Black October 2026: Critical Cybersecurity Vulnerabilities and Active Threats

October 2026 has brought several serious cybersecurity disclosures involving web servers, network infrastructure, email security gateways, enterprise software, and media servers. Multiple vulnerabilities have been reported as actively exploited, while others allow attackers to bypass authentication, execute arbitrary code, or disrupt critical services. This roundup covers the specific vulnerabilities and threats reported during October, their technical impact, affected products, and recommended remediation steps.

Summary

Major cybersecurity threats reported in October 2026 include PHP2Shell (CVE-2026-109618 and CVE-2026-109619), a critical Cisco SD-WAN authentication bypass, a Fortinet FortiMail path traversal vulnerability, actively exploited Citrix NetScaler flaws, the Plex2Shell vulnerability chain, and a Siemens Software Center DLL side-loading vulnerability. Microsoft also released its October security updates addressing more than 1,400 reported vulnerabilities. Organizations should prioritize flaws with confirmed exploitation, identify affected systems, and apply the relevant vendor security updates.

Table of Contents

1. PHP2Shell: Critical PHP Remote Code Execution Vulnerabilities
2. Cisco Catalyst SD-WAN Manager: Authentication Bypass
3. Fortinet FortiMail: Critical Path Traversal Vulnerability
4. Citrix NetScaler: Actively Exploited Vulnerabilities
5. Microsoft October 2026 Patch Tuesday
6. Plex2Shell: Multiple Plex Media Server Vulnerabilities
7. Siemens Software Center: DLL Side-Loading Attacks
8. EG Secure Solutions SiteGuard: OS Command Injection
9. Additional October Vulnerabilities Requiring Attention
10. Priority Remediation Checklist
11. Frequently Asked Questions

1. PHP2Shell: Critical PHP Remote Code Execution Vulnerabilities

Disclosure date: October 21, 2026
CVE identifiers: CVE-2026-109618 and CVE-2026-109619
Severity: Critical
Primary impact: Remote code execution
Exploitation status: Public proof-of-concept exploits reported; exploitation risk is high.

The PHP security team released patches for two critical vulnerabilities that could allow unauthenticated attackers to execute arbitrary code on vulnerable servers.

The vulnerabilities, commonly referred to as PHP2Shell, affect the PHP runtime used by many websites and web applications.

The European Union Agency for Cybersecurity and other European cybersecurity authorities urged organizations to identify affected systems and apply the available updates. Researchers also reported proof-of-concept exploits, increasing concerns about attacks against unpatched installations.

CVE-2026-109618

This vulnerability involves incorrect handling of out-of-memory conditions while PHP processes requests.

Under affected conditions, an attacker may exploit memory corruption to execute arbitrary code remotely.

CVE-2026-109619

This vulnerability involves improper management of internal request state when PHP workers are reused.

Successful exploitation could allow an unauthenticated attacker to execute code on an affected server.

Both vulnerabilities received a reported CVSS v4.0 score of 9.2 in the NHS England Digital security advisory.

Affected PHP versions

The security updates released on October 21 include:

PHP branch	Fixed version
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35

PHP 8.1 and older branches are also affected according to the security advisories, but these branches have reached end of life and do not receive normal security maintenance. Organizations should consult the official advisories for supported remediation options.

Potential impact

An attacker who successfully exploits a vulnerable PHP installation may gain the ability to execute code within the affected process’s security context.

Depending on the server configuration and available privileges, this could lead to:

• Unauthorized access to application data.
• Exposure of database credentials and environment secrets.
• Modification of website files.
• Installation of malicious scripts.
• Further compromise of the underlying server.

These outcomes depend on the affected environment and the attacker’s access.

Remediation

Check the installed PHP version:

php -v

On Debian or Ubuntu, identify installed PHP packages:

dpkg -l | grep -E '^ii[[:space:]]+php'

Then:

1. Identify every PHP runtime used by web applications.
2. Upgrade affected installations to the appropriate fixed version.
3. Check PHP-FPM, Apache mod_php, CGI, and other deployment configurations.
4. Restart affected services when required.
5. Review server logs and investigate suspicious activity.

The CLI version shown by php -v may differ from the PHP version used by a website. Check the actual web server configuration before declaring a system patched.

Official references: PHP and CERT-EU’s PHP security advisory.

