October 2026 Vulnerability Report: Critical CVEs & Zero-Days

October 2026 was a busy month for cybersecurity. Many security vulnerabilities were discovered in popular software, operating systems, web applications and network devices. Some of these vulnerabilities were very dangerous because they could allow attackers to execute commands remotely, steal sensitive information, bypass security controls or take control of vulnerable servers. Security teams also reported active attacks against several products. This made security updates especially important during the month. In this article, we will look at some of the most important vulnerabilities disclosed in October 2026, including their CVE numbers, affected products, security impact and recommended fixes. Note: This is a report covering major security vulnerabilities, not a complete list of every CVE published in October.

October 2026 vulnerabilities at a glance

Product	CVE	Impact	Exploited
Microsoft Windows Shell	CVE-2026-96951	Mark of the Web bypass	Yes
Node.js / Brotli (Node2Shell)	CVE-2026-111497	Remote code execution	Yes (CISA KEV)
PHP (PHP2Shell)	CVE-2026-109618 / CVE-2026-109619	Remote code execution	Yes (CISA KEV)
GitLab CE/EE	CVE-2026-97229 / CVE-2026-110264	Remote code execution	Patch now (CVSS 10.0)
Cisco Secure Email Gateway	CVE-2026-76519	Arbitrary file write as root	Yes (CISA KEV)
Fortinet FortiMail	CVE-2026-104286	Path traversal	Yes (CISA KEV)
Palo Alto Networks PAN-OS	CVE-2026-0322	Remote code execution	Yes (CISA KEV)

1. Microsoft October 2026 Security Updates

Microsoft released its October Patch Tuesday updates on October 13, 2026. According to Tenable, Microsoft addressed 1,407 CVEs in this release:

69 Critical vulnerabilities.
1,337 Important vulnerabilities.
1 Low-severity vulnerability.

The vulnerabilities affected 301 Microsoft products and components. Some of the affected technologies included Windows, Microsoft Office, Windows Kernel, DNS Server, Windows Installer and .NET.

CVE-2026-96951 – Windows Shell Security Feature Bypass

This vulnerability affects Windows Shell and was exploited in the wild. An attacker could use a specially crafted file to bypass the Mark of the Web security feature. This could help malicious files avoid some security warnings when users open them. Recommended fix:

Install the October Microsoft security updates.
Avoid opening files from unknown sources.
Use endpoint security software.
Investigate suspicious files and activity.

Microsoft also addressed CVE-2026-108398 in .NET Framework, which had been publicly disclosed before a security update was available. Reference: Tenable – Microsoft's October 2026 Patch Tuesday

2. Node.js Vulnerabilities – Node2Shell and More

One of the most important security events in October involved Node.js and Google's Brotli compression library. On October 21, 2026, the Node.js project released security updates addressing multiple vulnerabilities.

CVE-2026-111497 – Node2Shell

Severity: High – exploitation confirmed. Node2Shell, also called Broccoli2Shell or HTTP2Shell, is a serious vulnerability affecting the Brotli decoder. Brotli is a compression library used to reduce the size of data transferred over the internet. The vulnerability is caused by an out-of-bounds write in the Brotli decoder. An attacker can send specially crafted compressed data to an application that processes Brotli content. Successful exploitation could cause:

Remote code execution.
Memory corruption.
Sensitive information disclosure.
Application crashes.
Denial of Service.

The vulnerability is particularly important because Brotli is used by many applications and software projects. It affects more than Node.js alone. Other affected technologies include Microsoft .NET, PowerShell, Bun, Envoy Proxy, Istio and Python Brotli packages. CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) catalog on October 27, 2026. Affected Node.js versions: 22.x, 24.x and 26.x. Fixed Node.js releases:

Node.js 22.23.4
Node.js 24.22.1
Node.js 26.12.1

Later releases are also available, so organizations should install the latest supported security updates.

Other important Node.js vulnerabilities

The October 21 security release also fixed several other issues.

CVE	Description	Severity
CVE-2026-105482	DNS hostname validation issue	High
CVE-2026-105483	TLS certificate hostname bypass	High
CVE-2026-106069	TLS certificate validation issue	High
CVE-2026-106072	Incorrect TLS certificate validation	Medium
CVE-2026-105481	HTTP keep-alive connection issue	Medium
CVE-2026-106074	Random number generation issue	Medium
CVE-2026-106070	ZIP file validation issue	Low
CVE-2026-106071	Filesystem permission issue	Low
CVE-2026-106073	Permission model bypass	Low

Recommended fix: Node.js developers and system administrators should update their installations to the latest supported releases. They should also review third-party software that uses Brotli and make sure all vulnerable dependencies are updated. References:

3. PHP Critical Vulnerabilities – PHP2Shell

On October 21, 2026, two critical vulnerabilities were disclosed in the PHP programming language. These vulnerabilities became known as PHP2Shell. They could allow remote attackers to execute code without authentication on vulnerable PHP servers.

