This brief covers the trailing ~48 hours (October 19–21, 2026). Items are drawn from primary sources (vendor advisories and CISA) and cross-checked against reputable outlets.

PHP Security Team gives advance notice of an emergency release for two critical flaws

PHP.net · October 20, 2026

The PHP security team announced a security release scheduled for Wednesday, October 21, 2026 at 14:00 UTC addressing two critical vulnerabilities, both rated CVSS v4.0 9.2. The identifiers are reported as CVE-2026-109618 and CVE-2026-109619 (remote code execution). PHP has not published affected or fixed versions ahead of the release; researchers at Sansec say the issues affect web servers running PHP 5.4 or later, and Tenable reports the team’s expected fixes land in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (unconfirmed until release). watchTowr told BleepingComputer the flaws are real and says it believes it reproduced CVE-2026-109618; Cloudflare’s CTO reported early attacks. Neither CVE was in CISA KEV at the time of research.

“We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.” — PHP security team, php.net

Source: PHP.net announcement · BleepingComputer · Sansec · Tenable

Siemens confirms active exploitation of Software Center DLL search-path flaw (CVE-2026-110936)

Siemens ProductCERT · Updated October 19, 2026

Siemens updated advisory SSA-580366 on October 19 for CVE-2026-110936, an uncontrolled search path (DLL loading) weakness in Siemens Software Center. All versions below V4.0.9.8 are affected; the advisory rates it CVSS v4.0 8.4 (v3.1 6.7) and the fix is V4.0.9.8 or later. SecurityWeek reports attackers paired a legitimate signed copy of Software Center with malicious DLLs delivered via ClickFix lures. The flaw was listed among six additions to CISA’s Known Exploited Vulnerabilities catalog on October 20.

“No Siemens system, product or update channel was breached to our knowledge.” — Siemens, as quoted by SecurityWeek

Source: Siemens SSA-580366 · SecurityWeek

CISA adds six vulnerabilities to the KEV catalog, including Plex Media Server and SiteGuard

CISA · October 20, 2026

CISA published an alert on October 20 adding six vulnerabilities to the Known Exploited Vulnerabilities catalog. Per WindowsForum’s summary of the alert, the entries are four Plex Media Server flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656; SSRF, URI handling and path-control weaknesses), an OS command injection in EG Secure Solutions SiteGuard Server Edition (CVE-2026-106931, vendor-scored CVSS 4.0 8.5), and the Siemens Software Center bug above. CISA’s alert does not give affected version ranges or per-CVE exploitation details, so check the catalog and vendor advisories for remediation guidance and due dates.

Source: CISA alert · WindowsForum summary

This brief covers the trailing ~48 hours (October 19–21, 2026).

Primary sources: PHP.net · Siemens ProductCERT SSA-580366 · CISA KEV alert