October 2026 CVE Landscape​​ ​

In October 2026, Insikt Group¬ģ identified 82 high-impact vulnerabilities to prioritize for remediation , 52 of which had a Very Critical Recorded Future Risk Score. This represents a 13% decrease from the 94 vulnerabilities reported in September.‚Äč‚Äč‚Ää‚Äč

36 of October‚Äôs high-impact CVEs were surfaced through the US Cybersecurity and Infrastructure Security Agency (CISA)‚Äôs Known Exploited Vulnerabilities (KEV) catalog, 33 were reported in open sources and validated by Insikt Group, and 13 were exclusively surfaced through honeypot data.‚Äč‚Äč‚Ää‚Äč

The 82 vulnerabilities in this report affected products from 51 vendors, with Citrix and Microsoft together accounting for approximately 15% of the vulnerabilities. The remaining exposure spanned network edge and security management appliances; operating systems and endpoint software; collaboration, content management, and enterprise platforms; and artificial intelligence (AI), developer, and automation tools.‚Äč‚Äč‚Ää‚Äč

Insikt Group created a Nuclei template to detect the two PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Insikt Group also published templates for CVE-2026-87902 (WordPress) and CVE-2026-86124 (AutoAgent). These are available to customers in the Recorded Future Intelligence Operations Platform.‚Äč‚Äč‚Ää‚Äč

Quick reference: October 2026 vulnerability table‚Äč‚Äč‚Ää‚Äč

All 69 vulnerabilities below were actively exploited or operationally weaponized in October 2026.‚Äč‚Äč‚Ää‚Äč This table does not include the 13 CVEs that were exclusively surfaced through honeypot data, which are available to Recorded Future Intelligence Platform customers via the CVE Monthly report.‚Äč‚Äč‚Ää‚Äč šĽ•šłč„ĀģŤ°®„Āę„ĀĮ„ÄĀInsikt Group„ĀĆÁČĻŚģö„Āó„ĀüŚÖ¨ťĖčPoCÔľąś¶āŚŅĶŚģüŤ®ľÔľČ„Āģšĺč„āāÁ§ļ„Āē„āĆ„Ā¶„ĀĄ„Āĺ„Āô„Äā„Āď„āĆ„āČ„Āģś¶āŚŅĶŚģüŤ®ľÔľąPoCԾȄĀĮ„ÄĀś≠£ÁĘļśÄß„āĄśúČŚäĻśÄß„Āę„Ā§„ĀĄ„Ā¶ś§úŤ®ľ„Āē„āĆ„Ā¶„ĀĄ„Āĺ„Āõ„āď„ÄāŤĄÜŚľĪśÄßÁģ°ÁźÜ„ÉĀ„Éľ„Ɇ„ĀĮ„ÄĀ„ÉÜ„āĻ„Éą„āíŚģüśĖĹ„Āô„āčŚČć„Āę„ÄĀPoCÔľąś¶āŚŅĶŚģüŤ®ľÔľČ„ĀģŚ¶•ŚĹďśÄß„āíśÖéťáć„ĀꜧúŤ®ľ„Āô„āčŚŅÖŤ¶Ā„ĀĆ„Āā„āä„Āĺ„Āô„Äā‚Äč‚Äč‚Ää‚Äč

Ť°®1:‚Äč‚Äč‚Ää‚Äč List of vulnerabilities that were actively exploited in October 2026 based on Recorded Future data (excluding honeypot-sourced CVEs).‚Äč‚Äč‚Ää‚Äč

Key trends: October 2026‚Äč‚Äč‚Ää‚Äč

PHP2Shell reporting covered confirmed honeypot shell execution, a Fragnesia chain yielding root access on 25 servers, and Potassium-associated payload attempts. Other PHP2Shell activity involved suspected preparations for a North Korean attack, which was assessed with moderate confidence as linked to the Lazarus Group. Other exploitation activity this month included Longlegs deploying Warlock ransomware; ransomware groups exploiting PAN-OS; CL-STA-0954 targeting Fortinet products for data theft; PEERSTITCH deployment; Integrity Technology Group-enabled espionage; CyberXero‚Äôs AI-assisted exploitation; and ClingSTUN deployment.‚Äč‚Äč‚Ää‚Äč

