Issue #1 · Week ending October 27, 2026

2 PHP bugs top 4 new exploited vulns; 4 rated patch-now

Data: CISA KEV catalog v2026.10.26 · FIRST EPSS scores dated 2026-10-26

The 30-second version

4 vulnerabilities joined CISA's KEV catalog in the last 7 days (0 with known ransomware use). The catalog now holds 1,758 entries.
4 of this week's additions rate P1 (patch now).

New to KEV this week, ranked

P1 #1 · CVE-2026-109619

PHP

PHP Stale Internal Request-State Vulnerability

Added 2026-10-26 · CISA due 2026-10-29 · EPSS 99.99%

What it is: PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.

Why it matters: EPSS estimates a 99.99% chance of exploitation activity in the next 30 days, higher than 99.98% of all scored CVEs. The federal patch deadline is in 2 days.

Fix: Apply mitigations in accordance with vendor instructions. CISA alert · NVD

P1 #2 · CVE-2026-109618

PHP

PHP Memory Corruption Vulnerability

Added 2026-10-26 · CISA due 2026-10-29 · EPSS 99.98%

What it is: PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.

Why it matters: EPSS estimates a 99.98% chance of exploitation activity in the next 30 days, higher than 99.98% of all scored CVEs. The federal patch deadline is in 2 days.

Fix: Apply mitigations in accordance with vendor instructions. CISA alert · NVD

P1 #3 · CVE-2026-110447

Collabora Online – Built-in CODE Server

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Added 2026-10-23 · CISA due 2026-10-26 · EPSS 12.3%

What it is: Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.

Why it matters: EPSS estimates a 12.3% chance of exploitation activity in the next 30 days, higher than 96.2% of all scored CVEs. The federal patch deadline passed 1 day ago.

Fix: Apply mitigations in accordance with vendor instructions. Vendor advisory · NVD

P1 #4 · CVE-2026-114625

Arista VeloCloud Orchestrator

Arista VeloCloud Orchestrator SQL Injection Vulnerability

Added 2026-10-23 · CISA due 2026-10-26 · EPSS 1.0%

What it is: Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the...

Why it matters: EPSS estimates a 1.0% chance of exploitation activity in the next 30 days, higher than 63.3% of all scored CVEs. The federal patch deadline passed 1 day ago.