This brief covers October 19–21, 2026. Items were checked against vendor advisories and primary sources; it is a quiet window, so the list is short.

PHP security team pre-announces an emergency release for two critical RCE flaws

PHP.net · October 20, 2026

PHP announced an upcoming security release, scheduled for Wednesday, October 21 at 14:00 UTC, addressing two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated CVSS v4.0 9.2 by PHP. Affected and fixed versions have not yet been published. Per BleepingComputer, details leaked ahead of the embargo, and watchTowr says it has not observed exploitation and is withholding technical details until patches ship. Neither flaw was reported as being in CISA’s KEV catalog at the time of reporting.

“We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.” — PHP security team

Source: PHP.net advisory · BleepingComputer

Siemens Software Center DLL flaw exploited in ClickFix malware attacks

Siemens ProductCERT · October 19, 2026

Siemens confirmed in-the-wild exploitation of CVE-2026-110936 (CVSS v4 8.4), a flaw in Siemens Software Center 3.5.8.7 where helper files were not validated before loading. Attackers paired a genuine, signed copy of the program with malicious DLLs to gain code execution, and Siemens ties the activity to the Romulus ClickFix delivery platform. The fix is version 4.0.9.8, and existing installs update automatically on next launch. The CVE is reported to be in CISA’s KEV catalog.

“Existing installations update automatically the next time they start.” — Siemens ProductCERT

Source: Siemens ProductCERT · SSA-580366 · SecurityWeek

Plex2Shell chain turns unpatched Plex Media Server into crypto miners

The Hacker News · October 19, 2026

Attackers are chaining four Plex Media Server flaws, CVE-2026-96652 (CVSS 5.3), CVE-2026-96654 (6.9), CVE-2026-96655 (5.3) and CVE-2026-96656 (8.6), for unauthenticated remote code execution, delivering an XMRig miner and a Linux proxy backdoor. The flaws were reported by Zach Main on July 27 and fixed in Plex Media Server 1.43.3.10861 (August 3); technical details were published October 16 and exploitation attempts followed a day later. The CVEs are reported to be in CISA’s KEV catalog.

“Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server” — The Hacker News

Source: The Hacker News · Plex release thread

Still developing

AOMEI Backupper update servers tampered with to deliver backdoor

ManageEngine Threat Analysis Lab · October 16, 2026 (BleepingComputer coverage October 19)

Attackers briefly altered AOMEI Backupper update and notification configuration on several dates between April and July 2026 (May 28, July 16 and July 20), delivering the CROSSROAD downloader and SHINYROAD backdoor. Google Threat Intelligence tracks the actor as UNC7017. AOMEI says it has classified the matter as high priority and upgraded its servers.

“A supply chain compromise via AOMEI Backupper abused a trusted delivery mechanism to deploy Radmin.” — ManageEngine Threat Analysis Lab

Source: ManageEngine · BleepingComputer

This brief covers the trailing ~48 hours (October 19–21, 2026).

Primary sources:

• PHP.net security announcement
• Siemens ProductCERT SSA-580366
• Plex Media Server release thread
• ManageEngine Threat Analysis Lab
• CISA KEV catalog

This brief covers the trailing ~48 hours (October 19–21, 2026). Items are drawn from primary sources (vendor advisories and CISA) and cross-checked against reputable outlets.

PHP Security Team gives advance notice of an emergency release for two critical flaws

PHP.net · October 20, 2026

The PHP security team announced a security release scheduled for Wednesday, October 21, 2026 at 14:00 UTC addressing two critical vulnerabilities, both rated CVSS v4.0 9.2. The identifiers are reported as CVE-2026-109618 and CVE-2026-109619 (remote code execution). PHP has not published affected or fixed versions ahead of the release; researchers at Sansec say the issues affect web servers running PHP 5.4 or later, and Tenable reports the team’s expected fixes land in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (unconfirmed until release). watchTowr told BleepingComputer the flaws are real and says it believes it reproduced CVE-2026-109618; Cloudflare’s CTO reported early attacks. Neither CVE was in CISA KEV at the time of research.

“We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.” — PHP security team, php.net

Source: PHP.net announcement · BleepingComputer · Sansec · Tenable

Siemens confirms active exploitation of Software Center DLL search-path flaw (CVE-2026-110936)

Siemens ProductCERT · Updated October 19, 2026

Siemens updated advisory SSA-580366 on October 19 for CVE-2026-110936, an uncontrolled search path (DLL loading) weakness in Siemens Software Center. All versions below V4.0.9.8 are affected; the advisory rates it CVSS v4.0 8.4 (v3.1 6.7) and the fix is V4.0.9.8 or later. SecurityWeek reports attackers paired a legitimate signed copy of Software Center with malicious DLLs delivered via ClickFix lures. The flaw was listed among six additions to CISA’s Known Exploited Vulnerabilities catalog on October 20.

