Top 7 CVEs of October 2026: What Attackers Used and What to Fix First

Why do these CVEs matter more than the rest?

Attackers were already exploiting every CVE on this list in October, and that’s what puts them at the top of your patch queue. Microsoft alone fixed a record 1,400-plus CVEs on October 13, and Oracle, Ivanti and Fortinet shipped their own fixes the same month. Nobody can patch that many in a week, so the real question is which ones attackers are going after right now.

The CISA Known Exploited Vulnerabilities (KEV) catalog answers that question. CISA only adds a CVE once it has proof that attackers are using it in the wild, which makes KEV the best place to start when you decide what to fix first.

Every CVE below made that list in October.

What is PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?

PHP2Shell is a pair of critical bugs in PHP that let an attacker run code on your web server without logging in. CISA calls it unauthenticated remote code execution (RCE), and since PHP runs a big chunk of the web, the list of possible targets is long.

Both bugs come from how PHP cleans up after a fatal error, like running out of memory. When that happens, PHP uses a function called longjmp() to bail out of the request, and the cleanup goes wrong. CVE-2026-109618 leaves request memory uninitialized. CVE-2026-109619 leaves global memory pointing at memory that’s already been freed, which is a use-after-free bug. An attacker can cause these errors on purpose and use the leftover memory to run their own code.

Any PHP install that serves web requests is affected. That includes Apache with mod_php (which PHP rates as the highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.

Attackers moved fast. The first exploit attempt showed up on October 17, four days before the bugs were made public. PHP shipped fixes on October 21, and CISA added both CVEs to KEV on October 26.

That same day, Dream Research reported a campaign that chained PHP2Shell with Fragnesia (CVE-2026-46300), a Linux kernel privilege escalation bug, to break into PAN-OS firewalls. PHP2Shell got the attackers onto the firewall, and Fragnesia gave them root. Palo Alto Networks confirmed on October 29 that attackers were hitting PAN-OS management interfaces exposed to the internet this way.

What to do: Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Start by listing every place PHP runs, including inside appliances and containers, and patch the internet-facing ones first. Our PHP2Shell research page has a free checker that reads your server’s PHP version, plus remediation commands for each setup.

What is HTTP2Shell (CVE-2026-111497) and who is exposed?

HTTP2Shell is an out-of-bounds write bug in Google’s Brotli decoder, versions 1.0.3 through 1.2.0. Brotli is a compression format that tons of web software uses, so one bug in it spreads a long way.

You may also see it called Node2Shell, Python2Shell or Broccoli2Shell. They all point to the same CVE. It got the Node.js name because Node.js shipped the first fix on October 21, but the bug lives in the shared Brotli C library. That means Bun, the Python Brotli and brotlicffi packages, .NET, Envoy, Istio and curl builds that use Brotli can carry it too.

Here’s how an attack works. The attacker sends compressed data that’s built to break the decoder. When your app decompresses it, the decoder writes past the edge of its memory. That can crash the process or leak memory, and in some cases it lets the attacker run code. Google scored it 9.2 (Critical) on CVSS 4.0.

One detail decides whether you’re exposed. A bare Node.js HTTP server doesn’t decode a Brotli body just because it received one. You’re at risk when your code or middleware actually runs the decoder on data an attacker controls, whether that’s an incoming request or a response your app fetches from somewhere else.

CISA confirmed attacks and added it to KEV on October 27.

What to do: Update to Node.js 22.23.4, 24.22.1 or 26.12.1, Bun 1.4.4, Python Brotli 1.2.1, brotlicffi 1.2.1.0, or Brotli 1.0.10, 1.1.1 or 1.2.1. Node.js 20 and older won’t get a fix, so move to a supported version. If you can’t patch yet, block requests with Content-Encoding: br at your proxy or firewall. Our HTTP2Shell breakdown has the full list of affected versions.

Why does the Ivanti Connect Secure flaw (CVE-2026-104935) matter if you already patched?

It matters because attackers used it on a device that was fully patched at the time. CVE-2026-104935 is an authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure, Ivanti’s VPN appliance. It lets a remote attacker run commands on the box without a password, and it scores 8.6 on CVSS.

Volexity found the bug while looking into a breached device running 22.8R2.4 build 19097. That device counted as fully patched when the attack started on October 3. The attacker, tracked as UTA0576, chained this bug with a separate privilege escalation zero-day to run commands as root.

Ivanti patched CVE-2026-104935 on October 13, and CISA added it to KEV the same day. Then on November 2, Ivanti patched two more zero-days from the same chain, CVE-2026-111357 and CVE-2026-118527.

