Critical Vulnerabilities and Active Exploitation, Oct 2026

Monthly reference modules

These modules are completed automatically with verified dated facts from the period. Each one states its basis and counting criterion, so the figures reconcile across modules. This is the recurring month-by-month reading, while the analysis that follows develops the cases without repeating this summary.

Indicator window: 148 dated facts in October 2026 · 19 from previous months (comparative frame, not monthly volume) · 2 with no confirmed date (excluded from the indicators). Facts from previous months are used only as a comparative frame in the analysis, never as volume for this period.

Executive Summary

October 2026 ended with a particularly sensitive mix for defenders and response teams, several critical vulnerability families were confirmed as actively exploited, while others circulated with enough evidence to raise operational risk for exposed organizations. The common thread was not just technical severity, but the speed at which vendor advisories, national CERTs, and exploited-vulnerability catalogs converged on the same conclusion: patching had to move to the front of the queue, external exposure needed review, and the window between disclosure, exploitation, and response had narrowed again.

Three main themes stand out in the reporting for the period. First, CVE-2026-110447 in Collabora Online Built-in CODE Server for Nextcloud, a command injection flaw affecting the richdocumentscode app when the CODE server is not running. The combination of active exploitation, remote command execution, and evidence of web shells makes it a useful case for understanding a recurring pattern: embedded or add-on integrations, because they are treated as functional dependencies rather than primary attack surface, often fall outside hardening and patching cycles. Second, CVE-2026-109618 and CVE-2026-109619 in PHP, grouped by multiple organizations under the informal name PHP2Shell, show how memory bugs in a ubiquitous language can turn into a cross-cutting crisis for web infrastructure, containers, application platforms, and third-party services. Third, CVE-2026-76418 in Cisco Secure Firewall ASA and FTD illustrates a different scenario. This is not code execution, but a denial of service issue on the SSL VPN channel, with confirmed exploitation in real-world environments and enough impact to force teams to prioritize availability and operational continuity on perimeter devices.

The operational takeaway is clear. The month did not show a single dominant campaign, but an overlap of incidents of different kinds that share two traits, internet exposure and exploitation before patches and internal procedures fully matured. In Nextcloud and Collabora environments, the vulnerable surface was not the standalone Collabora Online installation, but the embedded variant inside Nextcloud. In PHP, the risk reached installations serving web requests across multiple architectures and runtimes. In Cisco, the condition needed to trigger the issue was secondary authentication configured in certain tunnel groups, which points to an interaction between secure access design and service availability.

From a risk management perspective, the problem is not only technical. The period’s reporting shows that teams running web and remote-access platforms still rely too heavily on containment assumptions that fail at the worst possible moment, service restarts, heterogeneous deployments, container images that are not updated because they inherit from the host, applications that are "disabled" but still retain functional artifacts, and unpatched firewalls that sustain critical remote access functions. For CISOs and infrastructure owners, the implication is that the question should not be "do we have the patch?" but "what happens if the vulnerable component is still present, even if it seems inactive, encapsulated, or indirect?"

At the regional level, the period also reinforced a pattern already visible during the year, institutional response in Latin America and other regions is leaning more and more on national CSIRT notices, official bulletins, and alerts from global vendors. That is good news in terms of speed of distribution, but it also exposes a structural dependency, when most alert traffic is concentrated in widely used global technologies, local prioritization depends on organizations quickly turning the generic warning into inventory, exposure, and concrete mitigation. The problem is not only knowing that a critical vulnerability exists; the challenge is identifying whether it affects a specific installation, a particular image, an embedded module, or a tunnel group configured in a certain way.

Overview

The month was dominated by vulnerabilities with active or confirmed exploitation, but not all of them carried the same profile. PHP2Shell was the broadest case by reach, affecting multiple PHP branches, with fixes for recent versions and backports for older branches that were still receiving source-code support. That scope explains why so many national bodies, from CISA to cybersecurity centers in several countries, issued nearly simultaneous advisories. The combination of unauthenticated remote code execution and the ubiquity of PHP makes any delay in patching a risk multiplier, especially on servers handling direct web traffic or running in hosted platforms, containers, and shared runtimes.