---

2. Cisco Catalyst SD-WAN Manager: Authentication Bypass

CVE: CVE-2026-76504
Disclosure date: September 30, 2026; October updates followed
CVSS score: 9.8
Primary impact: Unauthorized administrator access
Exploitation status: Confirmed exploitation reported by Cisco.

Cisco Catalyst SD-WAN Manager, formerly known as vManage, was affected by a critical authentication-bypass vulnerability.

Cisco’s October 2 advisory described a weakness in API session-based authentication management. An unauthenticated remote attacker could exploit the issue to access an affected system with administrator privileges.

Although the vulnerability was initially disclosed in September, it remained a significant threat during October because of continued remediation and exploitation concerns.

Technical impact

Cisco Catalyst SD-WAN Manager provides centralized management of software-defined wide area networks.

Administrator access to this system could expose sensitive network configurations and provide control over network-management operations.

A successful compromise could therefore threaten network confidentiality, integrity, and availability.

Affected versions

The October 2 Cisco advisory lists the following fixed releases:

Software branch	Fixed release
20.9	20.9.10.1
20.12	20.12.8.2
20.15	20.15.6.1
20.18	20.18.4.1
26.1	26.1.2.1
26.2	26.2.1

Earlier unsupported versions require migration to a supported release. Consult Cisco’s advisory for the complete affected-version matrix.

Remediation

Cisco recommends upgrading affected systems to fixed releases. The company also advises organizations to investigate potential compromise.

Administrators should:

• Upgrade all affected SD-WAN Manager instances.
• Review administrator authentication and access logs.
• Investigate unexpected configuration changes.
• Restrict access to management interfaces.
• Follow Cisco’s instructions for collecting diagnostic information and checking for indicators of compromise.

Official advisory: Cisco Catalyst SD-WAN Manager Authentication Bypass.

---

3. Fortinet FortiMail: Critical Path Traversal Vulnerability

CVE: CVE-2026-104286
First reported in October: October 1, 2026
CVSS score: 9.8
Primary impact: Arbitrary file write
Exploitation status: Reported as actively exploited.

Fortinet FortiMail was affected by a critical path traversal vulnerability involving its Identity-Based Encryption functionality.

The vulnerability allows attackers to manipulate file paths beyond the intended directory restrictions. The reported issue involves path traversal and null-byte injection, potentially enabling unauthorized file writes.

The Canadian Centre for Cyber Security confirmed that Fortinet had reported exploitation in the wild. CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog on October 1.

Why this vulnerability matters

FortiMail provides email security capabilities for organizations.

A compromise of an email security gateway can threaten a sensitive point in the organization’s infrastructure, particularly when the appliance has privileged network access or handles large volumes of corporate communications.

The actual impact depends on the attack path and the privileges available to the attacker.

Affected versions and remediation

The Canadian Centre for Cyber Security identified these affected FortiMail branches:

Branch	Fixed version
FortiMail 8.0	8.0.2
FortiMail 7.6	7.6.7
FortiMail 7.4	7.4.9
FortiMail 7.2	Upgrade to branch 7.4 or later

Consult Fortinet’s current advisory for the exact remediation requirements.

Administrators should:

1. Identify the FortiMail version and configuration.
2. Install the appropriate security update.
3. Review appliance logs for suspicious requests and file changes.
4. Investigate unexpected accounts, configuration modifications, and outbound connections.
5. Assess whether the appliance requires additional incident-response investigation.

Official references: Fortinet Product Security Incident Response Team and CVE-2026-104286 in the National Vulnerability Database.

---

4. Citrix NetScaler: Actively Exploited Vulnerabilities

CVE: CVE-2026-88779
First reported in October: October 3, 2026
CVSS v4.0 score: 8.7
Primary impact: Remote denial of service
Exploitation status: Exploitation in the wild reported.

Citrix NetScaler ADC and NetScaler Gateway were affected by a memory overflow vulnerability that can cause a denial-of-service condition.

The vulnerability affects specific configurations using Security Assertion Markup Language (SAML) authentication. Citrix and security authorities reported exploitation activity during October.

Technical details

The vulnerability involves improper restriction of memory-buffer operations.

An attacker who successfully triggers the issue may cause the affected appliance to become unavailable, potentially disrupting services that depend on it.

The documented impact is denial of service. Administrators should not assume that this vulnerability automatically enables remote code execution.

Affected configurations

The vendor identifies SAML service-provider or identity-provider configurations as relevant preconditions.