The bug affects Connect Secure 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Connect Secure has been a favorite target for years, including for ransomware gangs, and this bug makes 15 Connect Secure or Pulse Connect Secure flaws on the KEV list.

What to do: Install both the October 13 and November 2 updates. Don’t count on Ivanti’s integrity checker alone to tell you you’re clean. In your logs, watch for a high volume of requests to /dana-na/auth/url_default/welcome.cgi, especially ones carrying an X-DSCGI-PATH header that points to other CGI files or temp files.

How did attackers use the BeyondTrust Remote Support flaw (CVE-2026-102764)?

A suspected China-linked spy group used it to break into Remote Support appliances for about six weeks before any patch existed. BeyondTrust ties the attacks to a group called ARMORY CASTLE.

The bug sits in an internal messaging part of Remote Support, the product once called Bomgar. That component didn’t properly check where incoming messages came from (CWE-290), so an attacker with no login could perform file operations on the appliance. ARMORY CASTLE used that opening to drop webshells, escalate privileges and take root.

Root on this particular box is a big deal. Remote Support’s vault can hold admin passwords, API keys and the credentials your support staff use to reach other machines, so whoever controls the appliance may also hold the keys to much of your network.

The timeline shows how long the window stayed open. Attacks started on August 29, BeyondTrust disclosed the bug on October 15, and CISA added it to KEV on October 16. It affects versions through 26.2.3 and scores 9.3 on CVSS 4.0. BeyondTrust patched all SaaS instances by October 9, so SaaS customers don’t need to do anything to get the fix.

What to do: Patch self-hosted appliances with BT26-05. If your appliance faced the internet on a vulnerable version any time since late August, treat it as possibly breached. Rotate the appliance admin and Remote Support admin accounts, API client secrets, SAML keys, directory bind accounts and vault credentials. Then hunt for odd PHP files, new files in web-accessible folders, SUID binaries you can’t explain, changes to HAProxy or sudoers templates and gaps in log forwarding. Last, limit who can reach the /login and /appliance pages.

Why is the Windows Shell flaw (CVE-2026-96951) the first patch to deploy from October’s Patch Tuesday?

It’s the only one of Microsoft’s 1,400-plus October CVEs that attackers were already using. CVE-2026-96951 is a security feature bypass in Windows Shell that gets around Mark of the Web (MOTW). It scores 8.8 on CVSS.

MOTW is the tag Windows puts on files you download from the internet. That tag is what makes Windows show a warning before you open the file. This bug lets a malicious file pass itself off as a document you made on your own machine, so the warning never shows up. Add a phishing email and a crafted attachment, and the user opens it with no prompt at all.

Microsoft rated it Important, while more than 70 other CVEs in the same release got a Critical label. That gap is a good lesson in prioritization. A severity label tells you how bad a bug could be, and exploit status tells you whether someone is using it today, so exploit status should win. This is also the third Windows Shell zero-day exploited in 2026.

What to do: Push the October 13 cumulative updates to every Windows machine. Then move on to the Critical RCEs, starting with on-premises Exchange Server (CVE-2026-70571). If you still run Windows Server 2012 or 2012 R2, plan to replace it, because Extended Security Update coverage for both ended in October.

How serious is the PAN-OS flaw (CVE-2026-0322)?

It’s serious, with one catch: the attacker has to log in first. CVE-2026-0322 is a code injection bug (CWE-94) in the PAN-OS management interface. An attacker with valid credentials and network access to that interface can run code as root on the firewall.

It affects PA-Series and VM-Series firewalls and Panorama, and it doesn’t need any special configuration to work. Palo Alto Networks found it internally and has seen very limited exploitation. CISA added it to KEV on October 14, and it scores 8.6 on CVSS 4.0.

The login step shouldn’t make you relax. Attackers steal admin credentials all the time, and an exposed management interface draws attacks no matter which bug they bring. October proved that, because the PHP2Shell campaign above went after internet-facing PAN-OS management interfaces too.

What to do: Upgrade to the fixed build for your PAN-OS branch, as listed in Palo Alto’s advisory. Then take the management interface off the internet and only allow access from trusted internal IP addresses.

What happened with Fortinet FortiMail (CVE-2026-104286)?

Attackers exploited a critical FortiMail bug as a zero-day, before Fortinet had a fix out. CVE-2026-104286 is an improper pathname restriction bug that lets an attacker with no login write any file they want to the appliance. It scores 9.8 on CVSS, and CISA added it to KEV on October 1, the earliest entry on this list.

Writing a file to the right spot lets an attacker drop a webshell or overwrite a config file, and either one usually ends with them running code. On a mail gateway, that’s a serious problem. FortiMail sits in front of your email, so whoever controls it can read every message your company sends and receives.