The Collabora/Nextcloud case has a narrower attack surface, but it is highly instructive from a trust-chain perspective. The vulnerability is in the richdocumentscode application, not in standalone Collabora Online. That means teams may get a false sense of security if they review only the main product and not the embedded integration. The official notice clarified that disabling the app is not enough to fix the issue, it must be updated to version 26.4.303 or later, or removed. In other words, the presence of the component in the environment already creates exposure, even if the administrator believes it is "not in use."

Cisco, meanwhile, introduces a different warning: not every critical incident involves intrusion or remote code execution. CVE-2026-76418 centers on a denial of service in the remote-access SSL VPN service of Secure Firewall ASA and FTD. Confirmed exploitation in real-world environments shows that an unauthenticated remote attacker could send a specially crafted request when secondary authentication was configured in a tunnel group. Even if the impact is "only" availability, in perimeters where remote access supports operations, continuity, and contingency, an unexpected reboot can become a business interruption, and a down service can have the same practical effect as an intrusion at the wrong moment.

The convergence of these cases points to an additional lesson. Severity should not be measured only by the type of flaw, but by the combination of exposure, preauthentication, patch maturity, and the criticality of the affected service. In October 2026, the vulnerabilities that drew the most attention were not necessarily the most technically "sophisticated," but the ones that could be exploited without credentials, on exposed services, or through common dependencies across many organizations.

Indicators

The period’s indicators reflect the focus of the analysis: critical vulnerabilities with active or confirmed exploitation, impact on widely deployed technologies, and alerts issued by official agencies or vendors. This month’s snapshot should not be read as an exhaustive count of everything that happened on the Internet, but as a slice of the verifiable material available in the analysis window. When an indicator is 0, it means that specific axis did not appear in the reviewed material; it does not mean that this type of event was absent from the region or the broader ecosystem.

The case distribution points to three operational patterns. First, direct Internet exposure remains the most repeated risk factor: Nextcloud/Collabora, PHP, and Cisco SSL VPN share the trait of being reachable from external networks. Second, the most dangerous incidents were those that let an attacker act before authentication, or with secondary authentication misplaced in the access chain. Third, the most effective defensive response was still the familiar one, but applied with greater urgency: identify exposure, apply fixes, and temporarily remove from the Internet systems that cannot be patched right away.

From an executive standpoint, the real value of these indicators lies not only in the count, but in the difference between categories. A confirmed active-exploitation alert from a national CERT is not the same as telemetry on blocked attempts from a vendor. Nor is a denial-of-service vulnerability in a perimeter firewall equivalent to a remote code execution chain in a web service. That is why the body of the report keeps separating verified incidents, attack telemetry, and prior months used only for comparison.

Incidents

Collabora Online Built-in CODE Server for Nextcloud: command injection and web shells

The period's first major story is CVE-2026-110447, a critical operating system command injection vulnerability in Collabora Online Built-in CODE Server for Nextcloud, also known in the richdocumentscode app. Bolivia's CSIRT issued an advisory on October 14 about a flaw affecting versions earlier than 26.4.303 that could let an attacker run commands through a manipulated HTTP request to proxy.php when the CODE server is not running. That operational detail matters: the risk does not depend on a permanent condition, but on a specific service state, for example after a reboot or during a window when the component has not yet come up.

Collabora's official advisory clarified that disabling the app is not enough to fix the issue. The fix requires updating to version 26.4.303 or later, or removing the application. That distinction changes the practical response: a team that simply turns off the functionality without checking whether the component is still present may remain exposed, especially if the artifact is still installed and can be reactivated or reached through internal paths. For a CISO, the takeaway is straightforward but critical, mitigation is not the same as superficial deactivation, and controls must be verified against the actual exploitation mechanism, not the administrator's intent.

