Updated: 21 October 2026. This is a time-sensitive snapshot, not an exhaustive list of every newly published CVE. The examples below were selected because public advisories report critical impact or active exploitation. Confirm affected versions and remediation steps in the linked vendor guidance before making changes.

This week's priorities

For most teams, patching should not be ordered by CVSS score alone. A vulnerability that is actively exploited on an internet-facing system can be more urgent than a higher-scoring issue in an isolated test environment.

  • Priority 1: actively exploited vulnerabilities on exposed or business-critical assets.
  • Priority 2: critical remote-code-execution issues in services that accept untrusted requests.
  • Priority 3: high-impact flaws in internal systems, prioritised by reachability, privilege and business impact.

PHP: two critical vulnerabilities

On 21 October 2026, PHP maintainers released updates addressing CVE-2026-109618 and CVE-2026-109619. CISA described the issues as critical and urged organizations to update immediately. The reported risk includes unauthenticated remote code execution in PHP installations serving web requests.

The fixed versions cited in the advisory are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Check your exact branch, deployment method and vendor packaging; distributions may backport fixes without matching the upstream version string.

  • Inventory PHP versions across web servers, containers, serverless functions and CI images.
  • Upgrade to a fixed release supported by your vendor.
  • Rebuild and redeploy immutable images; do not assume updating a host updates running containers.
  • Review logs for suspicious requests and investigate indicators of compromise if exposure existed before patching.

CISA alerts and advisories · PHP official site

New entries in CISA's Known Exploited Vulnerabilities catalog

On 20 October 2026, CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog based on evidence of exploitation. Check whether any affected products are present in your environment:

  • CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 · Plex Media Server: multiple issues including server-side request forgery and path-related weaknesses.
  • CVE-2026-106931 · EG Secure Solutions SiteGuard Server Edition: OS command injection.
  • CVE-2026-110936 · Siemens Software Center: uncontrolled search path element.

Do not infer that every deployment is exploitable simply because a product is installed. Match the exact product and version against the vendor advisory, then determine exposure, available fixes and compensating controls. However, KEV inclusion is a strong reason to accelerate triage.

Open CISA's KEV catalog · CISA's 20 October announcement

Other high-risk issues to review

The French national cybersecurity agency CERT-FR's weekly bulletin for 12–18 October 2026 highlighted several high-impact vulnerabilities. Review these products if they are part of your estate:

  • CVE-2026-76519 · Cisco AsyncOS: rated 9.8 in the cited bulletin, with remote code execution and security-policy bypass; the bulletin marks it as exploited.
  • CVE-2026-0322 · Palo Alto Networks PAN-OS: rated 8.6 in the bulletin, with remote code execution; the bulletin marks it as exploited.
  • CVE-2026-97229 · GitLab CE/EE: rated 10 in the bulletin, with remote code execution. Check the exact affected release and vendor patch guidance.
  • CVE-2026-96951 · Microsoft Windows: rated 8.8 in the bulletin; CISA added it to KEV on 13 October.

These examples are not a substitute for vendor-specific advisories. Verify current affected versions, patch availability and exploitation status before assigning remediation deadlines.

Read the CERT-FR bulletin · Check CISA KEV

A practical triage checklist

  1. Find assets: query your CMDB, cloud inventory, container registry, SBOMs and endpoint tooling for affected products and versions.
  2. Confirm exposure: identify public endpoints, reachable management interfaces, affected workloads and privilege boundaries.
  3. Check exploitation: consult CISA KEV, CERT-FR and the product vendor's advisory not just the CVSS score.
  4. Assign an owner and deadline: record the risk, business service, mitigation, target date and exception approver.
  5. Patch and validate: deploy the fix, restart or rebuild where required, then verify the running version and service health.
  6. Look for compromise: if a system was exposed while vulnerable, patching alone does not prove it was not breached. Review logs and investigate suspicious activity.
# Example: identify PHP versions in a Linux environment
php -v

# Example: list running containers (review images and tags)
docker ps --format '{{.Image}} {{.Names}}'

# Example: inspect installed packages on Debian/Ubuntu
dpkg-query -W 'php*' 2>/dev/null

Adapt these checks to your environment. They are inventory starting points, not proof that a system is vulnerable or safe.

Sources and update cadence

Because vulnerability status changes quickly, bookmark authoritative sources and recheck them during incident response:

Set a regular review cadence, but allow urgent advisories to trigger out-of-band action. The goal is not to patch every item in a feed at once; it is to quickly identify which vulnerabilities create the most credible risk to your organization and prove that remediation worked.

In short

Start with active exploitation, public exposure and business impact. As of 21 October 2026, the PHP fixes and the latest CISA KEV additions deserve immediate review wherever the affected products are deployed. Keep the scope precise, verify fixes against primary advisories, and investigate potentially exposed systems rather than treating a successful patch as the end of the incident.

Book a Cloud Security Review for vulnerability triage and patch governance and we will help improve asset inventory, patching and security monitoring across your environments.