CVE-2026-96889

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

October 15, 2026

Last Seen

November 5, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical PHP2Shell and LiteLLM Vulnerabilities Expose Enterprises to Attacks72.8

In October 2026, multiple cybersecurity incidents highlighted severe vulnerabilities affecting organizations. The PHP project disclosed two critical remote code execution flaws, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated attackers to execute code on servers...

Critical SQL Injection Zero-Day in Arista VeloCloud Orchestrator Actively Exploited72.8

Arista Networks has patched a critical SQL injection vulnerability, CVE-2026-114625, in its VeloCloud Orchestrator (VCO) that allows authenticated users to escalate privileges to superuser status. The flaw, rated 9.9 on the CVSS scale, has been actively exploited in the wild, affecting on-premises d...

Critical PHP Vulnerabilities Exploited Before Public Disclosure72.8

Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were exploited before their public disclosure on October 21, 2026. Amazon Threat Intelligence reported that attempts to exploit these vulnerabilities began on October 17, 2026, targeting its MadPot honeypot network....

Next.js Releases Security Update for RCE Vulnerabilities72.0

On October 14, 2026, Vercel released an out-of-band security update for Next.js, addressing two unauthenticated remote code execution (RCE) vulnerabilities and a high-severity denial-of-service flaw. The update, available in versions 16.4.1 and 15.5.28, fixes issues with React Server Components and...