What to do: Upgrade to the fixed FortiMail release in Fortinet’s advisory, and keep the admin interface off the internet. Then check the appliance’s web folders for files you can’t explain, since a webshell planted before the patch stays behind after it.

What do October’s CVEs have in common?

Three patterns run through October’s list, and each one changes how you should test.

Attackers went for the edge. Ivanti Connect Secure, BeyondTrust Remote Support, PAN-OS and FortiMail all sit between the internet and your internal network, so breaking into one puts an attacker inside. These boxes are also hard to watch. Most can’t run an EDR agent, so an attacker can sit on one for weeks, the way ARMORY CASTLE did with BeyondTrust from late August. The only way to know how one looks to an attacker is to test it from the outside.

Small bugs got chained into big ones. PHP2Shell plus a kernel bug gave attackers root on firewalls. Ivanti’s bypass plus a privilege escalation zero-day did the same on VPNs. A scanner scores each bug on its own, so Fragnesia shows up as one more local privilege escalation in a long queue. You only see that it hands over a firewall when you test the whole path, from the web request to root.

Being patched didn’t keep people safe. Ivanti’s victim was fully patched when the attack began, and BeyondTrust customers had nothing to install for six weeks. A version check would have marked both as fine. The question that mattered was whether an attacker could reach the appliance at all, and you can answer that without waiting for a patch: take management pages off the internet, then test what’s left.

How can you check if you’re exposed?

You find out by testing your real setup, because a version number only tells you a bug might be there. Here’s the order we’d follow for October’s CVEs.

1. List everything that faces the internet. Include VPNs, remote support tools, firewall management interfaces, mail gateways and any app that runs PHP or decodes Brotli. Attack surface management keeps that list current as things change.

2. Rank by what’s being exploited. Put KEV entries first, then sort by EPSS and asset value before you look at CVSS. Our guide to vulnerability prioritization walks through it, and risk-based vulnerability management does it at scale.

3. Prove which bugs an attacker can reach. Test whether each flaw is reachable in your environment and whether it chains into something worse. Exposure validation does exactly this.

4. Retest after you patch, and hunt where you were exposed. Confirm the fix closed the hole. For anything that faced the internet while it was vulnerable, look for signs of a break-in, too.

Strobes agentic pentesting does this work for you. Agents test your web, API, network and cloud assets the way an attacker would, and they only report findings they’ve confirmed with evidence. So when the next PHP2Shell drops, you get a short, proven list of what an attacker can reach in your environment, so your team knows exactly where to start.

FAQ

What is the CISA KEV catalog?
It’s CISA’s list of vulnerabilities that attackers are confirmed to be exploiting in the wild. US federal agencies have to fix KEV entries by a set deadline, and many private companies use the same list to decide what to patch first.

Which October 2026 CVE should I patch first?
Patch whichever of these you run on an internet-facing system. If you run PHP web servers, start with PHP2Shell. If you run Ivanti Connect Secure or self-hosted BeyondTrust Remote Support, patch those right away and check for signs of a breach.

Is HTTP2Shell a bug in HTTP/2?
No. The bug is in the Brotli decoder. The name refers to the HTTP traffic that carries the malicious compressed data to your app.

Does patching mean I’m safe?
Patching closes the hole going forward. If an affected system was exposed before you patched it, an attacker may already have planted a webshell or stolen credentials, so check for that as well.

Why did Microsoft rate CVE-2026-96951 only Important if attackers were using it?
Microsoft’s severity rating measures how much damage a bug can do on its own. It doesn’t factor in whether anyone is exploiting it, which is why you should check KEV status alongside the rating.

Sources

• CISA: Critical vulnerabilities in PHP require immediate patching

• CISA: Two KEV additions, October 26

• CISA: Four KEV additions, October 14

• Palo Alto Networks Unit 42: PHP2Shell threat brief

• Strobes: PHP2Shell research

• Strobes: HTTP2Shell breakdown

• BleepingComputer: CISA warns of hackers exploiting Node2Shell

• The Register: Ivanti Connect Secure zero-day

• CSA Singapore: Ivanti Connect Secure advisory

• BleepingComputer: Ivanti patches two more Connect Secure zero-days

• BeyondTrust advisory BT26-05

• Rescana: BeyondTrust CVE-2026-102764

• Cyber Daily: BeyondTrust Remote Support alert

• Tech Times: October Patch Tuesday

• BleepingComputer: October 2026 Patch Tuesday

• SecurityWeek: PAN-OS zero-day

• isMalicious: KEV additions, October 2026