Global – October 27, 2026 -- PHP will ship an emergency patch for two critical core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on Wednesday, October 21, 2026, at 14:00 UTC (10:00 ET). The PHP security team rates both flaws CVSS v4.0 9.2, and researchers describe them as unauthenticated remote code execution.

Global – October 27, 2026 -- Roughly 2,000,000 internet-facing PHP servers run versions affected by two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, and 99.99% of identifiable servers remain unpatched, according to Shodan data cited by OX Security.

The PHP core team issued an out-of-band security release fixing both flaws in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Shodan counts only servers that expose their PHP version, so the real total is likely higher.

Global – October 27, 2026 -- Three critical vulnerabilities rated CVSS 9.2 in Pillow, the Python imaging library with an estimated 436 million monthly downloads, let a single crafted EPS, TIFF or JPEG file trigger command execution or heap corruption in any Python service that processes user-supplied images. Disclosed on 2026-10-19, all three flaws are fixed in Pillow 13.0.0.

Global -- Node.js issued security releases across all supported lines on October 21, 2026, to fix CVE-2026-111497, a high-severity out-of-bounds write in its bundled Brotli decoder that can lead to remote code execution. A Node.js process that decompresses attacker-controlled Brotli data, including Brotli-encoded HTTP responses it fetches, can be driven to write past the end of its buffer. The result is leaked memory or code execution with the process's privileges.

GLOBAL – October 27, 2026 -- Only 14,151 of 1,974,890 measurable PHP instances in the affected version range showed a patched release 24 hours after PHP shipped emergency fixes for the PHP2Shell flaws, leaving 99.3% exposed, according to OX Security.

PHP released the fixes on October 21 for CVE-2026-109618 and CVE-2026-109619. Both are critical vulnerabilities that allow unauthenticated remote code execution in the PHP engine itself. Governments and security agencies urged organizations to patch immediately, and some organizations took systems offline.

Global – October 27, 2026 -- Five days after the PHP project shipped emergency fixes for the PHP2Shell flaws, 93.6% of measurable PHP instances remain exposed, according to OX Security scans run through October 26, 2026. That is roughly 15 of every 16 hosts the firm can measure.

Global – October 27, 2026 -- Sixty-five percent of 2,000 senior security decision-makers say they have too many security tools or vendors, and 53% say their tools can't be integrated, according to 2025 research by Barracuda and Vanson Bourne. For application security (AppSec) teams, the sprawl shows up as overlapping findings from static application security testing (SAST), software composition analysis (SCA), and cloud-native application protection platforms (CNAPPs).

Norwalk – October 27, 2026 -- Xerox has been named a Leader in Quocirca's 2026 Automation & AI, Cloud & Technology (ACT) assessment, which evaluates vendors across Automation & AI, Cloud and Technology Ecosystems.

Xerox applies AI across four operational areas

Xerox says it now uses AI as a foundational capability in predictive maintenance, workflow automation, intelligent document processing and production optimization. Cloud platforms and partner ecosystems support these offerings and let them scale securely across distributed environments.

Norwalk, Conn. – October 27, 2026 -- Xerox has been named a Leader in Quocirca's Cloud Print Services Landscape 2026 for the fifth consecutive year, ranking strongest in the market on both strategy and completeness of offering.

Florham Park – October 27, 2026 -- The New York Jets have signed a multi-year agreement with Xerox to deploy document management, printing infrastructure and internal workflow technology across the team's training facility and front office.