Affected releases include:

• NetScaler ADC and Gateway 14.1 before 14.1-73.41.
• NetScaler ADC and Gateway 13.1 before 13.1-64.28.
• NetScaler ADC FIPS releases before 14.1-73.41 FIPS.
• NetScaler ADC FIPS and NDcPP releases before 13.1-37.282.

Check the vendor bulletin for additional release-specific requirements.

Remediation

Upgrade affected appliances to the fixed builds specified by Citrix.

Administrators should also:

• Confirm whether SAML authentication is enabled.
• Review availability and authentication logs.
• Investigate unexpected appliance restarts or service disruptions.
• Verify that the update completed successfully.

Official advisory: Citrix NetScaler Security Bulletin for CVE-2026-88779.

---

5. Microsoft October 2026 Patch Tuesday

Release date: October 13, 2026
Reported vulnerabilities addressed: 1,413
Zero-day vulnerabilities: Three reported
Critical vulnerabilities: 75 in CrowdStrike’s analysis.

Microsoft’s October security updates addressed a large number of vulnerabilities across Windows and other Microsoft products.

CrowdStrike’s October 13 analysis reported 1,413 vulnerabilities, including one exploited zero-day and two publicly disclosed zero-days. Its breakdown identified 75 critical vulnerabilities.

The exact counts reported by security publications may differ because of their counting methods and the products included.

Major vulnerability categories

CrowdStrike reported the following distribution of vulnerability types:

Vulnerability category	Reported count
Elevation of privilege	677
Remote code execution	317
Information disclosure	254

These figures describe vulnerability categories in the reported release analysis. They should not be interpreted as counts of successful attacks.

Why this release matters

Elevation-of-privilege vulnerabilities can allow attackers to gain higher permissions after obtaining an initial foothold.

Remote-code-execution vulnerabilities may allow attackers to run malicious code on affected systems, depending on the conditions required for exploitation.

Information-disclosure vulnerabilities can expose sensitive data that attackers may use in subsequent stages of an intrusion.

Recommended action

Windows administrators should review the October security updates and prioritize fixes according to:

• Confirmed exploitation.
• Exposure to untrusted networks.
• The sensitivity of affected systems.
• Available vendor mitigations.
• The consequences of a successful attack.

Install applicable updates and verify that the relevant systems received them successfully.

Official reference: Microsoft Security Response Center.

---

6. Plex2Shell: Multiple Plex Media Server Vulnerabilities

Reported in October: October 20–21, 2026
CVE identifiers: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656
Primary impact: Vulnerability chaining leading to remote code execution
Exploitation status: CISA added the vulnerabilities to its Known Exploited Vulnerabilities catalog.

CISA added four Plex Media Server vulnerabilities to its Known Exploited Vulnerabilities catalog on October 20.

Security researchers reported that an attacker could chain the vulnerabilities to achieve remote code execution without authentication under affected conditions.

Vulnerability breakdown

CVE	Vulnerability type	Reported CVSS score
CVE-2026-96652	Server-side request forgery (SSRF)	5.3
CVE-2026-96654	Improper neutralization of encoded URI schemes	6.9
CVE-2026-96655	Server-side request forgery (SSRF)	5.3
CVE-2026-96656	External control of file name or path	8.6

The individual scores do not fully describe the risk of a chained exploit. Multiple vulnerabilities can combine to produce a more serious outcome than any one flaw would achieve independently.

Why Plex servers are at risk

Plex Media Server may run on home servers, network-attached storage devices, virtual machines, and other systems.

If a vulnerable instance is exposed to untrusted networks, successful exploitation could place the server and accessible resources at risk.

The potential impact depends on the server’s configuration, permissions, and network access.

Remediation

The October reporting identifies Plex Media Server version 1.43.3.10861 as a fixed release for these vulnerabilities. Administrators should check the current Plex security guidance for any subsequent updates or additional requirements.

Recommended actions:

• Upgrade affected installations.
• Disable unnecessary public exposure.
• Review server logs for suspicious requests.
• Check for unexpected processes and file modifications.
• Investigate unusual outbound network traffic.

Reference: CISA Known Exploited Vulnerabilities Catalog.

---

7. Siemens Software Center: DLL Side-Loading Attacks

CVE: CVE-2026-110936
Reported in October: October 19–20, 2026
Vulnerability type: Uncontrolled search path element
Attack technique: DLL side-loading
Exploitation status: Confirmed exploitation reported by Siemens.

Siemens Software Center was affected by a vulnerability that attackers exploited through DLL side-loading.

