🛡️ Cybersecurity Vulnerability Watch

Week of: 2026-10-18 to 2026-10-24 Reporting window: Most recently completed Sunday–Saturday (excludes the in-progress week).

1. Top Action Item

Patch the two vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog on Friday — Collabora Online Built-in CODE Server (CVE-2026-110447, CVSS 9.2) and Arista VeloCloud Orchestrator (VCO) — because both are confirmed exploited in the wild. If either product is reachable from the internet, treat it as compromised until proven otherwise and check for post-exploitation activity. Then schedule the emergency PHP "PHP2Shell" fixes (CVE-2026-109618 and CVE-2026-109619, CVSS 9.8) immediately after: they are not yet reported as exploited, but PHP underpins web servers and CMS platforms globally.

2. Exploited This Week

Collabora Online Built-in CODE Server — CVE-2026-110447

• Source: The Hacker News
• Link: The Hacker News
• Severity: Critical (CVSS 9.2)
• What's happening: CISA added it to the KEV catalog on Friday, citing reports of active exploitation in the wild.
• Fix: Apply the vendor update — the fixed version is not listed in the excerpt (see source).

Arista VeloCloud Orchestrator (VCO) — second KEV addition

• Source: The Hacker News
• Link: The Hacker News
• Severity: Critical (vendor/CISA rating; see source)
• What's happening: Added to CISA KEV the same day as the Collabora flaw, citing active exploitation in the wild; the CVE ID is not given in the excerpt (see source).
• Fix: Apply the vendor update — patched version not specified in the excerpt (see source).

Palo Alto Networks PAN-OS — CVE-2026-0257

• Source: Palo Alto Unit 42
• Link: Unit 42
• Severity: See source
• What's happening: Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting this PAN-OS vulnerability; Unit 42 updated its advisory on October 20.
• Fix: Apply the PAN-OS update per the advisory and hunt for ransomware precursor activity on internet-facing firewalls (see source).

3. Critical Patch Roundup

PHP ("PHP2Shell")

PHP core — CVE-2026-109618 / CVE-2026-109619

• Source: Fortinet FortiGuard PSIRT
• Link: FortiGuard FG-IR-26-186
• Severity: Critical (CVSS 9.8)
• What's happening: Memory-handling flaws in PHP's out-of-memory error path (longjmp) and related global handling can leave request memory in an uninitialized state, leading to remote code execution. Talos warns the impact extends across the wider PHP ecosystem; fixes required emergency releases.
• Fix: Apply the emergency PHP patches. Note that simply clicking "Update" may not be enough — see the exposure/risk guidance in Dark Reading. A follow-on issue, CVE-2026-115560, is not being emergency-patched and only affects unusually configured apps; PHP recommends disabling the affected feature as mitigation.

Ruby / GitLab

Ruby Onigmo regex engine — Ruby 4.0.9, 3.4.12, 3.3.13

• Source: The Hacker News
• Link: The Hacker News
• Severity: Critical (four critical GitLab RCE flaws)
• What's happening: Three bugs in Ruby's built-in Onigmo regex engine allow a crafted pattern to corrupt memory during compilation, potentially achieving code execution; they underlie four critical GitLab RCE flaws patched over the past month.
• Fix: Upgrade to Ruby 4.0.9, 3.4.12, or 3.3.13.

Python ecosystem

Pillow — CVE-2026-112900

• Source: The Hacker News
• Link: The Hacker News
• Severity: Critical (per source)
• What's happening: Pillow passes a filename directly to Ghostscript when opening EPS images without validating it, letting a crafted image run operating-system commands on the server.
• Fix: Update Pillow to a fixed release (see source); avoid processing untrusted EPS files until patched.

Brotli decoder — CVE-2026-111497

• Source: The Hacker News
• Link: The Hacker News
• Severity: See source
• What's happening: A memory-corruption flaw in Google's Brotli decoder lets crafted compressed data overwrite past the end of a buffer; it affects Node.js, Bun, Microsoft .NET, the Python brotli and brotlicffi packages, and Envoy proxies configured to decompress Brotli.
• Fix: Update each affected runtime/library to a fixed version (see source).

