Recordedfuture October 2026 CVE Landscape Highlights Critical Vulnerabilities
Article Content
- •82 high-impact vulnerabilities identified in October 2026, with 52 rated Very Critical.
- •CVE-2026-109618 and CVE-2026-109619 are actively exploited PHP2Shell vulnerabilities.
- •Citrix and Microsoft account for approximately 15% of the reported vulnerabilities.
In October 2026, Insikt Group identified 82 high-impact vulnerabilities, with 52 rated as Very Critical. Among these, CVE-2026-109618 and CVE-2026-109619, both PHP2Shell vulnerabilities, were published on October 21 and added to CISA's KEV catalog on October 26, indicating. These vulnerabilities primarily affect products from Citrix and Microsoft, which together account for 15% of the total vulnerabilities reported. The vulnerabilities were detected through various sources, including CISA's KEV catalog, open-source reports, and honeypot data. Notably, 37 of the vulnerabilities enable remote code execution (RCE). The report also mentions exploitation activities linked to the Lazarus Group and other ransomware operations targeting various platforms and tools.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Qilin, Lazarus Group and CVE-2024-47575 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which vendors are affected by these vulnerabilities?
What is the severity of CVE-2026-109618 and CVE-2026-109619?
How can organizations protect themselves?
Continue Reading
Ransomware Attack Exposes Burnaby School District Data on Dark Web The Burnaby School District in British Columbia experienced a ransomware attack on September 21, 2026, allegedly perpetrated by the Russian hacker group Qilin. The group claims to have posted sensitive data, including personal information of students and staff, on the dark web. The school district confirmed that the… 
Hackers Exploit Firewalls, Compromise 70,000 Credentials Globally A large-scale cyber campaign has targeted exposed network edge devices, specifically Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls, leading to the compromise of over 70,000 credentials. The threat actor, known as k0t, has been active since October 2025 and is linked to ransomware groups like Qilin…