Critical Vulnerabilities October 2026: The Black October Patch List

The critical vulnerabilities October 2026 brought were so many that the security press just calls it Black October. If you run PHP, Node.js, Plex, GitLab or WordPress, you have at least one thing to patch. If you run a mail gateway, a VPN or a remote support appliance, probably more.

This post covers October 9 to November 9, 2026. I went through the CISA Known Exploited Vulnerabilities (KEV) catalog (version 2026.11.06), the vendor advisories and NVD, and put everything critical in one list. For each one you get what it does, whether attackers are already using it, the fixed version and a command to check your own box.

Critical vulnerabilities October 2026 at a glance

Start at the top. The first block is what attackers are already using, according to CISA.

“Not yet” means not in KEV as of November 6. It doesn’t mean nobody is trying.

Actively exploited: patch these first

PHP2Shell (CVE-2026-109618, CVE-2026-109619)

The big one. Two memory bugs in PHP itself let an unauthenticated attacker run code on the web server with one crafted request. Calif reported it first on August 11, Wiz found it independently on August 19, and the details went public on October 21 together with the fix. At least one of the bugs goes all the way back to PHP 5.4. PHP scores both 9.2 on CVSS 4.0. NVD gives CVE-2026-109618 a 9.8. CISA added both to KEV on October 26 with a three-day deadline.

Fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older are end of life and get no official build. If you’re on those, this is your sign.

Check what you run. The CLI and the FPM binary can be different packages, so check both:

php -v
php-fpm8.3 -v

On Ubuntu and Debian the version number won’t match upstream. Distros backport the fix into their own version, so look for the CVE in the package changelog instead:

apt changelog php8.3-fpm | grep -m3 CVE-2026-1096

That one needs network access. Offline, grep the changelog that ships with the package:

zgrep -m3 CVE-2026-1096 /usr/share/doc/php8.3-fpm/changelog.Debian.gz

No output means you don’t have the fix yet. Ubuntu’s CVE tracker shows which package versions have it. Update and restart:

sudo apt update && sudo apt upgrade
sudo systemctl restart php8.3-fpm apache2

Swap in your PHP version and web server. The PHP security advisory lists stopgaps, like blocking multipart requests if your app doesn’t take uploads, but it’s clear that upgrading is the only complete fix. If you set up PHP with my LAMP stack guide, the packages are php8.x and libapache2-mod-php8.x, so apt upgrade covers them.

Fragnesia (CVE-2026-46300): from PHP2Shell to root

PHP2Shell gives an attacker a shell as www-data. Fragnesia turns that into root. It’s a Linux kernel bug in the XFRM ESP-in-TCP code, rated 7.8, so “only” High. It’s on this list because CISA’s KEV entry from October 28 names it in the PHP2Shell chain. Dream Security reported about 25 servers rooted this way across the US and East Asia, three of them at a US government-affiliated organization.

The fix is old: distro kernels released after May 13, 2026 have it. If your server hasn’t rebooted since spring, it’s still running the vulnerable kernel even if the new one is installed. Check what’s running against what’s installed:

uname -r
ls /boot/vmlinuz-*

If the running version is older than the newest installed one, reboot. If no newer one is installed:

sudo apt update && sudo apt full-upgrade
sudo reboot

This is the textbook case for least privilege. A web server user that can’t do much is a lot less fun to own. More on that in understanding the Linux root user.

Broccoli2Shell (CVE-2026-111497)

Also called Node2Shell and HTTP2Shell, depending on which affected project you heard about first. It’s an out-of-bounds write in Google’s Brotli decompression library, versions 1.0.3 to 1.2.0. A crafted compressed stream can crash the process, leak memory or run code. Google rates it 9.2. CISA added it to KEV on October 27.

Brotli is everywhere, so the fix comes in several packages:

Check each one you use:

node -v
pip show brotli brotlicffi 2>/dev/null | grep -E "^(Name|Version)"
dotnet --list-runtimes

Judge Brotli by the Node.js, .NET or Python package version, not by the library’s own version string. A patched Ubuntu still shows libbrotli1 1.1.0 because the fix is backported, and fixed Node.js releases still report Brotli 1.1.0 or 1.2.0 in process.versions.