37 of the 82 vulnerabilities enabled remote code execution (RCE). Collaboration, content-management, and enterprise platforms were the most affected product type, with 12 vulnerabilities. Microsoft had the largest vendor , with three vulnerabilities.‚Äč‚Äč‚Ää‚Äč

Insikt Group identified public proof-of-concept (PoC) exploits or scanners for 37 of the 82 vulnerabilities in this report.‚Äč‚Äč‚Ää‚Äč

The most common weakness class was CWE-78 (OS Command Injection), with eight vulnerabilities, followed by CWE-287 (Improper Authentication), with seven. CWE-22 (Path Traversal) and CWE-77 (Command Injection) each affected six vulnerabilities.‚Äč‚Äč‚Ää‚Äč

10 of the 82 vulnerabilities were at least five years old, and the oldest was approximately 16 years old.‚Äč‚Äč‚Ää‚Äč

Trend analysis‚Äč‚Äč‚Ää‚Äč

PHP2Shell exploitation enables root access and internal pivoting‚Äč‚Äč‚Ää‚Äč

In October, two vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619 (collectively referred to as ‚ÄúPHP2Shell‚ÄĚ), drew attention from threat actors, who also chained them with CVE-2026-46300, a Linux kernel vulnerability known as Fragnesia. Following their disclosure, Insikt Group published multiple notes and detection rules involving PHP2Shell in October. Highlights from our coverage include:‚Äč‚Äč‚Ää‚Äč

Root access and internal pivoting: A TTP Instance detailed a campaign chaining CVE-2026-109618 (PHP) and CVE-2026-109619 (PHP) with CVE-2026-46300 (Linux kernel), also known as Fragnesia. Dream Research reported root access on 25 servers, including systems in a US government-affiliated environment. PHP2Shell provided initial access, and Fragnesia enabled privilege escalation. The actor deployed web shells, stole configurations, credentials, and private keys, and maintained reverse Secure Shell (SSH) tunnels to internal systems, enabling service-account password decryption and Active Directory enumeration. Domain-account creation was attempted but not confirmed.‚Äč‚Äč‚Ää‚Äč

Technical analysis and exploit development: A separate TTP Instance explained PHP2Shell‚Äôs memory-lifecycle failures enabling unauthenticated remote code execution (RCE), highlighting Apache mod_php exposure and unvalidated early PoCs. Separate TTP Instances covering reports from SOCRadar and AkatsukiLegion described actor-staged exploits, prerequisite checks, and a memory-leak-to-command-execution chain.‚Äč‚Äč‚Ää‚Äč

Threat actor pre-positioning: Two other TTP Instances covered PHP2Shell tooling on an extortion actor‚Äôs staging server and CYFIRMA‚Äôs assessment of suspected North Korean preparations using 21 compromised nodes to check 216 hosts. CYFIRMA assessed a Lazarus Group connection with moderate confidence. Neither earlier shared-hosting intrusions nor attack preparations established a successful PHP2Shell compromise.‚Äč‚Äč‚Ää‚Äč

Botnet activity: A TTP Instance covering Arctic Wolf and Cisco Talos described probes and payload-download attempts associated with Potassium, a Mirai-derived botnet. In separate TTP Instances covering Linux bots reported by Joe Security and Nextron Research, Insikt Group corroborated remote-shell, evasion, and denial-of-service capabilities in the former, and PHP2Shell testing, scanning, downloads, and persistence in the latter. These findings did not confirm successful malware delivery through PHP2Shell.‚Äč‚Äč‚Ää‚Äč

