October 2026 security notices: what to fix first
A record Patch Tuesday, PHP flaws allowing remote code execution and new CISA alerts. A summary of the month's vulnerabilities and what to prioritize.
· Josué Juca
- October's Patch Tuesday fixed 1,413 vulnerabilities, a record, with 1 exploited zero-day in Windows Shell.
- PHP fixed two unauthenticated remote code execution flaws, already exploited. Read the full PHP2Shell article.
- CISA added four exploited flaws to the KEV catalog on October 14, in PAN-OS, Cisco and AhsayCBS.
- Priority: update Windows and PHP, starting with whatever is exposed to the internet.
This is our monthly summary of the vulnerabilities that deserve the most attention from anyone looking after company computers and servers. It is based on public sources, listed at the end. Security advisories change quickly, so always confirm in vendors' official notices before acting.
Microsoft's record Patch Tuesday
October's update fixed 1,413 vulnerabilities, according to CyberScoop and Malwarebytes, topping even a full year's total: the previous record was 1,261 CVEs, in 2020. Windows accounts for 1,102 of them.
- CVEs fixed in Patch Tuesday, a record
- 1,413
- exploited zero-day in Windows Shell
- 1
- CVSS v4.0 score of the PHP flaws, per watchTowr
- 9.2
October 2026 Patch Tuesday: CVEs fixed by product
- Windows: 1102
- Office: 134
- Developer tools: 61
- SharePoint Server: 36
- Others*: 80
Source: CyberScoop. *Difference between the 1,413 total and the sum of the detailed products, which the report does not explain.
The month's highlights:
- Exploited zero-day: CVE-2026-96951, in Windows Shell. It is a security feature bypass that gets around Mark of the Web, the protection that warns about files downloaded from the internet. It has a CVSS score of 8.8 and requires the person to open a file or click a link. Tenable notes it is the third Windows Shell problem exploited this year.
- Publicly disclosed: CVE-2026-108398, in .NET Framework, which lets a local attacker bypass WDAC, Windows Defender Application Control (CVSS 8.8).
- Publicly disclosed: CVE-2026-92707, in MessagePack-CSharp, which can exhaust the memory of applications processing specially crafted data (CVSS 5.3).
Only the first has confirmed exploitation. ZDI's Dustin Childs sums up the advice: prioritize what is proven and public rather than getting lost counting CVEs.
PHP: remote code execution without authentication
CISA published an alert for CVE-2026-109618 and CVE-2026-109619, nicknamed "php2shell". They allow unauthenticated remote code execution and affect PHP installations serving web requests, including Apache with mod_php (considered the highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Both were added to the KEV catalog on October 26. We wrote a full article on PHP2Shell.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CISA's guidance is:
- Inventory systems running PHP, remembering it is often a component of other software, such as websites and packaged systems.
- Apply the update immediately, starting with internet-facing systems.
- If you cannot update, or the version is 8.1 or earlier (unsupported), take the system offline until it is fixed.
- Use a web application firewall (WAF) as partial protection in the meantime.
- Monitor for PHP processes opening shells or downloading tools.
Other exploited flaws in CISA's catalog
On October 14, CISA added four vulnerabilities with active exploitation:
| CVE | Product | Flaw type |
|---|
| CVE-2026-0322 | Palo Alto Networks PAN-OS | Code injection |
| CVE-2026-76519 | Cisco Secure Email Gateway | Relative path traversal |
| CVE-2026-105133 | AhsayCBS | Improper authentication |
| CVE-2026-105134 | AhsayCBS | Command injection |
CISA did not list affected versions in the alert, so check each vendor's advisory.
CISA's KEV catalog only lists flaws with proven exploitation. It is one of the best filters for deciding what to fix first.
Quick checklist
- Run Windows Update on workstations and servers and restart when asked.
- Find where PHP is running, including inside other systems, and check the version.
- Prioritize everything exposed to the internet: firewalls, email, panels and web servers.
- Keep tested backups and two-factor authentication on administrative access.
If your company needs help inventorying, updating and monitoring its environment, our technical support can do it for you.
Sources