “BlackX” UEFI bootkit revives BlackLotus to bypass Secure Boot on Windows hosts missing DBX revocations

Kaspersky GReAT · October 22, 2026

Kaspersky researchers Georgy Kucherin, Vladimir Nestor and Vasily Berdnikov describe BlackX, a UEFI bootkit used against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan in early 2026 and attributed with medium confidence to China-linked APT41. BlackX exploits the long-patched CVE-2022-21894 (“Baton Drop”, CVSS 4.4) to run before the OS on systems where administrators have not applied Microsoft’s manual Secure Boot revocations, installs Machine Owner Keys, loads a kernel driver signed with a since-revoked certificate to tamper with endpoint security, and deploys a RAT that uses Google Drive, OneDrive and Yandex.Disk for command and control. Kaspersky notes that the “Windows Production PCA 2011” certificate expired on October 19, 2026, yet still loads vulnerable binaries unless it is added to the DBX blocklist.

“Having examined it, we found it to be similar to BlackLotus.” — Kaspersky GReAT

Source: Kaspersky Securelist: BlackX · The Hacker News · BleepingComputer

This brief covers the trailing ~48 hours (October 23–25, 2026).

Primary sources: CISA KEV catalog · Arista SA-0199 · NVD CVE-2026-114625 · CVE-2026-110447 · PHP announcements · NVD CVE-2026-109618 · LiteLLM root-cause post · Ruby regexp fixes · CVE-2026-110264 · Node.js security releases · NVD CVE-2026-111497 · Imperva Node2Shell · HPE HPESBNW05162 · Quest Diagnostics 8-K · Kaspersky Securelist

This is a special follow-up to this morning’s brief, which went out while PHP’s emergency release was still pending. The patches shipped at 14:00 UTC on October 21, the GitHub advisories are now public, and the picture has moved quickly: exploitation attempts were being reported before the fix was even available. Everything below is drawn from the PHP project’s own advisory, the two GHSA entries, and the researchers who were first to confirm the bugs.

The short version

Two critical bugs in the PHP interpreter itself, not in any framework or application, allow unauthenticated remote code execution against essentially any PHP installation serving web requests. Both are rated CVSS v4.0 9.2 by PHP. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. There are no complete mitigations short of updating. Cloudflare reported early attack traffic at 07:43 UTC on October 21, roughly six hours before the patch, and watchTowr says it has observed in-the-wild exploitation attempts against both CVEs. If you run PHP anywhere that accepts HTTP requests, treat this as a patch-today event.

“Put simply: if you have not applied the patch, your deployment of PHP is vulnerable.” — watchTowr

How we got here: the timeline

October 20. A post on Hacker News claimed two critical PHP RCE flaws would be disclosed on October 22, ahead of any patch. The post was removed, but screenshots spread, along with screenshots of an exploit tool styled “PHP2Shell” that claimed to work against PHP 5.4.0 and later. watchTowr publicly confirmed the leaked details were real and under embargo. That evening the PHP security team published an advance notice of an out-of-cycle release for October 21 at 14:00 UTC, pulling disclosure forward by a day.

October 21, 07:43 UTC. Cloudflare CTO Dane Knecht said the company was seeing early attacks and updating mitigations as new vectors appeared.

October 21, ~14:00 UTC. PHP published its advisory and the four fixed releases, plus minimal source backports for the end-of-life 7.4, 8.0 and 8.1 branches. The UK NCSC issued an alert, and CISA published an alert titled “Critical Vulnerabilities in PHP Require Immediate Patching.”

October 21, 14:19 UTC. watchTowr published its technical write-up and reported exploitation attempts in the wild.

The two bugs

CVE-2026-109618, “RCE via OOM corruption” (GHSA-w8hw-w9fx-j79w). PHP handled out-of-memory conditions by calling longjmp() to abort the request. In some code paths, request memory is reachable before initialization has finished; an allocation failure at that moment leaves partially initialized data behind, and request shutdown then reads or branches on it. The failed allocation does not have to be related to the memory that ends up corrupted. The advisory’s primary trigger is multipart parsing: a request without a usable Content-Length can pass the initial post_max_size check, and a single part can carry an unbounded number of headers whose in-memory representation is far larger than the wire form. Empty file controls do not count toward max_file_uploads but still allocate metadata, and nested field names multiply the work. Full RCE over HTTP was demonstrated against Apache mod_php with default limits. PHP-FPM is assessed as susceptible from source analysis, though no complete exploit was demonstrated; FrankenPHP and LSAPI are considered likely susceptible but not validated. The fix removes the longjmp() OOM path entirely: a soft OOM is now raised at the next VM safe point, and a hard OOM calls _exit() past a higher threshold.

