Global – October 31, 2026 -- A PHP vulnerability that stalled in triage after a 2024 audit became unauthenticated remote code execution this year once researchers applied frontier AI models, and both PHP2Shell CVEs now carry a CVSS v4.0 score of 9.2.

Global – October 31, 2026 -- CrowdStrike Counter Adversary Operations has observed no successful exploitation of the PHP2Shell vulnerabilities in the wild or in its honeypot environments, only testing, probing and unsuccessful attempts.

Global – October 27, 2026 -- Apache Airflow's SSH and SFTP providers ship with host key verification disabled by default. Two High-severity vulnerabilities, CVE-2026-94134 and CVE-2026-94135, both rated CVSS 8.1, leave connections open to man-in-the-middle attacks, according to OX Security Research.

Both apache-airflow-providers-ssh and apache-airflow-providers-sftp are affected through version 6.0.1. Version 7.0.0 of each package fixes the flaw. The weakness is classified as CWE-322, key exchange without entity authentication.

Global – October 27, 2026 -- PHP will ship an emergency patch for two critical core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on Wednesday, October 21, 2026, at 14:00 UTC (10:00 ET). The PHP security team rates both flaws CVSS v4.0 9.2, and researchers describe them as unauthenticated remote code execution.

Global – October 27, 2026 -- Roughly 2,000,000 internet-facing PHP servers run versions affected by two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, and 99.99% of identifiable servers remain unpatched, according to Shodan data cited by OX Security.

The PHP core team issued an out-of-band security release fixing both flaws in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Shodan counts only servers that expose their PHP version, so the real total is likely higher.

Global – October 27, 2026 -- Three critical vulnerabilities rated CVSS 9.2 in Pillow, the Python imaging library with an estimated 436 million monthly downloads, let a single crafted EPS, TIFF or JPEG file trigger command execution or heap corruption in any Python service that processes user-supplied images. Disclosed on 2026-10-19, all three flaws are fixed in Pillow 13.0.0.

Global -- Node.js issued security releases across all supported lines on October 21, 2026, to fix CVE-2026-111497, a high-severity out-of-bounds write in its bundled Brotli decoder that can lead to remote code execution. A Node.js process that decompresses attacker-controlled Brotli data, including Brotli-encoded HTTP responses it fetches, can be driven to write past the end of its buffer. The result is leaked memory or code execution with the process's privileges.

Global – October 27, 2026 -- Security provider Wirespeed says reviews of new customers' previous 90 days of detections routinely uncover suspicious logins on MFA-enforced accounts that existing tools never surfaced, some dating back weeks.

The sessions go unflagged because the authentication evidence looks clean: valid credentials, a satisfied MFA prompt and a valid issued session. A stolen session token carries the authentication context that created it, so the assertion of strong authentication travels with the attacker.

Global – October 17, 2026 -- Citrix confirmed on September 27 that two critical NetScaler zero-day vulnerabilities, each scoring 9.5 in severity, were exploited in the wild. According to cyber insurer Coalition, the vendor's public communications lagged the first reports by at least 36 hours.

Global – October 13, 2026 -- Microsoft's October 2026 security release includes an actively exploited Windows Shell zero-day (CVE-2026-96951, CVSS 8.8), 20 Critical remote code execution flaws in Office applications and five CVSS 9.8 vulnerabilities in Outlook. Several of the flaws can be triggered by viewing a file or email in a preview pane, which removes the click-to-compromise barrier many enterprises rely on.