Detection rule coverage: Insikt Group created Sigma rules for Linux and Windows to detect web or PHP workers spawning shells, including PowerShell, and Suricata and Snort rules for multipart session-ID and upload-progress requests. Network detection requires visible HTTP bodies. Correlate these alerts with process creation, worker errors, and outbound activity because individual matches can be benign.‚Äč‚Äč‚Ää‚Äč

Separate PHP vulnerability: A TTP Instance reported on CVE-2026-115560 (PHP), a vulnerability distinct from PHP2Shell that could enable unauthenticated RCE in applications switching session serializers while upload progress is enabled. No in-the-wild exploitation was established at the time of publication. PHP recommended disabling session upload progress pending a separate fix; the initial PHP2Shell patches did not address this vulnerability.‚Äč‚Äč‚Ää‚Äč

A Validated Intelligence Event detailed Longlegs, also known as Storm-2603, exploiting CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771 (all related to SharePoint Server). Symantec reported that the actor used the ToolShell chain to access critical infrastructure organizations, move laterally, and deploy Warlock ransomware. The intrusion included domain-account privilege changes, credential spraying, and remote-access tunnels. The actor disabled endpoint protections and staged ransomware in a domain replication path, allowing normal replication to propagate the binaries between domain controllers.‚Äč‚Äč‚Ää‚Äč

A Vulnerability Intelligence note linked exploitation of CVE-2026-0257 (PAN-OS) to Qilin, Settra, and Tarnished Scorpius, which overlaps with activity Recorded Future tracks as INC Ransom. The reporting described the use of BloodHound and SharpHound to examine Active Directory relationships.‚Äč‚Äč‚Ää‚Äč

A separate Vulnerability Intelligence note described Longlegs exploiting CVE-2025-1055 ( K7 Anti-Malware ) through the signed K7RKScan driver to terminate protected security processes. Although this activity is also linked to Longlegs, it is separate from the SharePoint exploitation activity described above.‚Äč‚Äč‚Ää‚Äč

A Validated Intelligence Event linked CL-STA-0954 to exploitation of CVE-2024-47575 (FortiManager) and CVE-2025-61624 (FortiOS). Unit 42 reported command execution, theft of sensitive data associated with more than 500 managed FortiGate firewalls, traffic interception, and deployment of PEERSTITCH.‚Äč‚Äč‚Ää‚Äč

Additional trends and analyses from October are available to Recorded Future customers.‚Äč‚Äč‚Ää‚Äč

Ť°ĆŚčē„āíŤĶ∑„Āď„Āô‚Äč‚Äč‚Ää‚Äč

ÁíįŚĘÉ„āĄ„Éô„É≥„ÉÄ„Éľ„ÄĀ„āĶ„Éó„É©„ā§„ɧ„Éľ„ĀģŤĄÜŚľĪśÄß„ĀęťĖĘ„Āô„āč„āŅ„ā§„Ɇ„É™„Éľ„Āč„Ā§ťĖĘťÄ£śÄß„Āģťęė„ĀĄśÉÖŚ†Ī„ĀĮ„ÄĀ„É™„āĻ„āĮŤĽĹśłõ„Āꚳ挏Įś¨†„Āß„Āô„ÄāRecorded Future„ĀĆ„ÉĀ„Éľ„Ɇ„ĀģŚŹĮŤ¶ĖśÄߌźĎšłä„ÄĀŚäĻÁéጟϚłä„ÄĀŤá™šŅ°„ĀęśļÄ„Ā°„ĀüśĄŹśÄĚśĪļŚģö„ā팏ĮŤÉĹ„Āę„Āô„āč„Āď„Ā®„Āß„ÄĀ„Ā©„Āģ„āą„ĀÜ„Āę„āĶ„ÉĚ„Éľ„Éą„Āß„Āć„āč„Āč„āí„ĀĒŤ¶ß„ĀŹ„Ā†„Āē„ĀĄ„Äā‚Äč‚Äč‚Ää‚Äč

