This Week in CVEs: The Week Defenders Lost the Head Start

By SAFE Threat Research Team

This week, the normal vulnerability lifecycle broke down.

PHP2Shell set the tone for the week. CVE-2026-109618 and CVE-2026-109619, two critical unauthenticated RCEs in PHP, were already being probed before disclosure and drew exploitation attempts almost immediately after emergency fixes landed. Then, barely two days later, PHP disclosed CVE-2026-115560, another RCE vector tied to session upload progress, extending the security response before many teams had finished dealing with the first two.

That would have been enough for most weeks. It was only the beginning.

Fresh critical issues landed across Node.js, GitLab, Splunk, remote-access infrastructure, and the software supply chain, while already-compromised environments continued to generate downstream impact. The result was not just more vulnerabilities, but less time between discovery, disclosure, exploitability, and attacker action.

What stood out was how often defenders were forced to react with incomplete lead time: before patches were broadly deployed, before exploit activity was fully understood, or after attackers had already converted an initial foothold into credentials, persistence, or broader access.

This week, the real advantage was not knowing which CVEs were severe.

It was knowing which exposures could turn into incidents first.

Vulnerability Landscape

A total of 4,695 CVEs were published this week, including 1,663 rated critical or high. The more important shift was where the pressure concentrated: internet-facing runtimes, remote-access infrastructure, developer platforms, security tooling, and management systems. Several of the week’s highest-impact issues gave defenders little or no meaningful lead time between disclosure and attacker activity.

Top CVEs to Watch

PHP2Shell: Pre-auth RCE hit the internet before the patch did

CVE-2026-109618, CVE-2026-109619

Two memory-safety flaws in the PHP core enable unauthenticated remote code execution before application code even runs, putting Apache mod_php deployments at particular risk. Every PHP branch back to 5.4 is affected, and exploitation has been demonstrated against common PHP applications, including WordPress, Drupal, and Joomla.

For a detailed technical breakdown of the vulnerabilities, exploitation path, affected configurations, and mitigation guidance, see our PHP2Shell deep dive.

The dangerous part was the timeline. Probing was observed four days before disclosure, and scanners, web-shell delivery attempts, and Mirai-derived payloads appeared within hours of the October 21 fixes. With tens of millions of potentially vulnerable PHP services still exposed, this was effectively a race that defenders entered late.

Plex2Shell: Four medium-to-high bugs chained into full RCE – then monetized overnight

CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656

Plex2Shell chains two SSRFs, unsafe plugin URL handling, and an arbitrary file-write primitive into unauthenticated code execution as the Plex service account. Individually, none of the four CVEs exceeds 8.6; together, they produce a critical compromise path.

A public PoC appeared on October 16. Exploitation followed the next morning, with attackers deploying XMRig miners and proxyware connected to AISURU infrastructure. The chain also exposes the Plex owner token, making patching only half the response – exposed servers should also have sessions revoked and credentials rotated.

BeyondTrust: The zero-day was already inside the privilege boundary

CVE-2026-102764

This authentication bypass in BeyondTrust Remote Support lets an unauthenticated attacker abuse internal messaging components to perform file operations on the appliance and ultimately gain host-level control.

The vulnerability had already been used as a zero-day vulnerability weeks before disclosure. Attackers escalated to root, accessed the appliance’s credential vault, established reboot-resistant persistence, deleted logs, and used compromised administrative access to pivot into downstream systems. For exposed appliances, this is not simply a patch event – it is a compromise-assessment event.

Fortinet: A 2024 management-plane breach became a 2026 firewall implant

CVE-2024-47575, CVE-2025-61624

Unit 42’s October 14 report on a long-running telecom intrusion puts two Fortinet flaws back on the list. The actor, CL-STA-0954 (UNC5820), gained initial access in September 2024 through CVE-2024-47575, the FortiJump flaw in FortiManager, exfiltrated configurations, credentials, certificates, and private keys for more than 500 managed FortiGates, and later returned with the stolen credentials rather than a new exploit.