CVE-2026-109618

Severity: Critical
CVSS: 9.2
Type: Remote Code Execution
Main issue: Memory corruption during out-of-memory handling.

The vulnerability occurs when PHP handles an out-of-memory error incorrectly. Under certain conditions, this can corrupt internal memory and allow an attacker to execute malicious code.

CVE-2026-109619

Severity: Critical
CVSS: 9.2
Type: Remote Code Execution
Main issue: Incorrect handling of internal memory after it has been released.

This vulnerability involves internal PHP data that can remain accessible after the memory used by a request has been released. An attacker may use this problem to cause memory corruption and execute code.

Affected PHP versions

The vulnerabilities affect PHP versions before the following fixed releases:

PHP branch	Fixed version
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35

PHP 8.1 and older versions are also affected but no longer receive normal security updates. CISA added both vulnerabilities to its KEV catalog in October. Recommended fix:

Update PHP immediately.
Upgrade unsupported PHP installations.
Review WordPress, Drupal and Joomla environments.
Check web server logs for suspicious requests.
Investigate possible server compromise.

References:

4. GitLab Critical Remote Code Execution Vulnerabilities

GitLab released important security updates during October 2026. Two critical vulnerabilities could allow attackers to execute arbitrary code on vulnerable GitLab servers without authentication.

CVE-2026-97229

This vulnerability affects the CI/CD regular expression compiler. An attacker could use a specially crafted regular expression to trigger an integer overflow. Successful exploitation could allow remote code execution on the GitLab server.

CVSS: 10.0
Severity: Critical
Type: Integer overflow
Impact: Remote Code Execution

CVE-2026-110264

This vulnerability also involves an integer overflow when GitLab compiles specially crafted regular expressions. An unauthenticated attacker could exploit the issue under certain conditions to execute arbitrary code.

CVSS: 10.0
Severity: Critical
Type: Integer overflow
Impact: Remote Code Execution

Affected GitLab products

Both vulnerabilities affect GitLab Community Edition (CE) and Enterprise Edition (EE). Organizations using self-managed GitLab installations should check their versions and install the fixed releases. Recommended fix:

Update GitLab immediately.
Review CI/CD configurations.
Monitor unusual pipeline activity.
Check server logs for suspicious requests.
Investigate unexpected application crashes.

Reference: MyCERT – Advisory MA-1486.102026

5. Cisco Secure Email Gateway Vulnerability

CVE-2026-76519 – Critical Arbitrary File Write

Cisco published a critical security advisory on October 14, 2026. The vulnerability affects Cisco Secure Email Gateway and has a CVSS score of 9.8. It involves improper handling of email attachments when the File Reputation service is enabled. An attacker could send a specially crafted email attachment through a vulnerable gateway. Successful exploitation could allow the attacker to:

Write arbitrary files.
Execute commands with root privileges.
Compromise the affected email gateway.
Potentially gain control of the underlying system.

Cisco confirmed that software updates were available and that no workaround fully addresses the issue. The vulnerability was also added to CISA's KEV catalog. Recommended fix: Install the security updates provided by Cisco and review email gateway logs for suspicious attachments and activity. Reference: Cisco Security Advisory – Secure Email Gateway Arbitrary File Write

6. Fortinet FortiMail Vulnerability

CVE-2026-104286 – Path Traversal

Fortinet FortiMail was affected by a serious path traversal vulnerability. The vulnerability allows attackers to access or write files outside their intended directories under vulnerable conditions. Successful exploitation could lead to unauthorized file access and possible system compromise. Fortinet confirmed active exploitation, and CISA added the vulnerability to its KEV catalog on October 1, 2026.

Affected FortiMail versions

FortiMail 8.0 versions before 8.0.2.
FortiMail 7.6 versions before 7.6.7.
FortiMail 7.4 versions before 7.4.9.
FortiMail 7.2: Upgrade to a supported newer branch.

Recommended fix: Update affected FortiMail systems and review logs for suspicious activity. Reference: Canadian Centre for Cyber Security – Fortinet Security Advisory AV26-989

7. Palo Alto Networks PAN-OS Vulnerability

CVE-2026-0322 – Remote Code Execution

Palo Alto Networks disclosed a remote code execution vulnerability affecting the PAN-OS management interface. The vulnerability has a CVSS score of 8.6. An attacker with network access and high privileges could exploit the issue to execute arbitrary code with root privileges on an affected firewall. The vulnerability affects PA-Series and VM-Series firewalls, as well as Panorama. CISA added this vulnerability to its KEV catalog on October 14, 2026. Recommended fix:

Install the security updates provided by Palo Alto Networks.
Restrict access to the management interface.
Allow access only from trusted internal addresses.
Monitor suspicious administrative activity.