Microsoft

Windows Network Load Balancing — CVE-2026-83862

• Source: Microsoft MSRC
• Link: MSRC
• Severity: High (CVSS 8.8, revised down from 9.8)
• What's happening: Remote code execution, now scored as requiring Layer 2 network adjacency rather than network-wide reach. Microsoft notes this is an informational CVSS change only.
• Fix: If the update is already installed, no further action is required.

Microsoft cloud services — CVE-2026-105014, CVE-2026-96185, CVE-2026-96251, CVE-2026-97785, CVE-2026-97783

• Source: Microsoft MSRC
• Link: Azure Pipelines CVE-2026-105014 · Exchange Online CVE-2026-96185 · PowerShell CVE-2026-96251 · AAD App Proxy CVE-2026-97785 · SharePoint CVE-2026-97783
• Severity: See source
• What's happening: Command injection in Azure Pipelines enabling network code execution; stack buffer overflow in Exchange Online; RCE and a security feature bypass in PowerShell; improper authentication in AAD App Proxy allowing privilege elevation; and a SharePoint spoofing flaw that Microsoft says was fixed in July but inadvertently omitted from that release.
• Fix: Apply the current Microsoft updates; for SharePoint, move to the most current server release. MSRC also lists Azure Kubernetes Configuration Service (CVE-2026-83938), Azure AI Foundry (CVE-2026-108456), VM Inspector (CVE-2026-110063) and Windows Win32 Kernel Subsystem (CVE-2026-102208) advisories this week — check each for applicability.

4. Home / SOHO Impact

• Run Windows Update, then make sure Secure Boot revocations are applied. A new UEFI bootkit, BlackX, bypasses Secure Boot on Windows systems that are patched but are missing revocation updates — so the DBX/revocation step matters as much as the patch itself.
• Uninstall abandoned Popcorn Time / Time4Popcorn. Researchers had to push more than 2 million remote updates to switch off its updater, which could have let an outsider take over the machine.
• Keep your browser and operating system current so that the eight compromised eMudhra intermediate CA certificates are distrusted; an up-to-date trust store limits the risk of man-in-the-middle interception.
• If you run anything Python-based at home or in a small office, update Pillow and the Brotli libraries — both have code-execution/memory-corruption fixes out this week (CVE-2026-112900, CVE-2026-111497).
• Review what your Google account shares with Search and Gemini. Google's updated privacy policy states data from connected services like Gmail and Photos can inform targeted ads when you use personalized AI features.

5. Enterprise Impact

• PHP2Shell is a perimeter-and-app problem, not just a patching task. PHP powers web servers and CMS platforms worldwide; treat CVE-2026-109618 / CVE-2026-109619 (CVSS 9.8) as urgent, verify actual runtime versions rather than assuming package updates landed, and use the Snort coverage Cisco Talos published in its Community Ruleset to hunt for exploitation attempts.
• Sweep for internet-exposed Collabora Online CODE Server and Arista VeloCloud Orchestrator now. Both are KEV-listed with confirmed exploitation; assume compromise on any instance that was reachable and review logs for post-exploitation activity.
• PAN-OS remains an active ransomware target. Qilin (Spikey Scorpius) and Inc (Tarnished Scorpius) are exploiting CVE-2026-0257 — prioritize edge firewall patching overdue from May 2026 and rotate credentials on affected devices.
• Rotate credentials on network edge gear. A large-scale campaign against exposed Fortinet FortiGate and Palo Alto GlobalProtect devices has yielded over 70,000 credentials, with operators reported to have gained access to numerous organizations.
• Audit your LiteLLM installs and CI/CD trust. A master key committed to a public GitHub repository in May 2026 let an attacker push a malicious version of the LiteLLM Python package — pin and verify package versions, and rotate any GitHub tokens or release-pipeline secrets the deployment could reach.
• Apply Secure Boot revocation updates and monitor boot integrity. BlackX targets diplomatic organizations in Central Asia (suspected APT41), but the technique — booting on patched Windows that lacks revocations — applies to any estate with stale DBX data.
• Distrust the eMudhra intermediates and hunt for misuse. Eight compromised intermediate CA private keys risk unauthorized TLS signing and MitM interception; remove them from trust stores and search certificate transparency/monitoring for certificates chained to them.
• Check third-party SaaS exposure. Microsoft attributes the ConnectWise supply chain attack to Storm-0940, which used an AI-enabled penetration-testing tool to automate its way across more than 2,200 tenants — review tenant-level integrations and least-privilege grants.

