Cyber Threat Brief — October 21 2026
⚠️ This report is AI-generated. Always validate findings.
1. PHP2Shell-CVE-2026-109618 — leaked critical PHP RCEs
TL;DR: PHP published emergency fixes for CVE-2026-109618 and CVE-2026-109619 on 21 October. Update every web PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restart the workers. Cloudflare reports early attack traffic; Huntress still has no partner compromise as of its 10:00 ET update. Not in CISA KEV.
What’s New:
- The PHP security advisory and GHSA-w8hw-w9fx-j79w / GHSA-6wmf-4rv5-p3rp (published about 13:34 UTC) confirm both flaws as CVSS v4.0 9.2 unauthenticated RCEs. Fixed builds: 8.5.12, 8.4.27, 8.3.36, 8.2.35. Source and Windows binaries are on php.net/downloads.
- PHP names the classes: CVE-2026-109618 is RCE via OOM corruption; CVE-2026-109619 is RCE via stale global state. Confirmed paths for 109619 include
session.upload_progress(On by default since 5.4.0) and, on PHP 8.5,fatal_error_backtraces. Risk is highest for mod_php, where an unauthenticated request can trigger before any application code. Session-lifecycle RCE for 109619 was also validated on PHP-FPM. php-cgi, FrankenPHP, and LiteSpeed are in scope. Updating application code alone does not fix this. Wiz’s early table maps the upload-progress path to CVE-2026-109618; PHP’s advisories put that path under CVE-2026-109619. This brief follows PHP. One update covers both CVEs. - Cloudflare reports attack traffic aimed at its customers, and its rules have been live since 03:02 UTC. Huntress still has no partner compromise as of its 10:00 ET update. Imperva saw no matching patterns in pre-disclosure monitoring. Neither CVE is in CISA KEV. Treat as early attack attempts, not confirmed mass compromise.
- Ubuntu USN-8948-1 (13:56 UTC) and Debian DSA-6574-1 (php8.4 8.4.27-1~deb13u1 on trixie) are out. On Ubuntu, check the package revision, because
php -vkeeps the old minor version. - VirusTotal counts about 272,000 hosts on supported 8.2–8.5 branches and about 758,000 on end-of-life 5.4–8.1 branches among servers that disclose a version.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| CVE-2026-109618 | Fixed PHP core bug (RCE via OOM corruption) | T1190 | Package inventory / PHP php -v | Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart every PHP worker. See GHSA-w8hw-w9fx-j79w. |
| CVE-2026-109619 | Fixed PHP core bug (RCE via stale global state) | T1190 | Package inventory / PHP php -v | Same fixed builds as CVE-2026-109618. See GHSA-6wmf-4rv5-p3rp. |
| PHP 8.5.12 | Fixed build | T1190 | Package inventory | For every host on PHP 8.5, install 8.5.12 or later. 8.5.11 is not the fix. |
| PHP 8.4.27 | Fixed build | T1190 | Package inventory | For every host on PHP 8.4, install 8.4.27 or later. 8.4.26 is not the fix. |
| PHP 8.3.36 | Fixed build | T1190 | Package inventory | For every host on PHP 8.3, install 8.3.36 or later. 8.3.35 is not the fix. |
| PHP 8.2.35 | Fixed build | T1190 | Package inventory | For every host on PHP 8.2, install 8.2.35 or later. 8.2.34 is not the fix. |
| PHP 5.4 through 8.1 | End-of-life branches | T1190 | Package inventory | PHP 5.4 through 8.1 no longer receive upstream security releases. Take those sites off the internet or put them behind a VPN, or install a distribution backport when your vendor ships one. Ubuntu USN-8948-1 backports to jammy php8.1. Prefer a supported branch when you can. |
| Ubuntu USN-8948-1 / Debian DSA-6574-1 | Distro patch | T1190 | apt / package inventory | Install Ubuntu USN-8948-1 or Debian DSA-6574-1 (php8.4 8.4.27-1~deb13u1 on trixie), then restart PHP-FPM or Apache. On Ubuntu, confirm the package changelog names CVE-2026-109618 / 109619. |