CVE-2026-109619, “RCE via stale global state” (GHSA-6wmf-4rv5-p3rp). In persistent worker models, PHP’s global state (error, session, object and extension state) can retain pointers into memory owned by a previous request. That state is supposed to be cleared before the request heap is freed, but a fatal error such as OOM or “Maximum execution time exceeded” can abort an operation before its reset runs, and nonfatal diagnostics emitted late in shutdown can repopulate error state after it was cleared. The next request on the same worker can then read, free or branch on a dangling pointer before normal initialization replaces it. Three confirmed consumers are described: INI diagnostics raised while applying per-request settings (reachable via .htaccess and php_value directives on mod_php, and conditionally on FPM if the frontend passes PHP_VALUE/PHP_ADMIN_VALUE); session upload progress handling, which runs before ordinary session initialization, is enabled by default and does not require session_start(); and, on PHP 8.5 only, the new fatal_error_backtraces feature, which is the confirmed RCE path on mod_php. Exploitation requires a producer request and a consumer request to land on the same worker plus a cooperative heap layout, which is why both CVEs carry AC:H and AT:P in their vectors.

Both advisories share the vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H and credit the same reporters: lcfr-hax, sagitzadik-wiz (Wiz), tomash-areion and amyb-oai. The remediation was developed by arnaud-lb, iluuu1994, bukka and ndossche.

“Updating to a PHP release containing the patch to this vulnerability is the only complete mitigation.” — php/php-src advisory GHSA-w8hw-w9fx-j79w

Who is affected

PHP’s advisory is blunt: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The project considers mod_php the highest-risk configuration because there is a demonstrated exploit where an unauthenticated request triggers the bug before any application code runs. Every version from PHP 5 onward is believed to be affected; only 8.2 through 8.5 receive official fixed releases. PHP 8.2 itself reaches end of life on December 31, 2026. For scale, Silas Cutler estimates over 1.3 million internet-exposed hosts are potentially vulnerable, a Shodan query by Henk Poley counts over 1.9 million hosts advertising PHP, and Mallory counted roughly 884,000 hosts whose banners show PHP 8.1 or older. These are banner counts, not confirmed vulnerable systems, but they illustrate the exposure.

“The PHP situation will lead to a mass of incidents – it’s one of the biggest vulns in years.” — Kevin Beaumont, via Help Net Security

Exploitation status

Before the patch, watchTowr and Huntress both said they had not seen exploitation. That changed on the morning of October 21: Cloudflare reported early attacks at 07:43 UTC, and SecurityWeek’s updated story notes firms observed exploitation attempts, some before the fixes landed. watchTowr’s post-patch write-up lists CVE-2026-109619 as exploited in the wild. Sansec, which tracks e-commerce attacks, said it expects mass exploitation now that both the patch and the write-ups are public, and noted that the circulating PHP2Shell tool combines both CVEs into a single unauthenticated attack. As of the reports I could verify, neither CVE had yet appeared in CISA’s KEV catalog, though CISA did publish a standalone alert; I was unable to load the alert page itself to confirm its contents.

“We expect mass exploitation now that the patch and the writeups are public.” — Sansec

Patches and where to get them

Upstream: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with source and Windows binaries on php.net. Linux distributions and LTS vendors received the patches in advance. Ubuntu has fixes for every supported release (php8.5 for 26.10 and 26.04, php8.3 8.3.6-0ubuntu0.24.04.13 for 24.04, php8.1 8.1.2-1ubuntu2.28 for 22.04) and ESM builds for 20.04 back to 14.04. AlmaLinux had patched packages in testing on October 21. The PHP team specifically warned that the volunteer-maintained rpms.remirepo.net would not have updates on release day and urged those users to switch to distribution packages or build from source. For anyone stuck on 7.4, 8.0 or 8.1 without a vendor, PHP published minimal source-only backport branches on GitHub (PHP-7.4-CVE-2026-109618-109619 and siblings). After updating, restart every worker; a patched binary on disk does nothing for a worker that is still running the old code.

If you cannot patch in the next hour

PHP’s advisory is explicit that the measures below reduce exposure to specific paths but do not make an installation safe. PHP 8.6 release manager Joe Ferguson put it more bluntly: “ini settings won’t save you.”

