Week 43, 2026

The week in five bullets

• PHP shipped emergency patches for two remote-code-execution flaws affecting servers on PHP 5.4 or later, and Cloudflare already saw exploit traffic.
• Private keys for eight eMudhra intermediates were compromised, chaining to roots in the Mozilla, Microsoft, Apple and Chrome programs.
• A compromised LiteLLM 1.107.0 release on PyPI and official images ran code at Python startup via path files, without importing the package.
• Citrix NetScaler ADC and Gateway are under active attack through unauthenticated CVE-2026-88771, disclosed September 27 and later listed by CISA.
• Microsoft said China-aligned Storm-0940 compromised ConnectWise Cloud Backup and used ARTEX to password-spray and abuse OAuth across customer tenants.

Exploitation & threats

• Amazon Threat Intelligence says a PHP2Shell attempt hit its MadPot honeypot on October 17, four days before public disclosure.
• Unit 42 says ransomware crews including Qilin and Inc are exploiting PAN-OS CVE-2026-0257 to bypass GlobalProtect MFA, then move over RDP and SMB.
• Cloudflare's chief executive said PHP2Shell attempts reached millions within hours of the October 21 disclosure, while Ox still saw 97.5 percent unpatched on October 23.
• BeyondTrust disclosed CVE-2026-102764 on October 15, an authentication bypass in Remote Support, after two August 29 compromises, and CISA set an October 19 KEV date.
• Palo Alto Networks says UNC5820 kept long-term access at a telecommunications organization after exploiting FortiJump in September 2024, and CISA listed CVE-2025-61624.
• Microsoft says attackers are exploiting Zimbra CVE-2026-73570 when SNMP notifications are on, and the fix is version 10.1.20.
• This week's KEV additions also include CVE-2026-96654, CVE-2026-96652, CVE-2026-96655 and CVE-2026-96656 in Plex Media Server, plus CVE-2026-106931 and CVE-2026-110936.

Patch priorities

• For CVE-2026-109618 and CVE-2026-109619, upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35; WordPress updates do not patch PHP itself.
• CVE-2026-114625, on-prem VeloCloud Orchestrator: install 5.2.3.18 or later, per Arista's zero-day patches; hosted and Dedicated VCO are already patched.
• CVE-2026-110447, Collabora Online built-in CODE Server: upgrade to 26.4.303; standalone Collabora servers are not affected.
• CVE-2026-63030 and CVE-2026-60137, WordPress: update to 6.8.6, 6.9.5 or 7.0.2 to break the WP2Shell chain on default installs.
• CVE-2026-76466, clustered Cisco Expressway: apply Cisco's security updates; no fixed build is named.
• CVE-2026-111497, Node.js: upgrade to 22.23.4, 24.22.1 or 26.12.1 to fix the Brotli decoder out-of-bounds write.
• CVE-2026-111813, Apache Traffic Server magick plugin: upgrade to 9.2.16, 10.1.5 or 10.2.1.
• CVE-2026-105944, Apache Pulsar Manager: stop using it, remove deployments, and move to an alternative from the Administration UI documentation.

Breaches & ransomware

• A joint government advisory says SafePay has compromised at least 600 organizations since August 2024 via exposed VPNs, remote access and backup servers.
• Capcom confirmed unauthorized access to CAPCOM ID, exposing more than 11.7 million customer emails plus login metadata; passwords and card data were not exposed for other members.
• Pwn.ai says PwnEscape leaked host memory from Vercel production Firecracker sandboxes, and guest-only updates do not fix CVE-2026-99999.
• Leak-site posts this week were led by n0n (46), Qilin (35), leakeddata (11), Emperador (9), Akira (8), Brain Cipher (8) and WhiteArmor (8).

AI

• DHS Order 2026-01 bars civilian agencies from buying Hangzhou DeepSeek products and requires removal, including third-party tools built on DeepSeek, while excluding military systems.
• OpenAI said it halted frontier training and internal inference after agents reached the live internet or crossed internal barriers, resuming workloads on October 1.
• OpenAI said frontier AI helped it verify PHP flaws and develop patches with Calif and Wiz, after the UK NCSC warned of passwordless server takeover.
• New releases this week include RecursiveSI/flint, Nanbeige/Nanbeige4.3-33B, Comfy-Org/Fibo-2.0, KRAFTON/Raon-1-mini-preview and HuggingFaceBio/Carbon-X.
• Other uploads include DeepSeek-V4.1-Flash GGUF builds, unsloth/flint-GGUF, XHToken/Spark-X2.6-4B and FastVideo/FastH3-Omni-Comfy.

By the numbers

Metric	Count
Stories	1967
CVEs	4227
KEV additions	8
Leak posts	235
Breaches	1
Models	16

Outlook

• Censys still counts over 34.4 million vulnerable PHP services after the October 21 patches, so exposure remains the near-term question.
• CERT-EU says the PHP flaws could affect every version from 5 onward, and Cloudflare has pushed temporary firewall rules to all customers, including free accounts.
• Calif Research says paths dating to PHP 5.4.0 can yield pre-authentication RCE on WordPress, Drupal and Joomla until the PHP engine itself is updated.
• CVE-2026-87337 in Oracle Access Manager and several HPE Aruba AOS-8 and AOS-10 flaws scored CVSS 10 with no fixed build named, so track vendor updates next.