memory_limit = -1 (admin) | Partial stopgap for CVE-2026-109618 | N/A | php.ini / FPM php_admin_value / Apache php_admin_value | Set administratively so apps cannot override, then restart every worker. Removes the controllable PHP memory-limit OOM path. Not complete; an underlying allocation failure can still hit the bug. Do not use RLIMIT_AS or RLIMIT_DATA. After you patch, put a real memory_limit back. |
session.upload_progress.enabled = 0 | Partial stopgap for CVE-2026-109619 | N/A | php.ini / FPM pool / Apache config | Set before request parsing (not via ini_set or .user.ini), restart every worker. Blocks confirmed session paths only. Keep after patch unless the app needs upload-progress bars. |
fatal_error_backtraces = 0 (PHP 8.5) | Partial stopgap for CVE-2026-109619 | N/A | php.ini / FPM pool | On PHP 8.5 only: disable and restart workers. Blocks the confirmed fatal-backtrace producer, not other state families. |
Low post_max_size | Partial stopgap for CVE-2026-109618 | N/A | php.ini + reverse proxy | Prefer 8M without uploads, 32M with uploads; keep upload_max_filesize below it. Enforce decoded size, part, header, and nesting limits at the proxy, including requests without usable Content-Length. |
| Remi PHP packages | Package source gap | T1190 | Package inventory | rpms.remirepo.net will not ship the fix on 21 October. Move to distro PHP or build from source. |
| PHP 7.4 / 8.0 / 8.1 source backports | EOL source patch | T1190 | Source build inventory | PHP published minimal source backports for 7.4, 8.0 and 8.1 for people building from source without an LTS vendor. Prefer a supported branch when you can. |
Allowed memory size of … exhausted … in Unknown on line 0 | Log artifact | T1190 | Apache/nginx/php-fpm error log | Alert on memory-limit fatals with in Unknown on line 0 (startup phase). Pair with a preceding multipart POST. CrowdStrike’s Falcon Next-Gen SIEM has a detection for this pattern. |
PHP_SESSION_UPLOAD_PROGRESS in multipart body | Request pattern | T1190 | Access / WAF body log / Zeek | Hunt multipart POSTs that carry this field (default upload-progress name). High volume or odd pairing with huge filenames or many empty file parts is worth a ticket. |
Oversized or garbage PHPSESSID Set-Cookie | Response artifact | T1190 | Access / proxy response headers | Unexpectedly large or non-hex PHPSESSID cookies after multipart traffic can indicate the memory-disclosure path. |
ParentImage php-fpm | Child-process hunt | T1059 | Linux EDR / auditd process events | Alert when a process whose name starts with php-fpm spawns sh, bash, python, perl, curl, wget, or nc. |
ParentImage httpd | Child-process hunt | T1059 | Linux EDR / auditd process events | Alert when httpd spawns sh, bash, curl, or wget. On many Apache installs the PHP child is httpd, not php-fpm. |
ParentImage w3wp.exe | Child-process hunt | T1059 | Windows Sysmon Event ID 1 | Alert when w3wp.exe spawns cmd.exe, powershell.exe, pwsh.exe, or php-cgi.exe with a command line you did not schedule. |
ParentImage php-cgi.exe | Child-process hunt | T1059 | Windows Sysmon Event ID 1 | Alert when php-cgi.exe or php.exe spawns cmd.exe, powershell.exe, or certutil.exe. |
Cloudflare Managed Ruleset rule Generic Rules - Anomalous Execution | Edge control | N/A | Cloudflare WAF event log | Confirm the 2026-10-21 emergency Managed Ruleset rules are on: c1d409ad838f47f59446f21cc438d5dd, f9a45927414245e3a64bb12d0a0c2f64, 771c654ae1154d4daa72f4e1545d163c, 217005865f0145f392300bac212afcc9, 38efdb17ea594501bb55a1d71867b12e, 4148ae686fdb4d01be673fab9d9c073d, and 1389aa259617437392ce149c48143645. Also confirm Managed Response Firewall rule afffe22785674c80a31875c848d2242a. Check each one’s action in your dashboard. See the Cloudflare php2shell blog. |
Cloudflare Free Ruleset rule Generic Rules - Anomalous Execution | Edge control | N/A | Cloudflare WAF event log | On Free plans, confirm 4e315666e8e344cdb64119a3b5ccf32f, 00c10e6cc4da4bd08722adeebcd95984, 48ddf592361e4fdb97a8a85982dab691, 3556683d512a47f2937899c524b1a4c6, da07c85852e34625bb478496302ede46, 19373a83abb840e18ab3ce5a7975ce1b, and 07f0b6ddaabf40b1b2042dade8d613fa. Block direct-to-origin traffic, or the rules never see the request. |