Siemens and the Canadian Centre for Cyber Security reported that the vulnerability was being exploited in the wild. CISA subsequently added CVE-2026-110936 to its Known Exploited Vulnerabilities catalog.

How the attack works

Windows applications may load dynamic-link libraries to access additional functionality.

If an application searches an unsafe location for a required DLL, an attacker may place a malicious library where the application will load it.

The malicious code can then execute in the context of the legitimate application.

A valid digital signature on the main executable does not guarantee that every library it loads is trustworthy.

Affected version

Siemens identified versions before Software Center 4.0.9.8 as affected.

Remediation

• Upgrade to Siemens Software Center 4.0.9.8 or a later applicable fixed release.
• Investigate unexpected DLL files and suspicious application behavior.
• Review endpoint alerts and process execution logs.
• Check for signs of malware infection.

The disclosure also demonstrates why security monitoring must consider how applications behave, not just whether their primary executable is digitally signed.

Official reference: Siemens ProductCERT.

---

8. EG Secure Solutions SiteGuard: OS Command Injection

CVE: CVE-2026-106931
Product: EG Secure Solutions SiteGuard Server Edition
Reported in October: October 20, 2026
Vulnerability type: OS command injection
Exploitation status: CISA added the vulnerability to its Known Exploited Vulnerabilities catalog.

CISA identified CVE-2026-106931 as an actively exploited vulnerability affecting SiteGuard Server Edition. The issue involves operating-system command injection.

What is the risk?

An OS command injection vulnerability occurs when an application processes untrusted input in a way that allows an attacker to influence commands executed by the operating system.

Depending on the affected component and its privileges, successful exploitation may allow unauthorized commands to run on the server.

Potential consequences include unauthorized file access, changes to system configuration, and further compromise.

Remediation

Administrators should consult the vendor’s security advisory to determine affected versions and the applicable fix.

They should also investigate whether vulnerable systems have received unexpected commands or experienced suspicious changes.

Because CISA identified the issue as exploited, organizations running the affected product should treat it as a priority.

Reference: CISA Known Exploited Vulnerabilities Catalog.

---

9. Additional October Vulnerabilities Requiring Attention

The vulnerabilities discussed above are not the only security issues reported during October. Several additional advisories deserve attention from administrators responsible for enterprise infrastructure.

9.1 BeyondTrust Remote Support — CVE-2026-102764

Ireland’s National Cyber Security Centre listed a critical authentication-related vulnerability affecting BeyondTrust Remote Support on October 20.

Organizations using the affected product should consult the vendor’s advisory to establish the affected versions, exposure conditions, and required remediation.

Reference: Ireland’s National Cyber Security Centre.

9.2 Cisco Secure Email Gateway — CVE-2026-76519

Ireland’s National Cyber Security Centre listed a critical vulnerability affecting Cisco Secure Email Gateway on October 15.

Because email security appliances process external communications and often operate at network boundaries, administrators should verify their deployed versions and apply the vendor’s recommended fixes.

Reference: Ireland’s National Cyber Security Centre.

9.3 Ivanti Connect Secure — CVE-2026-104935

A critical vulnerability affecting Ivanti Connect Secure was listed in the Irish NCSC’s October security advisories on October 13.

Organizations using the affected remote-access product should review the vendor advisory for affected versions, exploitation information, and remediation requirements.

Reference: Ireland’s National Cyber Security Centre.

9.4 SonicWall SMA1000 — CVE-2026-102255

The Irish NCSC also listed a critical SonicWall SMA1000 vulnerability on October 7.

Administrators should check the vendor’s advisory to determine whether their appliances are affected and whether additional checks for compromise are necessary.

Reference: Ireland’s National Cyber Security Centre.

9.5 Atlassian Products — CVE-2026-21589

A critical arbitrary-file-access vulnerability affecting multiple Atlassian products appeared in the Irish NCSC’s October 6 advisory list.

Organizations using affected Atlassian products should verify their versions and review the vendor’s security guidance.

Reference: Ireland’s National Cyber Security Centre.

9.6 GitLab Community Edition and Enterprise Edition — CVE-2026-110264

Ireland’s National Cyber Security Centre published an advisory about a critical vulnerability affecting GitLab Community Edition and Enterprise Edition on October 23.

GitLab administrators should review the official advisory for the affected versions, impact, and available fixes.

Because GitLab installations may contain source code, CI/CD configurations, and deployment credentials, administrators should also review repository and account activity if they suspect compromise.