For Node.js with nvm it’s one line. If you installed Node from my nvm guide:

nvm install 24.22.1
nvm alias default 24.22.1

If you installed Node with apt from the NodeSource setup, sudo apt update && sudo apt upgrade nodejs does it. For Python, pip install -U "brotli>=1.2.1". Then restart the apps and rebuild every Docker image that has an old node: or python: base. A patched host does nothing for a container that was built in September.

Plex2Shell (CVE-2026-96652, -96654, -96655, -96656)

Four Plex Media Server bugs that chain into code execution without a login: a server-side request forgery steals the admin token, then a planted library file runs code. Plex fixed it in early August in 1.43.3.10861. The write-up came on October 16, and attackers were dropping cryptominers the next day. KEV followed on October 20.

Plex reports its version without a login:

curl -s http://localhost:32400/identity

Look at the version attribute. Anything below 1.43.3.10861 needs an update. Most installs update themselves, but jails, NAS packages and pinned Docker tags often don’t. My guide on manually updating Plex covers the jail case. If your Plex server was exposed and outdated, check for processes that eat CPU and you didn’t start. That’s what the miners look like.

GitLab CVE-2026-97229 and CVE-2026-110264

Two separate unauthenticated RCEs, both rated 10.0 by GitLab, both in how GitLab handles regular expressions. CVE-2026-97229 affects 19.2 to 19.4, was fixed on October 12, and is in KEV since October 29. CVE-2026-110264 came on October 21 and affects every version since 7.0. Neither fix covers the other, so just go to the latest patch release:

19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13

sudo gitlab-rake gitlab:env:info | grep -A2 "GitLab information"
sudo apt update && sudo apt install gitlab-ee

Use gitlab-ce if that’s your edition. apt install pulls the newest release, which can be several minor versions ahead, so check GitLab’s upgrade path page first, or pin the patch release in your branch (for example gitlab-ee=19.2.9-ee.0). If you build your own images, on Alpine for example, you also need Ruby’s regex fix from October 23 (Ruby 3.3.13, 3.4.12 or 4.0.9). The GitLab 19.5.1 release notes have the details.

Nextcloud built-in CODE server (CVE-2026-110447)

If your Nextcloud runs Collabora Online through the “Built-in CODE Server” app (richdocumentscode), an attacker can inject OS commands through its proxy.php while the bundled CODE server isn’t running, for example after a restart, an upgrade or a crash. Exploited since September 10, KEV since October 23. On ARM servers the app is called richdocumentscodearm64. The fix is Collabora 26.4.303.

sudo -u www-data php occ app:list | grep -A1 richdocumentscode
sudo -u www-data php occ app:update richdocumentscode

Don’t use the office editor? Remove the app with sudo -u www-data php occ app:remove richdocumentscode. Disabling it is not enough, because proxy.php stays reachable. Collabora says so in the advisory.

Appliances: Cisco, BeyondTrust, Arista

You can’t apt upgrade these, but they’re the internet-facing boxes attackers love.

• Cisco Secure Email Gateway, CVE-2026-76519 (9.8): a crafted email attachment leads to a file write and root commands. Exploited as a zero-day and in KEV since October 14. Get the fixed AsyncOS and Content Scanner versions for your release from Cisco’s advisory.
• BeyondTrust Remote Support, CVE-2026-102764 (9.3): authentication bypass, exploited as a zero-day since August 29. On-prem versions 24.3.1 to 26.2.3 need patch BT26-05-RS. Older versions have to upgrade first. SaaS is already patched.
• Arista VeloCloud Orchestrator, CVE-2026-114625 (9.9): SQL injection that turns any logged-in user into a superuser. Fixed in 5.2.3.18, 6.1.3.10 and 6.4.2.12.