6. What To Patch First

1. Collabora Online Built-in CODE Server — CVE-2026-110447 (exploited in the wild, CISA KEV, CVSS 9.2)
2. Arista VeloCloud Orchestrator — second CISA KEV addition (exploited in the wild)
3. PHP — PHP2Shell emergency fixes, CVE-2026-109618 / CVE-2026-109619 (critical, CVSS 9.8, ubiquitous deployment)
4. Palo Alto Networks PAN-OS — CVE-2026-0257 (actively exploited by Qilin and Inc ransomware)
5. Windows / Secure Boot — CVE-2026-83862 NLB RCE (CVSS 8.8) plus Secure Boot revocation updates to block BlackX
6. Ruby — 4.0.9 / 3.4.12 / 3.3.13 (underlying four critical GitLab RCE flaws)
7. Pillow (Python) — CVE-2026-112900 (critical code execution via crafted image)
8. Brotli decoder — CVE-2026-111497 (affects Node.js, Bun, .NET, Python packages, Envoy)
9. Microsoft cloud/identity — Azure Pipelines CVE-2026-105014, AAD App Proxy CVE-2026-97785, Exchange Online CVE-2026-96185, PowerShell CVE-2026-96251, SharePoint CVE-2026-97783
10. Trust stores — remove the eight compromised eMudhra intermediate CA certificates

Sources

• CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud — https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html
• Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20) — https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/
• PHP2Shell core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619) — https://fortiguard.fortinet.com/psirt/FG-IR-26-186
• Two critical RCEs in PHP core — https://blog.talosintelligence.com/two-critical-rces-in-php-core/
• Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 — https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/
• Exposed to PHP2Shell? Cyber Experts Weigh in With Advice — https://www.darkreading.com/application-security/exposed-php2shell-cyber-experts-advice
• PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches — https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html
• Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws — https://thehackernews.com/2026/10/ruby-fixes-three-regex-engine-bugs.html
• Critical Flaw in Python's Popular Pillow Image Library Allows Code Execution via a Crafted Image — https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html
• Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software — https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html
• CVE-2026-83862 Windows Network Load Balancing Remote Code Execution Vulnerability — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83862
• CVE-2026-105014 Azure Pipelines Remote Code Execution Vulnerability — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105014
• CVE-2026-96185 Microsoft Exchange Online Remote Code Execution Vulnerability — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96185
• CVE-2026-96251 Microsoft PowerShell Remote Code Execution Vulnerability — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96251
• CVE-2026-97785 AAD App Proxy Elevation of Privilege Vulnerability — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97785
• CVE-2026-97783 Microsoft Office SharePoint Spoofing Vulnerability — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97783
• EMudhra Intermediate CA Certificates Compromised — https://unit42.paloaltonetworks.com/emudhra-certificate-compromise/
• Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline — https://thehackernews.com/2026/10/leaked-litellm-master-key-let-attackers.html
• BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations — https://thehackernews.com/2026/10/blackx-uefi-bootkit-bypasses-secure.html
• Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials — https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html
• Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet — https://thehackernews.com/2026/10/researchers-push-over-2-million-updates.html
• Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack — https://www.darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack
• Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads — https://thehackernews.com/2026/10/google-says-gmail-and-photos-data.html