| Corelight Suricata sid:3000650 | Network detection | T1190 | Suricata | Deploy https://github.com/corelight/php2shell-detect suricata/php2shell.rules. sid:3000650 flags POST bodies with PHP_SESSION_UPLOAD_PROGRESS. |
| Corelight Suricata sid:3000651 | Network detection | T1190 | Suricata | Same ruleset. sid:3000651 flags a potentially affected PHP version in HTTP response headers. |
| Corelight Suricata sid:3000652 | Network detection | T1190 | Suricata | Same ruleset. sid:3000652 flags phpinfo body content advertising a potentially affected PHP version. |
| Corelight Zeek / Akamai ASE 3000991 / PAN-OS TP 543004 | Network and edge detection | T1190 | Zeek notice.log / Akamai / PAN-OS threat log | Install the Corelight Zeek php2shell package from the same repo. Confirm Akamai Adaptive Security Engine rule 3000991 and PAN-OS Threat Prevention signature 543004 (ATP+ since 2026-10-20). |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — Web or Application Server Spawning a Shell | Linux parents are httpd, apache2, nginx, and a few app servers. php-fpm is not in that list. Windows parents include php*.exe, php-cgi.exe, httpd.exe, and w3wp.exe when the child is a shell macro match. |
| Elastic | Partial — Suspicious Child Execution via Web Server | Linux only. Parent can be php-fpm*, httpd, or apache2, and the child must be a named tool such as curl or whoami, or an executable under /tmp or /home. Suspicious Command Execution via Web Server is the shell case: parent php-fpm* and child bash or sh with -c and a suspicious argument. A quiet shell command line misses both. |
| Sigma | Partial — Suspicious Process By Web Server Process | Windows only. Parent php-cgi.exe, php.exe, httpd.exe, or w3wp.exe spawning cmd.exe, powershell.exe, or bash.exe. No Linux php-fpm rule names this CVE. |
| Suricata (Corelight) | Present — sid:3000650–3000652 | Open-source in corelight/php2shell-detect. Body inspection is required. Not in ET Open as of 2026-10-20 20:31 GMT. |
| Nuclei | Pending — PR #17473 open | Not merged; do not treat as coverage. |
Detection index: ESCU 678e76c (2026-10-21) · elastic detection-rules fb7f864 (2026-10-21) · SigmaHQ 05d1031 (2026-10-21) · corelight/php2shell-detect 4d5131c (2026-10-21).
Hunt hint: Run php -v on web servers, control panels, and any appliance that ships php.exe or php-cgi.exe. Search the effective config for session.upload_progress.enabled and assume it is On when the line is absent. After the release, confirm the installed build is 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (or your distro’s backport package revision) before you close the change ticket. Preserve access logs and the PHP-FPM pool log if a worker starts a shell. Also hunt error logs for in Unknown on line 0 memory fatals, multipart bodies containing PHP_SESSION_UPLOAD_PROGRESS, and oversized PHPSESSID cookies. Do not pull php2shell repositories. Several circulating GitHub copies are of unknown provenance.
Sources: PHP advisory · GHSA-w8hw-w9fx-j79w · GHSA-6wmf-4rv5-p3rp · php2shell.com · Wiz · Calif · Huntress · Cloudflare · Corelight · VirusTotal · NCSC UK · watchTowr
2. Plex2Shell-CVE-2026-96652 — Plex Media Server RCE chain
TL;DR: CISA added four Plex Media Server bugs to KEV on 20 October. CVE-2026-96654 and CVE-2026-96656 are due 2026-10-23. Update to 1.43.3.10861 or later, then treat any older internet-facing server as one that may already be running a miner or a proxy.
What’s New:
- KEV catalog 2026.10.20 lists CVE-2026-96652 and CVE-2026-96655 due 2026-11-03, and CVE-2026-96654 and CVE-2026-96656 due 2026-10-23. All four were added 2026-10-20. Ransomware use is Unknown.
