This brief covers October 19–21, 2026. Items were checked against vendor advisories and primary sources; it is a quiet window, so the list is short.
PHP security team pre-announces an emergency release for two critical RCE flaws
PHP.net · October 20, 2026
PHP announced an upcoming security release, scheduled for Wednesday, October 21 at 14:00 UTC, addressing two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated CVSS v4.0 9.2 by PHP. Affected and fixed versions have not yet been published. Per BleepingComputer, details leaked ahead of the embargo, and watchTowr says it has not observed exploitation and is withholding technical details until patches ship. Neither flaw was reported as being in CISA’s KEV catalog at the time of reporting.
“We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.” — PHP security team
Source: PHP.net advisory · BleepingComputer
Siemens Software Center DLL flaw exploited in ClickFix malware attacks
Siemens ProductCERT · October 19, 2026
Siemens confirmed in-the-wild exploitation of CVE-2026-110936 (CVSS v4 8.4), a flaw in Siemens Software Center 3.5.8.7 where helper files were not validated before loading. Attackers paired a genuine, signed copy of the program with malicious DLLs to gain code execution, and Siemens ties the activity to the Romulus ClickFix delivery platform. The fix is version 4.0.9.8, and existing installs update automatically on next launch. The CVE is reported to be in CISA’s KEV catalog.
“Existing installations update automatically the next time they start.” — Siemens ProductCERT
Source: Siemens ProductCERT · SSA-580366 · SecurityWeek
Plex2Shell chain turns unpatched Plex Media Server into crypto miners
The Hacker News · October 19, 2026
Attackers are chaining four Plex Media Server flaws, CVE-2026-96652 (CVSS 5.3), CVE-2026-96654 (6.9), CVE-2026-96655 (5.3) and CVE-2026-96656 (8.6), for unauthenticated remote code execution, delivering an XMRig miner and a Linux proxy backdoor. The flaws were reported by Zach Main on July 27 and fixed in Plex Media Server 1.43.3.10861 (August 3); technical details were published October 16 and exploitation attempts followed a day later. The CVEs are reported to be in CISA’s KEV catalog.
“Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server” — The Hacker News
Source: The Hacker News · Plex release thread
Still developing
AOMEI Backupper update servers tampered with to deliver backdoor
ManageEngine Threat Analysis Lab · October 16, 2026 (BleepingComputer coverage October 19)
Attackers briefly altered AOMEI Backupper update and notification configuration on several dates between April and July 2026 (May 28, July 16 and July 20), delivering the CROSSROAD downloader and SHINYROAD backdoor. Google Threat Intelligence tracks the actor as UNC7017. AOMEI says it has classified the matter as high priority and upgraded its servers.
“A supply chain compromise via AOMEI Backupper abused a trusted delivery mechanism to deploy Radmin.” — ManageEngine Threat Analysis Lab
Source: ManageEngine · BleepingComputer
This brief covers the trailing ~48 hours (October 19–21, 2026).
Primary sources:
Pingback: PHP2Shell Follow-Up: Patches Out for CVE-2026-109618 and CVE-2026-109619, Exploitation Underway, What to Do Now | Scott Harvanek