ŤĄÜŚľĪśÄß ŚĄ™ŚÖąť†ÜšĹ暼ė„ĀĎ ‚Äď ŤĄÜŚľĪśÄß„ĀĮśā™ÁĒ®„ĀģŚŹĮŤÉĹśÄß„ĀęŚüļ„Ā•„ĀŹ ŤĄÜŚľĪśÄß ‚Äď Śćė„Ā™„āčś∑ĪŚąĽ„Āē„Āß„ĀĮ„Ā™„ĀŹ„ÄĀ śā™ÁĒ®„Āē„āĆ„āč„É™„āĻ„āĮ„Ā®„ĀĚ„Āģś∑ĪŚąĽŚļ¶„āíŚģĻśėď„Āęśä䜏°„Āß„Āć„ÄĀ„É™„āĘ„Éę„āŅ„ā§„Ɇ„ĀģÁä∂ś≥Ā„ĀęŚŅú„Āė„Āü„ā§„É≥„ÉÜ„É™„āł„āß„É≥„āĻ„āíśīĽÁĒ®„Āô„āč„Āď„Ā®„Āß„ÄĀŤŅÖťÄü„Āč„Ā§Ťá™šŅ°„āíśĆĀ„Ā£„Ā¶śĄŹśÄĚśĪļŚģö„ā퍰ƄĀĄ„ÄĀťá捶Ā„Ā™ÁģáśČÄ„Āę„ÉĎ„ÉÉ„ÉĀ„āíťĀ©ÁĒ®„Āó„ÄĀśĒĽśíÉ„āíśú™ÁĄ∂„Āęťė≤„Āź„Āď„Ā®„ĀĆ„Āß„Āć„Āĺ„Āô„Äā‚Äč‚Äč‚Ää‚Äč

Attack Surface Intelligence ‚Äď ÁČĻŚģö„ĀģCVE„ĀęŚĮĺ„Āó„Ā¶ŤĄÜŚľĪ„Ā™„ā§„É≥„āŅ„Éľ„Éć„ÉÉ„ÉąťĖĘťÄ£Ť≥áÁĒ£„āíÁČĻŚģö„Āó„Āĺ„Āô„ÄāAttack Surface Intelligence ÁĶĄÁĻĒ„ĀģŚ§ĖťÉ®„Āč„āČŤ¶ĖÁāĻ„ā휏źšĺõ„Āó„ÄĀśú™Áü•„ĀģŤ≥áÁĒ£„ÄĀŤĄÜŚľĪśÄß„ÄĀ„Āĺ„Āü„ĀĮŤ™§„Ā£„ĀüŤ®≠Śģö„ĀģŤ≥áÁĒ£„āíÁ©ćś•ĶÁöĄ„ĀęÁôļŤ¶č„Āó„ÄĀŚĄ™ŚÖąť†ÜšĹć„ā횼ė„ĀĎ„āč„ÄĀŚĮĺŚŅú„Āô„āč„Āģ„ĀęŚĹĻÁęč„Ā°„Āĺ„Āô„Äā‚Äč‚Äč‚Ää‚Äč

„āĶ„Éľ„ÉČ„ÉĎ„Éľ„ÉÜ„ā£„É™„āĻ„āĮ ‚Äď „Éô„É≥„ÉÄ„Éľ„āĄ„ÉĎ„Éľ„Éą„Éä„Éľ„Āģ„āĽ„ā≠„É•„É™„ÉÜ„ā£„ÉĚ„āĻ„ÉĀ„É£„Éľ„ā팧ĖťÉ®„Āč„āČśä䜏°„Āó„Āĺ„Āó„āá„ĀÜ„Äā „ā§„É≥„āŅ„Éľ„Éć„ÉÉ„ÉąŚĮĺŚŅú„ā∑„āĻ„É܄Ɇ„ĀģŤĄÜŚľĪśÄß„āíŤŅÖťÄü„Āꍩēšĺ°„Āß„Āć„āčŤÉĹŚäõ„Āę„āą„āä„ÄĀśôāťĖď„Āģ„Āč„Āč„ā荙ŅśüĽ„āĄ„Éô„É≥„ÉÄ„Éľ„Ā®„ĀģťÄ£ÁĶ°„āĶ„ā§„āĮ„Éę„āíśéíťô§„Āó„Āĺ„Āó„āá„ĀÜ„Äā‚Äč‚Äč‚Ää‚Äč