“No Siemens system, product or update channel was breached to our knowledge.” — Siemens, as quoted by SecurityWeek

Source: Siemens SSA-580366 · SecurityWeek

CISA adds six vulnerabilities to the KEV catalog, including Plex Media Server and SiteGuard

CISA · October 20, 2026

CISA published an alert on October 20 adding six vulnerabilities to the Known Exploited Vulnerabilities catalog. Per WindowsForum’s summary of the alert, the entries are four Plex Media Server flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656; SSRF, URI handling and path-control weaknesses), an OS command injection in EG Secure Solutions SiteGuard Server Edition (CVE-2026-106931, vendor-scored CVSS 4.0 8.5), and the Siemens Software Center bug above. CISA’s alert does not give affected version ranges or per-CVE exploitation details, so check the catalog and vendor advisories for remediation guidance and due dates.

Source: CISA alert · WindowsForum summary

This brief covers the trailing ~48 hours (October 19–21, 2026).

Primary sources: PHP.net · Siemens ProductCERT SSA-580366 · CISA KEV alert

This brief covers October 17–19, 2026. It is a quieter window, and items are drawn from vendor and researcher primary sources, with outlet reporting linked alongside.

ConnectWise disables application identities after Microsoft 365 tenants compromised

ConnectWise · October 17, 2026

Unknown actors obtained unauthorized access to ConnectWise application identities and used them to sign in to customer Microsoft 365 tenants. ConnectWise says it first identified the issue on October 14, disabled seven application identities at 07:00 UTC on October 17, suspended Cloud Backup by revoking certificates, and took SaaS Security and Cloud Management offline. Huntress observed sign-in activity from the associated IP address against almost 1,000 Entra tenants, about 300 of them successful. Disabling the connections blocks new authentication but does not undo changes already made inside a tenant. No CVE has been assigned, and ConnectWise says it is not yet clear whether a product vulnerability contributed.

“Since implementing these mitigations, we have not observed successful threat activity in the environments we monitor.”
— ConnectWise advisory update, as quoted by The Hacker News

Source: The Hacker News · BleepingComputer · ConnectWise status page

OpenCode Console breach may have exposed customers’ OpenAI, Anthropic and Google API keys

OpenCode · October 17, 2026

An intruder reached a legacy system in OpenCode’s hosted Console, where workspaces store their own third-party provider keys. OpenCode emailed affected users on October 17; it says keys “may have been exposed” for about 1.4% of Console users and has not confirmed any were copied. Keys stored locally by the CLI and desktop apps are reportedly not affected. Some users report unauthorized provider charges, but those are individual claims. No CVE applies. Anyone with a provider key saved in the Console should rotate it. Vendor wording is as relayed by The Hacker News; the original X posts were not independently retrieved.

“Action Required: Potential provider key breach.”
— OpenCode notification email subject, as reported by The Hacker News

Source: The Hacker News · OpenCode on X

Still developing

SiteGuard Server Edition WAF command injection exploited in the wild (CVE-2026-106931)

JPCERT/CC (JVN) · October 14, 2026 · widely reported October 18

OS command injection (CWE-78) in SiteGuard Server Edition 2.20 and later, when the statistics function is enabled (the default). JVN scores it CVSS v4.0 8.5 and v3.0 7.8 and states exploitation in the wild has been confirmed; successful abuse runs commands as root or SYSTEM. Fixed in 8.00 Update 5 (Apache, Nginx, IIS) and 7.00 Update 6 (FreeBSD), with a file-replacement patch for versions that cannot be upgraded. The vendor advises downloading diagnostic information before patching, since remediation can erase attack traces. No KEV entry was confirmed in the sources reviewed.

“Abuse has already been confirmed.”
— SiteGuard vendor alert, as quoted by BleepingComputer

Source: JVN · SiteGuard alert · BleepingComputer

Drupal core and Entity List RCE flaws patched; exploits expected soon (CVE-2026-108097, CVE-2026-108099)

Drupal Security Team · October 14, 2026 · reported October 17

SA-CORE-2026-014 (CVE-2026-108097) is rated “Critical 19/25” by Drupal and affects core 8.9.0 through releases before 10.6.19, 11.3.19 and 11.4.10, plus Drupal 12 pre-releases before beta2. Drupal says core alone is not directly exploitable but serious exploit paths exist through contributed modules, one requiring no authentication. A companion Entity List module flaw, CVE-2026-108099, is fixed in 3.0.10. Drupal publishes no CVSS score for the core flaw, and no in-the-wild exploitation has been confirmed. Uninstalling the Field UI module is the stopgap if you cannot upgrade.