For CVE-2026-109618, set memory_limit=-1 in a way applications cannot override (for example php_admin_value in the FPM pool or Apache config) and confirm nothing re-imposes a finite limit. This removes the controllable memory-limit failure but not an underlying allocation failure. Set a low post_max_size (8M where uploads are not needed, 32M otherwise) and keep upload_max_filesize below it. Enforce limits at the web server or proxy for decoded request size, field count, multipart part count, header count and nesting depth, and make sure those limits apply to requests with no usable Content-Length. Use a container or cgroup limit as the availability boundary, and do not substitute RLIMIT_AS or RLIMIT_DATA, which themselves trigger the vulnerable path.

For CVE-2026-109619, set session.upload_progress.enabled=0 in php.ini or pool configuration (not via ini_set() or .user.ini) and restart every worker. On PHP 8.5, also set fatal_error_backtraces=0. Remove invalid or deprecated per-request INI settings that emit diagnostics before initialization; suppressing them with error_reporting, display_errors or @ does not help. Consider pm.max_requests=1 on FPM. Fix attacker-reachable fatal errors and execution timeouts.

Sansec adds two blunter options for sites that cannot patch at all right now: block multipart/form-data at the web server (breaks uploads and some checkout flows), or reject every method except GET and HEAD until the update lands. Cloudflare has WAF rules for the known vectors available on all plans including free, but both Cloudflare and Sansec stress that this only covers traffic that actually routes through the proxy, and that the attack executes inside PHP before any application-layer rule can see it.

What to do now

Inventory every host running PHP, including the ones nobody remembers: internal dashboards, admin panels, bundled appliances, Docker images built months ago. Update to a fixed release and restart workers; do not stop at the package upgrade. If you are on mod_php, move to the front of the queue. If you are on 8.1 or older, get a vendor backport, apply the PHP source backport, or take the system offline, which is what the NCSC has recommended for anything that cannot be fixed immediately. Then look backward: with attack traffic observed before 08:00 UTC on the 21st, any exposed PHP host that was unpatched through the day should be reviewed for signs of compromise, starting with unexpected processes spawned by the web server user, new files in writable directories, and outbound connections from the web tier.

This follow-up reflects primary sources available as of the evening of October 21, 2026 (UTC).

Primary sources:

• PHP.net security advisory: Critical remote code execution vulnerabilities, update now
• GHSA-w8hw-w9fx-j79w (CVE-2026-109618, RCE via OOM corruption)
• GHSA-6wmf-4rv5-p3rp (CVE-2026-109619, RCE via stale global state)
• PHP.net advance notice, October 20
• watchTowr: PHP Remote Code Execution (“PHP2Shell”)
• Sansec: PHP2Shell
• Ubuntu: php2shell fixes available
• AlmaLinux: patched packages in testing
• CISA alert: Critical Vulnerabilities in PHP Require Immediate Patching
• SecurityWeek · Tenable FAQ · Check Point · Help Net Security

This brief covers October 19–21, 2026. Items were checked against vendor advisories and primary sources; it is a quiet window, so the list is short.

PHP security team pre-announces an emergency release for two critical RCE flaws

PHP.net · October 20, 2026

PHP announced an upcoming security release, scheduled for Wednesday, October 21 at 14:00 UTC, addressing two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated CVSS v4.0 9.2 by PHP. Affected and fixed versions have not yet been published. Per BleepingComputer, details leaked ahead of the embargo, and watchTowr says it has not observed exploitation and is withholding technical details until patches ship. Neither flaw was reported as being in CISA’s KEV catalog at the time of reporting.

“We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.” — PHP security team

Source: PHP.net advisory · BleepingComputer

Siemens Software Center DLL flaw exploited in ClickFix malware attacks

Siemens ProductCERT · October 19, 2026

Siemens confirmed in-the-wild exploitation of CVE-2026-110936 (CVSS v4 8.4), a flaw in Siemens Software Center 3.5.8.7 where helper files were not validated before loading. Attackers paired a genuine, signed copy of the program with malicious DLLs to gain code execution, and Siemens ties the activity to the Romulus ClickFix delivery platform. The fix is version 4.0.9.8, and existing installs update automatically on next launch. The CVE is reported to be in CISA’s KEV catalog.