Reference: Ireland’s National Cyber Security Centre.

Important: The product listings above identify issues reported by the NCSC during October. They do not, by themselves, establish that every vulnerability was exploited in the wild. Confirm exploitation status and remediation details through the relevant vendor advisory.

---

10. Priority Remediation Checklist

Organizations should prioritize vulnerabilities based on exploitation evidence, exposure, potential impact, and the availability of effective fixes.

Priority	Product or vulnerability	Required action
Critical	PHP2Shell — CVE-2026-109618 and CVE-2026-109619	Update affected PHP installations immediately.
Critical	Cisco SD-WAN — CVE-2026-76504	Upgrade affected systems and investigate possible compromise.
Critical	FortiMail — CVE-2026-104286	Apply the vendor fix and review appliance activity.
High	Citrix NetScaler — CVE-2026-88779	Upgrade affected appliances and verify relevant configurations.
High	Microsoft October security updates	Install applicable updates, prioritizing exploited vulnerabilities.
High	Plex2Shell — four CVEs	Upgrade affected Plex installations and review exposure.
High	Siemens Software Center — CVE-2026-110936	Install a fixed release and investigate potential malware activity.
High	SiteGuard — CVE-2026-106931	Verify affected versions and follow vendor remediation guidance.
High	Other October advisories	Confirm affected versions, exploitation status, and available fixes.

Recommended operational steps

1. Identify vulnerable assets.

Maintain an inventory of operating systems, applications, appliances, and internet-facing services.

2. Confirm exposure.

Compare installed versions with the vendor’s affected-version ranges. Consider configuration-specific conditions.

3. Patch according to risk.

Prioritize vulnerabilities with confirmed exploitation and systems exposed to untrusted networks.

4. Investigate potential compromise.

Patching does not remove malware or reverse unauthorized changes that occurred before remediation.

5. Verify the result.

Confirm the installed version, check service health, and investigate relevant logs.

6. Monitor new advisories.

Use vendor security bulletins and the CISA Known Exploited Vulnerabilities Catalog to track new information.

---

11. Frequently Asked Questions

What are the most important cybersecurity vulnerabilities reported in October 2026?

Major issues include PHP2Shell, Cisco Catalyst SD-WAN Manager’s authentication bypass, Fortinet FortiMail’s path traversal vulnerability, Citrix NetScaler’s denial-of-service flaw, the Plex2Shell vulnerability chain, and the Siemens Software Center DLL side-loading vulnerability.

What is PHP2Shell?

PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619. These critical PHP vulnerabilities can allow unauthenticated remote code execution under affected conditions.

Which October 2026 vulnerabilities have confirmed exploitation?

The sources cited in this roundup report exploitation for Cisco SD-WAN CVE-2026-76504, FortiMail CVE-2026-104286, Citrix NetScaler CVE-2026-88779, the four Plex2Shell vulnerabilities, Siemens Software Center CVE-2026-110936, and SiteGuard CVE-2026-106931. PHP2Shell has publicly reported proof-of-concept exploits and a high exploitation risk, but its observed exploitation status should be verified against current advisories.

How many vulnerabilities did Microsoft address in October 2026?

CrowdStrike’s October 13 analysis reported 1,413 vulnerabilities addressed in Microsoft’s October security release, including three zero-day vulnerabilities and 75 critical vulnerabilities. Counts can differ between publications because of their methodologies.

How can administrators check whether their systems are affected?

Identify the installed product and version, consult the official security advisory, compare the version against the affected ranges, and verify whether the necessary fix is installed. Configuration-specific requirements may also affect exposure.

Does installing a security patch guarantee that a system is safe?

No. A patch closes the vulnerability it addresses, but it does not necessarily remove an attacker’s existing access, malicious files, unauthorized accounts, or persistence mechanisms. Investigate suspected compromises separately.

Conclusion

October 2026 has seen serious vulnerabilities affecting PHP, Cisco SD-WAN, Fortinet FortiMail, Citrix NetScaler, Microsoft products, Plex Media Server, Siemens Software Center, and other enterprise technologies.

Several of these issues have been reported as actively exploited, making prompt remediation particularly important.

Administrators should begin with PHP2Shell and other vulnerabilities with confirmed exploitation, verify their affected systems, install the appropriate vendor fixes, and investigate any signs of compromise. Follow the official security advisories for the latest affected-version information and remediation guidance.