Reference: Palo Alto Networks – CVE-2026-0322

8. Other Important Vulnerabilities Added to CISA KEV

October also included several other vulnerabilities with evidence of exploitation. Some affected products included:

CVE	Product	Vulnerability
CVE-2026-104935	Ivanti Connect Secure	Authentication bypass
CVE-2026-88779	Citrix NetScaler	Memory buffer bounds issue
CVE-2026-105133	AhsayCBS	Improper authentication
CVE-2026-105134	AhsayCBS	Command injection
CVE-2026-102764	BeyondTrust Remote Support	Authentication bypass
CVE-2026-114625	Arista VeloCloud Orchestrator	SQL injection
CVE-2026-48356	Adobe Commerce / Magento	Dangerous file upload

These vulnerabilities show that security problems are not limited to operating systems. Enterprise software, remote support platforms, network appliances and web applications are also important targets. Organizations should check whether they use affected products and follow the relevant vendor security advisories.

9. How to Protect Your Systems

After reviewing the October vulnerabilities, here are some important security recommendations.

Update your software

Install the latest security updates for operating systems, applications, servers and network devices. Do not continue using unsupported software.

Check the CISA KEV catalog

The CISA Known Exploited Vulnerabilities catalog helps security teams identify vulnerabilities that attackers are actively exploiting. Prioritize these vulnerabilities when planning security updates.

Scan your servers

Use vulnerability scanners to identify outdated software and vulnerable services. Popular tools include:

Nessus
OpenVAS
Qualys
Greenbone
Nmap

Only scan systems that you own or have permission to test.

Monitor suspicious activity

Check system logs, authentication records, network traffic and application activity. Look for unusual connections, unexpected processes and suspicious login attempts.

Protect internet-facing services

Avoid exposing administrative interfaces directly to the internet. Use firewalls, VPNs, access restrictions and multi-factor authentication.

Review third-party dependencies

Developers should regularly check their libraries and software dependencies. The Node2Shell vulnerability is a good example of why this is important: a vulnerable component inside a larger application can create security risks even when the application itself was not developed by the affected library's authors. Your package manager can help here: npm audit, pnpm audit, and yarn npm audit list known vulnerable dependencies. See pnpm vs npm vs Yarn vs Bun for how the four tools compare.

Conclusion

October 2026 was an important month for cybersecurity, with many serious vulnerabilities affecting widely used software and infrastructure. Some of the most important issues included Node2Shell (CVE-2026-111497), PHP2Shell (CVE-2026-109618 and CVE-2026-109619), critical GitLab vulnerabilities, Microsoft security updates, Cisco Secure Email Gateway and Fortinet FortiMail. Several of these vulnerabilities were added to CISA's Known Exploited Vulnerabilities catalog, showing that attackers were already exploiting them. For system administrators, developers and security professionals, the message is simple: keep your software updated, monitor your systems and prioritize vulnerabilities that are actively exploited. Security is not a one-time task. It requires regular updates, monitoring and continuous attention. Stay informed, stay updated and stay secure.

FAQ

What is Node2Shell (CVE-2026-111497)?

Node2Shell, also called Broccoli2Shell or HTTP2Shell, is an out-of-bounds write in Google's Brotli decoder. Specially crafted compressed data can lead to remote code execution in Node.js and other software that uses Brotli. It is fixed in Node.js 22.23.4, 24.22.1 and 26.12.1.

What is PHP2Shell?

PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed on October 21, 2026. Both allow unauthenticated remote code execution. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

How many CVEs did Microsoft fix in October 2026?

Microsoft's October 13, 2026 Patch Tuesday addressed 1,407 CVEs, including the actively exploited Windows Shell flaw CVE-2026-96951.

Which October 2026 vulnerabilities were actively exploited?

Node2Shell, both PHP2Shell flaws, Cisco Secure Email Gateway CVE-2026-76519, Fortinet FortiMail CVE-2026-104286 and Palo Alto PAN-OS CVE-2026-0322 were added to the CISA KEV catalog. Microsoft also confirmed that the Windows Shell flaw CVE-2026-96951 was exploited in the wild.

What should I patch first?

Start with internet-facing systems that appear in the CISA KEV catalog: email gateways, firewalls, VPNs, and public web servers running PHP, Node.js or GitLab.

References and Useful Resources

Disclaimer: This article is intended for cybersecurity awareness and defensive security. Always check official vendor advisories for the latest information about affected versions and available security updates.