“Existing installations update automatically the next time they start.” — Siemens ProductCERT

Source: Siemens ProductCERT · SSA-580366 · SecurityWeek

Plex2Shell chain turns unpatched Plex Media Server into crypto miners

The Hacker News · October 19, 2026

Attackers are chaining four Plex Media Server flaws, CVE-2026-96652 (CVSS 5.3), CVE-2026-96654 (6.9), CVE-2026-96655 (5.3) and CVE-2026-96656 (8.6), for unauthenticated remote code execution, delivering an XMRig miner and a Linux proxy backdoor. The flaws were reported by Zach Main on July 27 and fixed in Plex Media Server 1.43.3.10861 (August 3); technical details were published October 16 and exploitation attempts followed a day later. The CVEs are reported to be in CISA’s KEV catalog.

“Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server” — The Hacker News

Source: The Hacker News · Plex release thread

Still developing

AOMEI Backupper update servers tampered with to deliver backdoor

ManageEngine Threat Analysis Lab · October 16, 2026 (BleepingComputer coverage October 19)

Attackers briefly altered AOMEI Backupper update and notification configuration on several dates between April and July 2026 (May 28, July 16 and July 20), delivering the CROSSROAD downloader and SHINYROAD backdoor. Google Threat Intelligence tracks the actor as UNC7017. AOMEI says it has classified the matter as high priority and upgraded its servers.

“A supply chain compromise via AOMEI Backupper abused a trusted delivery mechanism to deploy Radmin.” — ManageEngine Threat Analysis Lab

Source: ManageEngine · BleepingComputer

This brief covers the trailing ~48 hours (October 19–21, 2026).

Primary sources:

• PHP.net security announcement
• Siemens ProductCERT SSA-580366
• Plex Media Server release thread
• ManageEngine Threat Analysis Lab
• CISA KEV catalog

This brief covers the trailing ~48 hours (October 19–21, 2026). Items are drawn from primary sources (vendor advisories and CISA) and cross-checked against reputable outlets.

PHP Security Team gives advance notice of an emergency release for two critical flaws

PHP.net · October 20, 2026

The PHP security team announced a security release scheduled for Wednesday, October 21, 2026 at 14:00 UTC addressing two critical vulnerabilities, both rated CVSS v4.0 9.2. The identifiers are reported as CVE-2026-109618 and CVE-2026-109619 (remote code execution). PHP has not published affected or fixed versions ahead of the release; researchers at Sansec say the issues affect web servers running PHP 5.4 or later, and Tenable reports the team’s expected fixes land in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (unconfirmed until release). watchTowr told BleepingComputer the flaws are real and says it believes it reproduced CVE-2026-109618; Cloudflare’s CTO reported early attacks. Neither CVE was in CISA KEV at the time of research.

“We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.” — PHP security team, php.net

Source: PHP.net announcement · BleepingComputer · Sansec · Tenable

Siemens confirms active exploitation of Software Center DLL search-path flaw (CVE-2026-110936)

Siemens ProductCERT · Updated October 19, 2026

Siemens updated advisory SSA-580366 on October 19 for CVE-2026-110936, an uncontrolled search path (DLL loading) weakness in Siemens Software Center. All versions below V4.0.9.8 are affected; the advisory rates it CVSS v4.0 8.4 (v3.1 6.7) and the fix is V4.0.9.8 or later. SecurityWeek reports attackers paired a legitimate signed copy of Software Center with malicious DLLs delivered via ClickFix lures. The flaw was listed among six additions to CISA’s Known Exploited Vulnerabilities catalog on October 20.

“No Siemens system, product or update channel was breached to our knowledge.” — Siemens, as quoted by SecurityWeek

Source: Siemens SSA-580366 · SecurityWeek

CISA adds six vulnerabilities to the KEV catalog, including Plex Media Server and SiteGuard

CISA · October 20, 2026

CISA published an alert on October 20 adding six vulnerabilities to the Known Exploited Vulnerabilities catalog. Per WindowsForum’s summary of the alert, the entries are four Plex Media Server flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656; SSRF, URI handling and path-control weaknesses), an OS command injection in EG Secure Solutions SiteGuard Server Edition (CVE-2026-106931, vendor-scored CVSS 4.0 8.5), and the Siemens Software Center bug above. CISA’s alert does not give affected version ranges or per-CVE exploitation details, so check the catalog and vendor advisories for remediation guidance and due dates.

Source: CISA alert · WindowsForum summary

This brief covers the trailing ~48 hours (October 19–21, 2026).

Primary sources: PHP.net · Siemens ProductCERT SSA-580366 · CISA KEV alert

This brief covers October 17–19, 2026. It is a quieter window, and items are drawn from vendor and researcher primary sources, with outlet reporting linked alongside.

