SecOraLens
CriticalRansomware

October 2026 CVE Landscape

Recorded Future·Source published ·1 min read

What happened?

In October 2026, Insikt Group® identified 82 high-impact vulnerabilities to prioritize for remediation, 52 of which had a Very Critical Recorded Future Risk Score. This represents a 13% decrease from the 94 vulnerabilities reported in September. 36 of October’s high-impact CVEs were surfaced through the US Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, 33 were reported in open sources and validated by Insikt Group, and 13 were exclusively surfaced through honeypot data.

Key details

  • Insikt Group identified 82 high-impact vulnerabilities in October 2026, with 52 rated Very Critical by Recorded Future Risk Score.
  • The 82 vulnerabilities affected products from 51 vendors, with Citrix and Microsoft together accounting for about 15 percent of the total.
  • Thirty-six of the high-impact CVEs appeared in the CISA Known Exploited Vulnerabilities catalog, 33 were validated from open sources, and 13 came exclusively from honeypot data.
  • PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 were chained with the Fragnesia Linux kernel flaw to achieve root access on 25 servers, including a US government-affiliated environment.
  • Longlegs (Storm-2603) exploited multiple SharePoint Server vulnerabilities using the ToolShell chain to deploy Warlock ransomware and move laterally in critical infrastructure organizations.
  • The most common weakness classes were CWE-78 (OS Command Injection) with eight vulnerabilities and CWE-287 (Improper Authentication) with seven.

Affected

  • Collaboration, content management, and enterprise platforms were the most affected product type with 12 vulnerabilities.
  • Network edge and security management appliances, operating systems, endpoint software, AI, developer, and automation tools were also affected.

Fixes and mitigations

  1. PHP recommended disabling session upload progress pending a separate fix for CVE-2026-115560, which was not addressed by the initial PHP2Shell patches.

What to look for

  • Web or PHP workers spawning shells, including PowerShell, detected via Sigma rules.
  • Multipart session-ID and upload-progress requests detected via Suricata and Snort rules.
  • Potassium botnet probes and payload-download attempts associated with PHP2Shell.
  • Actor-staged exploits, prerequisite checks, and memory-leak-to-command-execution chains for PHP2Shell.
  • Reverse SSH tunnels to internal systems enabling service-account password decryption and Active Directory enumeration.

Summarised by SecOraLens from Recorded Future. Always read the original source before acting. How SecOraLens verifies advisories.

Back to all advisories