- Zach Main’s write-up shows an unauthenticated request to
/player/timelinewith anyX-Plex-Tokenvalue. The server calls itself, a loopback plugin call leaks the owner token, andTranscoderH264Options=dump-yuvwrites a.sointo the Codecs directory that the next transcode loads. - Censys quotes Plex’s 19 October notice: compromised servers have been used for miners and proxy software. A honeypot saw the chain on 17 October, including a proxy whose banner says “external use of your internet traffic”. Build 1.43.3.10828 is still vulnerable. The honeypot page itself returned HTTP 429 at drafting time, so file hashes from that write-up are not in this brief.
- The Censys advisory counts about 324,000 Plex Media Server hosts and about 30 percent on a vulnerable build. Under 2 percent of still-vulnerable hosts moved in the three days after the exploit write-up. The Censys post the same day said about 340,000. Linux, NAS, and Docker installs need a manual update. Windows and macOS can auto-update when that setting is on.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Plex Media Server before 1.43.3.10861 | Vulnerable build | T1190 | Plex Settings → General / package inventory | Any build before 1.43.3.10861 is vulnerable, including 1.43.3.10828. If that server was reachable from the internet, assume compromise and rebuild rather than only upgrading. |
| Plex Media Server 1.43.3.10861 | Fixed build | T1190 | Plex Settings → General | Install 1.43.3.10861 or later. Windows and macOS can auto-update. Linux, NAS, and Docker need a manual package. Upgrading does not delete a .so already in Codecs. |
| CVE-2026-96652 | KEV SSRF | T1190 | Plex or reverse-proxy access log | Due 2026-11-03. Search for /player/timeline where the protocol parameter contains http://127.0.0.1 and X-Plex-Token is present. |
| CVE-2026-96654 | KEV loopback pivot | T1190 | Plex access log | Due 2026-10-23. Search for /system/agents/ and searchOne with identifier containing GetResultFromNetwork. |
| CVE-2026-96655 | KEV token leak | T1190 | Plex access log / proxy | Due 2026-11-03. Search outbound requests from the Plex host to a hostname that starts with 127.0.0.1. and ends in sslip.io. |
| CVE-2026-96656 | KEV codec write | T1190 | Plex Preferences.xml / file integrity | Due 2026-10-23. Open Preferences.xml and look for TranscoderH264Options containing dump-yuv. Delete unfamiliar .so and .dll files in the Codecs directory. |
TranscoderH264Options | Preference abuse | T1574.006 | Preferences.xml | If TranscoderH264Options contains dump-yuv, clear it, remove the file it names under Codecs, and sign the Plex account out of every device. |
Process myawesomeproxy | Proxy payload | T1090 | Linux process list / EDR | Alert when the Plex service account runs myawesomeproxy. Plex names that process on compromised servers. |
Process mylovelyminer | Miner payload | T1496 | Linux process list / EDR | Alert when the Plex service account runs mylovelyminer. Plex names that process beside the proxy. High CPU while nothing is playing is the host symptom. |
Process x12345 | Unexpected child | T1059 | Linux process list / EDR | Alert when the Plex service account runs a process named x12345. Plex lists that name with the other unexpected children. |
Domain proxystream.st | Proxy callback | T1090 | DNS | Alert on DNS lookups for proxystream.st. Plex says compromised servers connect there. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No rule names Plex, TranscoderH264Options, or myawesomeproxy. Miner stories key on other behaviors, not this parent process. |
| Elastic | None — verified | No rule names Plex Media Server or myawesomeproxy. Web-server child rules do not treat the Plex binary as a web server parent. |
| Sigma | None — verified | Linux Crypto Mining Indicators matches command lines such as stratum+tcp:// and --donate-level=0. A process name alone does not match. No rule names proxystream.st, myawesomeproxy, or Plex. |
Hunt hint: Read the version in Plex Web under Settings, General. If it is below 1.43.3.10861 and TCP 32400 was forwarded, empty the Codecs directory, check Preferences.xml for dump-yuv, and change the Plex password. Then look at process trees for the Plex user. Turn off Remote Access when you do not need it.
Sources: Plex forum · zmain · Censys · Censys on X · CISA KEV
3. Siemens-Software-Center-CVE-2026-110936 — signed binary DLL sideload
TL;DR: CISA added CVE-2026-110936 to KEV on 20 October, due 2026-11-03. Update Siemens Software Center to 4.0.9.8 or later, and hunt for SiemensSoftwareCenter.exe under AppData\Local\Programs when msiexec started it. Patching a normal install does not remove a copy the attacker brought along.
