Mon, 26 Oct 2026
← VoltarMultiple critical remote code execution vulnerabilities are actively exploited, causing widespread risk across various platforms. Attackers leverage leaked keys and software supply-chain attacks, escalating threats significantly.
This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent patches than they can keep up with.
And that's not even the full story. A leaked key led to a software supply-chain attack. AI agents are being tricked into following harmful instructions. Old bugs are still being used to break into systems, and some attacks are so simple it's hard to believe they still work.
Some websites even went offline to avoid taking chances. It's been a rough week for anyone trying to keep systems safe. Here's what happened. PHP2Shell Flaws Puts Organizations on Alert — The PHP Foundation released patches for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, that could lead to unauthenticated remote code execution.
The security flaws have been codenamed PHP2Shell. Since public disclosure, the shortcomings have witnessed widespread scanning efforts, with Cloudflare stating it detected millions of exploitation attempts after public disclosure. To date, no successful exploitation has been observed. The severity of the flaws, coupled with the ubiquity of PHP on the web, prompted several websites to go offline as a precautionary measure.
How CTEM prioritization and validation stages align with four elements of strong exposure prioritization, from threat intelligence to security control validation, and the question each one answers. Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild. Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-109618, CVE-2026-109619, CVE-2026-115560 (PHP), CVE-2026-97406 (Xerj Console API), CVE-2026-75754 (ASUS Control Center), CVE-2026-76299, CVE-2026-76302, CVE-2026-76531, CVE-2026-76407 (Splunk), CVE-2026-28328 (SolarWinds Observability), CVE-2026-20043, CVE-2026-20236, CVE-2026-20291, CVE-2026-20356, CVE-2026-76466, CVE-2026-76473, CVE-2026-76474, CVE-2026-76475, CVE-2026-76476, CVE-2026-76477, CVE-2026-76478, CVE-2026-76479, CVE-2026-76481 (Cisco), CVE-2026-91403 (Oracle), CVE-2026-82814 (Duplicator and Duplicator Pro WordPress plugins), CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280, CVE-2026-113271, CVE-2026-113303 (Google Chrome), CVE-2026-110264 (GitLab), CVE-2026-77934 (Coze Studio), CVE-2026-77933, CVE-2026-77932 (DB-GPT), CVE-2026-77936, CVE-2026-77937 (Letta), CVE-2026-77930 (EvoScientist), CVE-2026-109443 (JoySafeter), CVE-2026-77926 (Aix-DB ChatBI), CVE-2026-75128 (Langchain-Chatchat), CVE-2026-109442 (piflow), CVE-2026-109444 (OpenSRE), CVE-2026-109440 (LangAlpha), CVE-2026-109437 (Cognition), CVE-2026-108263 (Astron Agent), CVE-2026-77521 (MaxKB), CVE-2026-97693 (Yuxi), CVE-2026-104085 (odt2spip), CVE-2026-49950 (Xorbits Xoscar), CVE-2026-113380 (Signal), CVE-2026-114625 (Arista VeloCloud Orchestrator), CVE-2026-111497 aka Node2Shell (Brotli), CVE-2026-112900, CVE-2026-112403, CVE-2026-112393 (Pillow), CVE-2026-77185 (Atlassian Fisheye and Crucible), CVE-2026-65182, CVE-2026-65637, CVE-2026-65905, CVE-2026-68525 (Atlassian Crowd Data Center and Confluence Data Center), CVE-2026-58062 (Atlassian Jira Service Management Data Center), CVE-2026-75595 (Atlassian Bamboo Data Center), CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264 (Ruby), from CVE-2026-79844 through CVE-2026-79895, CVE-2026-79955, CVE-2026-79956, and from CVE-2026-95704 through CVE-2026-95721 (HPE Networking Wireless Operating Systems).
If this week wasn't enough of a warning, nothing will be. Critical RCE bugs are piling up, attackers are already exploiting some of them, and millions of attempts are hitting newly disclosed flaws. Even widely trusted software and tools are becoming attack surfaces. The scar y part?
Some bugs don't even need a login, and some still have no fix available. The lesson is simple: don't wait for proof of an attack before taking action. Check what's exposed, patch what you can, lock down what you can't, and treat leaked keys as urgent. Not every scanning attempt leads to a breach, but attackers only need one working path.
With so many doors being tested at once, this is a bad week to leave even one wide open. Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Get the latest news, expert insights, exclusive resources, and strategies from industry leaders, all for free.