“At least one known exploit path does not require authentication.”
— Drupal SA-CORE-2026-014

Source: Drupal SA-CORE-2026-014 · SA-CONTRIB-2026-218 · BleepingComputer

Unpatched Broadcom WPS flaw allows root code execution from Wi-Fi range

Quentin Kaiser · October 16, 2026 · reported October 19

A long-standing bug in Broadcom’s proprietary WPS implementation lets an unauthenticated attacker in radio range leak memory and execute code without the network key. Affected chips include BCM3380, BCM3383 and BCM33834 (eCos) and BCM3390, BCM65xx and BCM68xx (Linux). Broadcom would not assign a CVE, none of the devices the researcher tested were patched, and no real-world exploitation has been reported. Replacement of unpatched hardware is the practical mitigation.

“Yet they refused to assign a CVE to this vulnerability or to communicate publicly about it”
— Quentin Kaiser

Source: Quentin Kaiser · The Hacker News

This brief covers the trailing ~48 hours (October 17–19, 2026).

Primary sources:

• JVN (JPCERT/CC) JVN88474777
• SiteGuard vendor alert
• Drupal SA-CORE-2026-014
• Drupal SA-CONTRIB-2026-218
• ConnectWise status page
• Quentin Kaiser research post

This brief covers October 15–17, 2026. Items are drawn from vendor advisories and primary reporting, with dates checked against the source pages. The window was quiet: one new, verified development, followed by a few still-active campaigns.

BeyondTrust discloses Remote Support authentication bypass exploited as a zero-day since August (CVE-2026-102764)

BeyondTrust · October 15, 2026

BeyondTrust published advisory BT26-05 for CVE-2026-102764, a critical (CVSS 9.3) authentication bypass in Remote Support (RS) that lets an unprivileged remote attacker perform file operations on an appliance. RS 26.2.3 and earlier are affected, and Privileged Remote Access shares the code and was patched as a precaution. BeyondTrust says first exploitation was August 29 and was contained September 28; patches shipped October 8 (SaaS and self-hosted). Google’s Mandiant/GTIG attributes the activity to Armory Castle (formerly UNC5221), a suspected China-nexus espionage group. Observed post-exploitation included web shells, a tunneler and log wiping. Shadowserver counts more than 1,400 exposed instances. KEV listing was not confirmed in the sources reviewed.

“We are aware of only a small number of impacted organizations at this time.” — Kelli Vanderlee, Google Threat Intelligence Group, via CyberScoop

Source: BeyondTrust advisory BT26-05 · BleepingComputer · CyberScoop

Still developing

Cisco Secure Email Gateway path traversal exploited for root (CVE-2026-76519)

Cisco · October 14, 2026

CVSS 9.8. A crafted attachment can let an attacker write files and run commands as root when File Reputation is enabled and Content Scanner Tools is older than 25.3.0.5525. Cisco says there are no workarounds; fixes are AsyncOS 16.5.0-780 or Content Scanner Tools 25.3.0.5525+. Added to CISA KEV on October 14 (federal deadline October 17).

“In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” — Cisco, via SecurityWeek

Source: SecurityWeek · Help Net Security

Palo Alto PAN-OS management interface RCE exploited (CVE-2026-0322)

Palo Alto Networks · October 14, 2026

CVSS 8.6. An authenticated attacker with network access to the management interface can execute code as root on PA-Series, VM-Series and Panorama; Cloud NGFW and Prisma Access are not affected. Fixes are available across supported PAN-OS branches, and there is no full workaround, so restrict management access to trusted internal IPs. Added to KEV October 14.

“Very limited exploitation has been observed targeting the Palo Alto Networks management interface” — Palo Alto Networks advisory, via BleepingComputer

Source: BleepingComputer

Windows Shell Mark-of-the-Web bypass exploited before patch (CVE-2026-96951)

Microsoft · October 13, 2026

CVSS 8.8. A Windows Shell security feature bypass that lets a crafted file evade Mark of the Web protections; exploited as a zero-day and fixed in October Patch Tuesday. Added to KEV October 13 (federal deadline October 16). No public PoC was documented.

Source: SOC Prime analysis · BleepingComputer

This brief covers the trailing ~48 hours (October 15–17, 2026).

Primary sources:

• BeyondTrust security advisories
• CISA KEV alert, October 14
• CISA KEV alert, October 13