PatchTheCVEBlog · 2-hour update · 2026-10-27
CVE-2026-109618 PHP: exploited in the wild, how to patch
By the PatchTheCVE security team · Updated 2026-10-27 · Data from NVD, CISA KEV, EPSS and vendor advisories
Critical severity (CVSS 9.8), exploited in the wild, remotely exploitable, no login needed. Recommended action: upgrade to 8.2.35, 8.3.36, 8.4.27, 8.5.12.
On 27 October 2026, 66 new CVEs were published that we track: 4 critical, 3 already exploited in the wild (CISA KEV) and 21 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.
Key takeaways
- Most urgent: CVE-2026-109618 (PHP): upgrade to 8.2.35, 8.3.36, 8.4.27, 8.5.12.
- 3 exploited in the wild (CISA KEV): patch these before anything else.
- 7 of the top 8 can be attacked over the network without a login.
- 21 of 66 new CVEs already have a fix or vendor patch.
- Most affected vendors: dell, spesmilo, a2aproject.
What happened in this 2-hour window: the most serious item is CVE-2026-109618 in php (critical, CVSS 9.8, priority 97/100). Recommended action: upgrade to 8.2.35, 8.3.36, 8.4.27, 8.5.12. 3 new CVEs from the list below are already being exploited (CVE-2026-109618, CVE-2026-109619, CVE-2026-86950), so those go first. 7 of the 8 top items can be attacked remotely without a login. Most affected: dell (6), spesmilo (3), a2aproject (1). 21 of 66 new CVEs already have a fix or vendor patch; for the other 45, follow the downgrade or mitigation steps until one ships.
Patch these first
CVE-2026-109618: PHP Memory Corruption Vulnerability
- Risk: Critical (CVSS 9.8), priority 97/100 (patch now), published 21 October 2026
- Exploitation: exploited in the wild (CISA KEV), federal due date 2026-10-29; 100.0% chance of exploitation in the next 30 days (EPSS); attackable over the network without a login
- Affected: php php (>= 7.3.0 and < 8.2.35, >= 8.3.0 and < 8.3.36, >= 8.4.0 and < 8.4.27)
- Fixed in: 8.2.35, 8.3.36, 8.4.27, 8.5.12
- Patch ID: RHSA-2026:87070, RHSA-2026:87071, RHSA-2026:88561
- What to do: upgrade to 8.2.35, 8.3.36, 8.4.27, 8.5.12 for php php
Why it ranks here: critical severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev).
References: NVD · Mitigation, Vendor Advisory
CVE-2026-109619: PHP Stale Internal Request-State Vulnerability
- Risk: High (CVSS 8.1), priority 86/100 (patch now), published 21 October 2026
- Exploitation: exploited in the wild (CISA KEV), federal due date 2026-10-29; 100.0% chance of exploitation in the next 30 days (EPSS); attackable over the network without a login
- Affected: php php (>= 5.4.0 and < 8.2.35, >= 8.3.0 and < 8.3.36, >= 8.4.0 and < 8.4.27)
- Fixed in: 8.2.35, 8.3.36, 8.4.27, 8.5.12
- Patch ID: RHSA-2026:87070, RHSA-2026:87071, RHSA-2026:88561
- What to do: upgrade to 8.2.35, 8.3.36, 8.4.27, 8.5.12 for php php
Why it ranks here: high severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev).
References: NVD · Mitigation, Vendor Advisory
CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability
- Risk: High (CVSS 8.8), priority 80/100 (patch now), published 28 September 2026
- Exploitation: exploited in the wild (CISA KEV), federal due date 2026-10-13; 26.2% chance of exploitation in the next 30 days (EPSS)
- Affected: apple ipados (< 18.7.11, >= 26.0 and < 26.7.1)
- Fixed in: 18.7.11, 26.7.1
- What to do: upgrade to 18.7.11, 26.7.1 for apple ipados
Why it ranks here: high severity; epss top 2%: very likely to be exploited; exploited in the wild (cisa kev).
References: NVD · Release Notes, Vendor Advisory · Release Notes, Vendor Advisory
CVE-2026-65145: NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue
- Risk: Critical (CVSS 10.0), priority 40/100 (patch this month), published 27 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: critical severity; remotely exploitable, no login, no user action.
References: NVD
CVE-2026-115216: In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the opera
- Risk: Critical (CVSS 9.1), priority 37/100 (patch this month), published 27 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: critical severity; remotely exploitable, no login, no user action.
References: NVD
CVE-2026-112362: @fastify/express is a Fastify plugin that runs Express middleware inside Fastify
- Risk: Critical (CVSS 9.1), priority 37/100 (patch this month), published 27 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: critical severity; remotely exploitable, no login, no user action.
References: NVD
CVE-2026-4337: Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a unauthentica
- Risk: High (CVSS 8.8), priority 36/100 (routine), published 27 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: high severity; remotely exploitable, no login, no user action.
References: NVD
CVE-2026-106087: TRO600 contains an arbitrary file read vulnerability
- Risk: High (CVSS 8.7), priority 35/100 (routine), published 27 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: high severity; remotely exploitable, no login, no user action.
References: NVD
Most affected vendors
- dell: 6 new CVEs
- spesmilo: 3 new CVEs
- a2aproject: 1 new CVE
- admidio: 1 new CVE
- ai-sdlc-framework: 1 new CVE
- anyant: 1 new CVE
How to act on this list
- Start with anything marked exploited or patch now.
- Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
- Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
- Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.
FAQ
What is the most serious vulnerability published on 27 October 2026?
CVE-2026-109618 (PHP Memory Corruption Vulnerability) ranks highest, with a priority score of 97/100. Recommended action: upgrade to 8.2.35, 8.3.36, 8.4.27, 8.5.12.
Are any of the new CVEs exploited in the wild?
Yes, 3 of the new CVEs appear on the CISA Known Exploited Vulnerabilities list. Patch those first.
Should I downgrade if there is no fix yet?
Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.
Sources
- NIST National Vulnerability Database: CVE details and affected versions
- CVE Program: official CVE records
- CISA Known Exploited Vulnerabilities catalog: exploitation in the wild
- FIRST EPSS: exploit probability
- Distribution and vendor advisories linked under each item.