ConnectWise disables application identities after Microsoft 365 tenants compromised

ConnectWise · October 17, 2026

Unknown actors obtained unauthorized access to ConnectWise application identities and used them to sign in to customer Microsoft 365 tenants. ConnectWise says it first identified the issue on October 14, disabled seven application identities at 07:00 UTC on October 17, suspended Cloud Backup by revoking certificates, and took SaaS Security and Cloud Management offline. Huntress observed sign-in activity from the associated IP address against almost 1,000 Entra tenants, about 300 of them successful. Disabling the connections blocks new authentication but does not undo changes already made inside a tenant. No CVE has been assigned, and ConnectWise says it is not yet clear whether a product vulnerability contributed.

“Since implementing these mitigations, we have not observed successful threat activity in the environments we monitor.”
— ConnectWise advisory update, as quoted by The Hacker News

Source: The Hacker News · BleepingComputer · ConnectWise status page

OpenCode Console breach may have exposed customers’ OpenAI, Anthropic and Google API keys

OpenCode · October 17, 2026

An intruder reached a legacy system in OpenCode’s hosted Console, where workspaces store their own third-party provider keys. OpenCode emailed affected users on October 17; it says keys “may have been exposed” for about 1.4% of Console users and has not confirmed any were copied. Keys stored locally by the CLI and desktop apps are reportedly not affected. Some users report unauthorized provider charges, but those are individual claims. No CVE applies. Anyone with a provider key saved in the Console should rotate it. Vendor wording is as relayed by The Hacker News; the original X posts were not independently retrieved.

“Action Required: Potential provider key breach.”
— OpenCode notification email subject, as reported by The Hacker News

Source: The Hacker News · OpenCode on X

Still developing

SiteGuard Server Edition WAF command injection exploited in the wild (CVE-2026-106931)

JPCERT/CC (JVN) · October 14, 2026 · widely reported October 18

OS command injection (CWE-78) in SiteGuard Server Edition 2.20 and later, when the statistics function is enabled (the default). JVN scores it CVSS v4.0 8.5 and v3.0 7.8 and states exploitation in the wild has been confirmed; successful abuse runs commands as root or SYSTEM. Fixed in 8.00 Update 5 (Apache, Nginx, IIS) and 7.00 Update 6 (FreeBSD), with a file-replacement patch for versions that cannot be upgraded. The vendor advises downloading diagnostic information before patching, since remediation can erase attack traces. No KEV entry was confirmed in the sources reviewed.

“Abuse has already been confirmed.”
— SiteGuard vendor alert, as quoted by BleepingComputer

Source: JVN · SiteGuard alert · BleepingComputer

Drupal core and Entity List RCE flaws patched; exploits expected soon (CVE-2026-108097, CVE-2026-108099)

Drupal Security Team · October 14, 2026 · reported October 17

SA-CORE-2026-014 (CVE-2026-108097) is rated “Critical 19/25” by Drupal and affects core 8.9.0 through releases before 10.6.19, 11.3.19 and 11.4.10, plus Drupal 12 pre-releases before beta2. Drupal says core alone is not directly exploitable but serious exploit paths exist through contributed modules, one requiring no authentication. A companion Entity List module flaw, CVE-2026-108099, is fixed in 3.0.10. Drupal publishes no CVSS score for the core flaw, and no in-the-wild exploitation has been confirmed. Uninstalling the Field UI module is the stopgap if you cannot upgrade.

“At least one known exploit path does not require authentication.”
— Drupal SA-CORE-2026-014

Source: Drupal SA-CORE-2026-014 · SA-CONTRIB-2026-218 · BleepingComputer

Unpatched Broadcom WPS flaw allows root code execution from Wi-Fi range

Quentin Kaiser · October 16, 2026 · reported October 19

A long-standing bug in Broadcom’s proprietary WPS implementation lets an unauthenticated attacker in radio range leak memory and execute code without the network key. Affected chips include BCM3380, BCM3383 and BCM33834 (eCos) and BCM3390, BCM65xx and BCM68xx (Linux). Broadcom would not assign a CVE, none of the devices the researcher tested were patched, and no real-world exploitation has been reported. Replacement of unpatched hardware is the practical mitigation.

“Yet they refused to assign a CVE to this vulnerability or to communicate publicly about it”
— Quentin Kaiser

Source: Quentin Kaiser · The Hacker News

This brief covers the trailing ~48 hours (October 17–19, 2026).

Primary sources:

• JVN (JPCERT/CC) JVN88474777
• SiteGuard vendor alert
• Drupal SA-CORE-2026-014
• Drupal SA-CONTRIB-2026-218
• ConnectWise status page
• Quentin Kaiser research post