What’s New:
- Siemens ProductCERT says it validated attacks against version 3.5.8.7, which loaded helper DLLs from its own folder. The fix is 4.0.9.8 in SSA-580366. Existing installs update the next time they start. Siemens says its update channel was not breached.
- The bundle is a genuine signed
SiemensSoftwareCenter.exeplus attacker files. Block96.62.218.59andwizardexpensive.com.2.27.248.127no longer servesAllMyBasic.msi, and hosts that already downloaded it can still be infected. - Siemens attributes the bundle to ROMULUS. Forescout (15 October) lists
2.27.248.127as a ROMULUS panel host and does not name Siemens Software Center. A second ROMULUS route delivers LegionLoader, which callssmashshape.com. - rifteyy describes the loader path as an MSI with files in the Binary section, a VBS runner, a PowerShell loader, AES decryption of a PE, and injection of LegionLoader.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| CVE-2026-110936 | KEV DLL search path | T1574.002 | Software inventory | Due 2026-11-03. Every Siemens Software Center build before 4.0.9.8 is affected. Starting the app is supposed to auto-update it. Confirm the version after launch. |
| Siemens Software Center 4.0.9.8 | Fixed build | T1574.002 | Software inventory | Install 4.0.9.8 or later from Siemens. A copy under AppData\Local\Programs is the attacker’s bundle, not your managed install. Remove that tree after you isolate the PC. |
SiemensSoftwareCenter.exe under AppData\Local\Programs | Sideload host | T1574.002 | Sysmon Event ID 1 | Alert when msiexec.exe starts SiemensSoftwareCenter.exe from AppData\Local\Programs. The exe is signed. Do not block it by hash alone. |
SHA-256 3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491 | Malicious DLL | T1574.002 | File inventory | Block and search for 3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491, the archive.dll Siemens published. |
SHA-256 f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a | Malicious installer | T1204.002 | File inventory / MSI log | Block and search for f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a, the AllMyBasic.msi Siemens published. |
IP 96.62.218.59 | Payload and C2 | T1071.001 | Firewall / proxy | Block 96.62.218.59. Siemens marked it active for payload hosting and command and control. |
Domain wizardexpensive.com | Payload and C2 | T1071.001 | DNS | Block wizardexpensive.com and search DNS for that name. Siemens marked it active. |
IP 2.27.248.127 | ROMULUS distribution host | T1105 | Proxy logs | Search historical logs for 2.27.248.127. Siemens says it distributed AllMyBasic.msi and is now inactive. Forescout lists the same address as a ROMULUS host. |
Folder AppData\Local\Programs\SM Software Provisioning Service | Malware directory | T1574.002 | File inventory | If SM Software Provisioning Service exists under AppData\Local\Programs on a PC that should not have Siemens Software Center, isolate the PC and stop SiemensSoftwareCenter.exe before you delete the folder. |
File AppData\Local\FTSuite\ftc.uml | Infection marker | T1574.002 | File inventory | Search for ftc.uml inside AppData\Local\FTSuite. Siemens names that file as a warning sign, next to activate.bak or statinfosta.DB beside the exe. |
Domain smashshape.com | LegionLoader C2 | T1071.001 | Proxy / DNS | Block smashshape.com. Forescout says LegionLoader from the ROMULUS route posts to smashshape.com paths /nfront.php and /nback.php with a single base64 body. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — Windows Unsigned DLL Side-Loading In Same Process Path | Sysmon Event ID 7. An unsigned DLL loaded from the same folder as its host, outside System32 and Program Files, matches archive.dll beside SiemensSoftwareCenter.exe under AppData. A signed DLL misses. The search does not name Siemens. |
| Elastic | Partial — Potential ClickFix Command via Windows Run Dialog | Fires when explorer writes a RunMRU value containing msiexec (or a suspicious PowerShell string). It does not look at SiemensSoftwareCenter.exe or archive.dll. A lure that never touches the Run dialog misses. |
| Sigma | None — verified | Suspicious ClickFix/FileFix Execution Pattern also requires a # and a captcha-like word in the command line. Siemens did not publish that command line. Other sideload rules name VMware Xfer, DeviceEnroller, or Defender binaries. |
Hunt hint: Start with Sysmon Event ID 1 where ParentImage is msiexec.exe and Image is SiemensSoftwareCenter.exe under AppData\Local\Programs. On a hit, pull Sysmon Event ID 7 for that process and look for archive.dll loaded from the same folder. Then search the host’s DNS and proxy logs for wizardexpensive.com, 96.62.218.59 and smashshape.com. Isolate the PC and reset the passwords used on it before you delete the folder.