Exploited, rated High, still urgent

Not critical on paper, but in KEV and on hardware a lot of you run:

• WordPress Core CVE-2026-119977 (8.1): a race condition during core upgrades gives an unauthenticated attacker code execution. Affects 4.7 to 7.1.3, fixed in 7.1.4 on October 28 with backports. In KEV since November 3. Check with wp core version, update with wp core update.
• Ivanti Connect Secure CVE-2026-104935 (8.6): unauthenticated command execution, chained with two more bugs added on October 30. Go to 25.1.1.3 or 22.8R2.6.
• Palo Alto PAN-OS CVE-2026-0322 (8.6): authenticated RCE as root on the management interface. The fixed builds are per branch. Also, your management interface shouldn’t face the internet.
• Windows Shell CVE-2026-96951 (8.8): a Mark of the Web bypass. The only exploited zero-day in October’s Patch Tuesday.
• Cisco Secure Firewall ASA and FTD CVE-2026-76418 (8.6): an unauthenticated attacker can crash and reload the box through the SSL VPN. In KEV since October 29. Fixed builds are in Cisco’s advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75.
• SonicWall SonicOS SSLVPN CVE-2026-19868 (7.5): bypasses SAML login, including SAML-enforced MFA, with credentials for another login method. In KEV since November 6. Fixed in 7.3.4-7013 and 8.2.2-8015.

Critical, not exploited (yet)

React Server Components (GHSA-xqc2-xf4c-x3h3)

Published October 14, CVSS 9.5, unauthenticated RCE in the react-server-dom-* packages that Next.js and other React Server Components setups use. Exploitation needs a rare condition, but proof-of-concept code is public. It was fixed the same day in Next.js 16.4.1 and in react-server-dom-* 19.0.9, 19.1.10, 19.2.9 and 19.3.1. Go straight to Next.js 16.4.5 (or 15.5.29 on Next.js 15) to also get the November 3 fixes. I wrote a full beginner walkthrough: how to fix the React Server Components vulnerability.

Oracle Critical Patch Update (October 20)

More than 1,200 fixes. The two to care about are 9.8s that need no login: WebLogic Server CVE-2026-83399 over T3/IIOP (12.2.1.4, 14.1.1, 14.1.2, 15.1.1) and APEX CVE-2026-101521 over HTTPS. If T3 is reachable from outside your network, fix that too.

Microsoft October Patch Tuesday (October 13)

About 1,411 CVEs, the largest release Microsoft has ever shipped. The critical one for servers is the Active Directory Domain Services RCE, CVE-2026-70229. Patch your domain controllers first. November’s Patch Tuesday lands on November 10, so expect another round.

eMudhra: when the CA leaks its keys

No CVE, but a bad week for the web’s trust model. On October 17 a researcher recovered the private keys of eight eMudhra intermediate CAs, because they were generated with almost no randomness. Mozilla blocked them the same day, Chrome dropped the emSign ECC Root CA G3 on October 27, and eMudhra left the TLS business.

If your site uses an emSign certificate, get a new one from another CA. Check your chain:

openssl s_client -connect example.com:443 -showcerts </dev/null 2>/dev/null | grep -i emsign

Then update your trust store. Debian’s ca-certificates update from October 20 distrusts the emSign ECC Root CA G3, and Ubuntu shipped it on October 22 and November 2. Browsers block the leaked intermediates on their own.

sudo apt update && sudo apt install --only-upgrade ca-certificates

Older bugs that hit KEV this month

These were disclosed before October 9 but only showed up as exploited in this window. If you skipped them the first time:

• Atlassian Data Center products, CVE-2026-21589 (9.3): unauthenticated file read. KEV October 15.
• Ahsay AhsayCBS, CVE-2026-105134 (10.0) and CVE-2026-105133: an authentication bypass chained with a 10.0. Both in KEV since October 14.
• Adobe Commerce and Magento, CVE-2026-48356 (9.3): patched in July (APSB26-73), KEV October 27.

One more from just before the window: Citrix NetScaler ADC and Gateway, CVE-2026-107406 (9.5), a SAML memory overflow disclosed on October 8. It’s not in KEV yet, but NetScaler bugs rarely stay out for long. Patch it with the rest.

Why so many at once?