It then used CVE-2025-61624, a medium-rated authenticated path traversal in the FortiOS CLI, to gain root on FortiGates and deploy PEERSTITCH, a memory-resident implant with no persistent binary, no listening ports, and no outbound connections; CISA added the CVE to KEV on October 16. Fixed releases are FortiOS 7.6.5 and 7.4.10 (7.2, 7.0, and 6.4 must migrate), FortiProxy 7.6.5 and 7.4.12, FortiSwitchManager 7.2.8 and 7.0.7, and FortiPAM 1.7.1, but patching does not evict this actor: rotate every credential, certificate, and key held by any FortiManager that was ever exposed.

Siemens Software Center: A signed binary became the attacker’s loader

CVE-2026-110936

CVE-2026-110936 is an uncontrolled DLL search-path flaw in Siemens Software Center that allows a crafted DLL placed beside the executable to run with the application’s privileges.

Attackers turned the issue into something much more effective than the local-attack scenario implied by the score: a legitimate, validly signed Siemens executable was packaged with a malicious archive.dll and delivered through ClickFix-style social engineering. The result was trusted software carrying attacker-controlled code past controls that rely heavily on signatures and publisher reputation.

REDCap: One public survey URL was enough to reach code execution

CVE-2026-90817

REDCap’s public survey handler contains a double-decoding flaw that can expose an internal controller capable of writing files later executed by the application. The attack requires access to a public survey URL – exactly the type of link that can be indexed or widely shared.

Observed exploitation used a single request to stage a transient web shell, followed by an in-memory loader that retrieved XMRig disguised as image files, masqueraded the miner as syslog-ng, and established persistence through cron and an added SSH key. Patching closes the initial path but does not remove the payloads already deployed.

Also on the Radar

A few issues did not make the main deep-dive list but deserve close monitoring:

• LiteLLM 1.107.0 – compromised release pipeline: The project’s official release pipeline was compromised, pushing malicious PyPI wheels and container images with credential-stealing and remote-code-execution capability. Three developer GitHub credentials were compromised in the incident. This is not a CVE story; the package itself became the attack path, which makes installed copies of the affected release a compromise-assessment problem rather than a normal patching problem.
• Arista VeloCloud Orchestrator – CVE-2026-114625: A CVSS 9.9 privilege-escalation flaw that can let even a read-only authenticated user become a superuser operator. Arista says the issue is being actively exploited, making it the third VeloCloud Orchestrator vulnerability to be exploited since July.
• SiteGuard Server Edition – CVE-2026-106931: Root-level command injection with confirmed exploitation and a short remediation window after its addition to KEV.
• Collabora CODE – CVE-2026-110447: Administrators have reported web shells being dropped through exposed Nextcloud CODE servers, indicating exploitation beyond proof-of-concept activity.
• Langflow – CVE-2026-105740: More than 3,000 honeypot exploitation attempts have been observed, although confirmed production compromise remains less clear.
• Node.js – CVE-2026-111497: A Brotli decoder memory-corruption issue capable of remote code execution. Exploitability has been demonstrated, but the draft does not establish confirmed in-the-wild exploitation.
• Apache Traffic Server, Splunk, Snort 3, and BIND 9: Newly disclosed high-impact flaws across web infrastructure, security tooling, network inspection, and DNS. None showed confirmed exploitation in the draft cutoff, but all sit in components where exploitation could quickly become operationally significant.

From Vulnerability Intelligence to Action

This week exposed a different bottleneck: not the lack of vulnerability intelligence, but the time it takes to turn that intelligence into a defensible response.

When multiple high-impact issues land across runtimes, developer platforms, security infrastructure, remote-access systems, and the software supply chain at once, teams cannot treat every new CVE as an isolated patch ticket. They need to quickly answer which assets are affected, which exposures are reachable and exploitable, what those systems control, and where remediation will reduce the most risk first.

That makes response speed a function of context, not just patch availability.

The goal is to compress the path from disclosure to exposure understanding to validated remediation. SAFE CTEM helps teams do that by connecting current threat activity with asset context, exploitability, controls, and business impact – so the response is driven by where attackers can create meaningful impact, not by whichever CVE arrived most recently.

In weeks like this, the advantage is not simply knowing first.

It is deciding and acting first.