Sources: Siemens ProductCERT · SSA-580366 · Forescout · rifteyy · CISA KEV
Status Updates
- SiteGuard-CVE-2026-106931: KEV added 2026-10-20, due 2026-10-23. OS command injection when the statistics feature is enabled, which is the default, on SiteGuard Server Edition Ver2.20 and later. IIS builds from Ver3.10 through Ver4.00 Update4 are not affected. Fixed in Ver8.00 Update5 for Apache, Nginx, and IIS, and Ver7.00 Update6 for FreeBSD. Download diagnostic information before you patch, because the update can wipe traces. KEV catalog · EG Secure.
- UpdraftCentral-2026-10: TeamUpdraft’s incident page, updated 21 October 11:05 BST, says UpdraftPlus 1.26.13 and 2.26.13 revoke UpdraftCentral connection keys. An older section of that same page still says 1.26.12 or later. Confirm the installed build is 1.26.13 or 2.26.13, delete leftover keys, then look for administrators and plugins you did not install. Original brief.
- CVE-2026-102764 (BeyondTrust Remote Support): KEV due date was Oct 19 and remains overdue. No new fixed build or IOC set today. Self-hosted 26.2.3 and older still need the BT26-05-RS patch. Original brief.
- CVE-2025-61624 (FortiOS auto-script path traversal): KEV due date was Oct 19 and remains overdue. No new IOC set today. Original brief.
- CVE-2026-21589 (Atlassian Data Center file read): KEV due date was Oct 18 and remains overdue. Original brief.
- CVE-2026-0257 (PAN-OS GlobalProtect): Unit 42’s page, updated 20 October at 1:30 p.m. PT, adds a check rather than a new actor. From outside, open the management IP on TCP 4443 and TCP 3879. A response means a GlobalProtect profile is bound to the management interface. Original brief.
- KEV deadlines already passed, no new fix or IOC: CVE-2026-0322 (PAN-OS) and CVE-2026-76519 (Cisco Secure Email Gateway; AsyncOS 16.0 still has no fixed build in cisco-sa-esa-afw-zqYJkjxp, so migrate to 15.5.5-014 or 16.5.0-780) (brief); CVE-2026-105134 (AhsayCBS) (brief); CVE-2026-104935 (Ivanti) and CVE-2026-96951 (Windows Shell) (brief).
- Retired from watch (last update 2026-10-14): CVE-2026-86950 (Apple CoreGraphics). KEV due 2026-10-13 passed more than seven days ago, and the fixed builds have not changed.
- Retired from watch (last update 2026-10-07): CVE-2026-61500 (Rejetto HFS), CVE-2026-88062 (OmniRoute), ClickFix-CacheSmuggle-2026-10, CVE-2026-102406 (Kibana Fleet), CVE-2026-103007 (Elasticsearch manage_roles). No KEV entry and no new fix, PoC, or exploitation report. Today’s ROMULUS ClickFix reporting is a different chain.
- Watching (no change): ConnectWise-CloudBackup-SkyKick-2026-10 (10-17); OVHcloud-CLI-2026-10 (10-20); RankMath-SEO-Pro-3.0.123 (10-20); UNC7017-AOMEI-2026-10 (10-17); Candiru-AdFection-DiscoverTech-2026-10 (10-18); InfinityCore-2026-10 (10-18); CVE-2026-110447 (10-15); CVE-2026-102255 (10-15); Danfoss-AKSM-FROMAGEGATE-2026-10 (10-13); CVE-2026-97229 (10-13); CVE-2026-85097 (10-09); CVE-2026-107406 (10-09); CVE-2026-82077 (10-11); FortiBleed-2026-10 (10-08); tensorlake-npm-0.5.144 (10-08); CVE-2026-105192 (10-08); CyberXero-2026-10 (10-12); GhostAction-2026-10 (10-10).