Insikt Group¬ģ ‚Äď Recorded Future„ĀģŚįāťĖÄŚģ∂„ÉĀ„Éľ„Ɇ„Āß„Āā„āčInsikt„āį„Éę„Éľ„Éó¬ģ„Āę„āą„āčśĖį„Āü„Ā™ŤĄÜŚľĪśÄß„āĄ„Éą„ɨ„É≥„ÉČ„ĀęťĖĘ„Āô„āčÁ訌憄ɨ„ÉĚ„Éľ„Éą„Āę„āĘ„āĮ„āĽ„āĻ„Āß„Āć„Āĺ„Āô„ÄāInsikt Group¬ģ„ĀĆšĹúśąź„Āó„Āü„ÄĀÁČĻŚģö„ĀģCVE„ĀęŚĮĺŚŅú„Āó„ĀüNuclei„ÉÜ„É≥„Éó„ɨ„Éľ„Éą„āí„ÉÄ„ā¶„É≥„É≠„Éľ„ÉČ„Āó„Ā¶„ÄĀŚģüťöõ„Āęśā™ÁĒ®„Āē„āĆ„Ā¶„ĀĄ„ā荥܌ľĪśÄß„ā휧úŚáļ„Āó„Ā¶„ĀŹ„Ā†„Āē„ĀĄ„Äā‚Äč‚Äč‚Ää‚Äč

Insikt Group¬ģ„Āę„Ā§„ĀĄ„Ā¶‚Äč‚Äč‚Ää‚Äč

Recorded Future „ĀģŤĄÖŚ®Ā„É™„āĶ„Éľ„ÉĀťÉ®ťĖÄ„Āß„Āā„āč Insikt Group „ĀĮ„ÄĀśĒŅŚļú„ÄĀś≥ēŚü∑Ť°Ćś©üťĖĘ„ÄĀŤĽć„ÄĀŤęúŚ†Īś©üťĖĘ„Āęś∑Ī„ĀĄÁĶĆť®ď„āíśĆĀ„Ā§„āĘ„Éä„É™„āĻ„Éą„Ā®„āĽ„ā≠„É•„É™„ÉÜ„ā£Á†ĒÁ©∂ŤÄÖ„Āßśßčśąź„Āē„āĆ„Ā¶„ĀĄ„Āĺ„Āô„ÄāŚĹľ„āČ„ĀģšĹŅŚĎĹ„ĀĮ„ÄĀ„ĀäŚģĘśßė„Āģ„É™„āĻ„āĮ„ā퍼Ŝłõ„Āó„ÄĀŚÖ∑šĹďÁöĄ„Ā™śąźśěú„āíŚģüÁŹĺ„Āó„ÄĀ„Éď„āł„Éć„āĻ„Āģšł≠śĖ≠„āíťė≤„Āź„ā§„É≥„ÉÜ„É™„āł„āß„É≥„āĻ„āíÁĒü„ĀŅŚáļ„Āô„Āď„Ā®„Āß„Āô„Äā‚Äč‚Äč‚Ää‚Äč

ťĖĘťÄ£„É™„āĹ„Éľ„āĻ‚Äč‚Äč‚Ää‚Äč

„āĶ„ā§„Éź„Éľ„āĽ„ā≠„É•„É™„ÉÜ„ā£śą¶Áē•„ā팾∑ŚĆĖ„Āô„āč„Āü„āĀ„ĀģŚįāťĖÄŚģ∂„ĀģśīěŚĮü„ÄĀ„ɨ„ÉĚ„Éľ„Éą„ÄĀ„ÉĄ„Éľ„Éę„āí„ĀĒŤ¶ß„ĀŹ„Ā†„Āē„ĀĄ„Äā‚Äč‚Äč‚Ää‚Äč