Mostly AI. Wiz says it found PHP2Shell with its own agent and commercial models, and the PHP advisory credits researchers from both Wiz and OpenAI. Microsoft says its record October release came from running AI tools on its own code. Bugs that sat in old C code for a decade are now cheap to find, for defenders and attackers alike.

Two more things made it worse. Some fixes sat in public repositories long before a release: the Brotli fix was reportedly committed in February. And CISA’s new BOD 26-04 gives federal agencies three days for many KEV entries, so a whole month of patching got squeezed into a few weeks.

And yes, everything ends in “2Shell” now. Someone built 2 Shell 2 Furious, a tracker of every shell-named bug since Shellshock, with the fair note that mocking the names doesn’t make the bugs less real. My favorite is Terminal2Shell, a parody advisory registered on October 24. Its “vulnerability” is that opening a terminal gives you a shell, rated CVSS 11.0 out of 10, with “Remove the keyboard” as a listed mitigation. It’s a joke, but it’s a good reminder to read the advisory, not the logo.

How I’d work through this list

1. Internet-facing first. Mail gateways, VPNs, remote support, anything with a login page on the internet. Those get scanned within hours of a disclosure.
2. KEV entries before CVSS scores. A 7.8 that’s being chained into root beats a 9.8 nobody can reach. The KEV catalog is free and filterable.
3. Know what you run. Most people with a VPS have PHP, Node.js or both somewhere. apt list --installed, docker ps and npm ls take a minute. A scanner like OpenVAS finds what you forgot about.
4. Patch, restart, rebuild. Package updates don’t reach running processes or old container images.
5. Then look for damage. Unknown processes, new cron jobs, new files in web roots, new admin users. A patch closes the door. It doesn’t kick out whoever already came in.

For the baseline that makes the next month less painful, see securing your Linux server.

Gotchas

• Distro version numbers lie. Ubuntu’s PHP 8.3 can have the PHP2Shell fix without saying 8.3.36. Check the changelog or Ubuntu’s CVE tracker, not the version string.
• End of life means no fix. PHP 8.1 and older, Node.js 20 and old .NET releases got nothing this month. That’s the actual risk on a lot of servers.
• Bundled copies. Brotli also ships inside apps and wheels you never installed on purpose. pip show checks Python. For the rest, check vendor advisories.
• Unattended upgrades don’t reboot by default. The kernel fix for Fragnesia only counts after a reboot.
• Pinned Docker tags. plexinc/pms-docker:1.42.2.10156-f737b826c stays vulnerable forever. Move the tag.

FAQ

What is Black October?

The nickname the security press gave October 2026, after PHP2Shell, Broccoli2Shell, Plex2Shell, the GitLab RCEs and the eMudhra CA leak all landed within a few weeks of each other, along with Microsoft’s largest Patch Tuesday ever.

Which October 2026 vulnerability should I patch first?

PHP2Shell, if you run PHP anywhere on the internet. It needs no login, it’s being exploited, and it chains with Fragnesia to root. After that, anything else in the exploited table that you run.

How do I know if a vulnerability is being exploited?

Check the CISA Known Exploited Vulnerabilities catalog. A CVE only lands there when there’s evidence of real attacks. Vendor advisories and threat reports from Wiz, watchTowr or Amazon often say it earlier.

Is Terminal2Shell a real vulnerability?

No. It’s a parody of vulnerability marketing. Its point is that a terminal running a shell is the whole idea of a terminal. The other 2Shell names in this post are real.

Does updating packages fix running services?

No. Restart the service (systemctl restart), rebuild containers from patched base images, and reboot for kernel fixes.

Related guides

• How to fix the React Server Components vulnerability
• Securing your Linux server
• Understanding the Linux root user
• Install OpenVAS on Kali Linux
• Vulnerability scanning with Metasploit
• sudo-rs on Ubuntu 26.04

Your turn

What did Black October hit on your side? PHP on a forgotten VPS, a Plex server nobody updated, a GitLab that was “internal only”? Tell me on X at @StefanRows. And if I missed a critical one from this window, send it over and I’ll add it.