Operational interest grew because the CVE record described the vulnerability as actively exploited during September and October 2026. That mention not only supports the urgency of patching, it also suggests there was a sustained exploitation window before the advisory became widely known. The vulnerable state occurs when the CODE server is not running, which fits a post-exploitation pattern in systems that restart services, perform maintenance, or rely on delayed startup. In collaboration environments, those conditions are more common than they may seem, because platforms often combine multiple services, backend dependencies, and planned reboots.

Third-party technical coverage added a hypothesis about the exploitation method: proxy.php would incorporate request text into a Bash command inside double quotes, allowing the insertion of a $(...) sequence in the path and command execution without authentication. The same analysis reported observed PHP web shells and extraction of sensitive files. Although that description comes from an analysis cited as not independently confirmed in the material, it helps explain the kind of risk administrators face: this is not just a one-off execution, but a possible persistent foothold afterward, with web shell loading and system artifact collection capabilities.

From a defensive standpoint, this case illustrates a common problem with embedded components in collaboration suites: the final administrator often thinks first about functional availability, not attack surface. If Nextcloud depends on an external application to render documents, that integration becomes part of the organization's logical perimeter. The right response is not only to update, but also to review the add-on inventory, service startup state, container dependencies, and hardening routines that treat "services not running" as a potentially vulnerable state, not as safe by definition.

SC Media's warning that disabling the application is not sufficient mitigation aligns with that reading, but in this report it is used as a secondary reference and priority is given to the official advisory. The main lesson for regional teams is that collaboration suite security cannot be left solely to its visible layer. Integrated modules, wrappers, and embedded servers are often where architectural complexity turns into operational risk.

PHP2Shell: a cross-cutting flaw affecting multiple branches and deployments

The second block of the period is broader and more worrying in systemic reach, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. CISA described both as critical unauthenticated remote code execution vulnerabilities in PHP installations serving web requests, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. That range of environments makes clear that this is not an isolated lab case, but a condition affecting common deployment paths in traditional servers, containers, hosting platforms and development stacks that use PHP as an application engine.

PHP2Shell matters operationally because of the combination of ubiquity and pre-authentication. CISA asked organizations to apply the available fixes immediately in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and recommended temporarily removing systems that cannot be updated from the Internet, especially those still using PHP 8.1 or earlier without support. The Canadian Centre for Cyber Security agreed that branches 8.2.x, 8.3.x, 8.4.x and 8.5.x earlier than those versions were affected, and expanded the alert to third-party products, devices and containers that include vulnerable PHP components. In other words, the risk is not limited to "servers with PHP installed," but also to packaged solutions that carry that runtime.

Unit 42 explained that CVE-2026-109618 is linked to memory initialization bugs that leave partially initialized data, while CVE-2026-109619 involves use-after-free references. In both cases, the result can be remote code execution. The CVSS 9.2 score and the classification as pre-authenticated remote code execution vulnerabilities confirm that the issue is not merely theoretical. In addition, the fact that the risk is greater in Apache with mod_php suggests that the interaction between server modules and the PHP worker process remains a point of concentrated impact.

The period's timeline reinforces the urgency. ANCI in Chile issued an alert about two critical vulnerabilities affecting PHP and recommended installing updates immediately; days later it added background on exploitation attempts observed since October 17, 2026, and identified a related vulnerability, CVE-2026-115560. In Peru, CNSD reported exploitation attempts for CVE-2026-109618 and CVE-2026-109619 and recommended installing the vendor's patches; the Presidency of the Council of Ministers, through the same body, communicated preventive measures to security and technology leads in public agencies. In Paraguay, CERT-PY warned about WhatsApp account theft through voicemail access, but the Electoral Justice also temporarily suspended its websites after an alert related to these PHP vulnerabilities. Although these events do not mean all institutions were compromised, they do show a pattern of precautionary response to a high-impact class of flaw.

For defense teams, PHP2Shell demands a broader approach than simply installing patches. Microsoft recommended updating all PHP deployments, including virtual machines, containers, base images and platform runtimes. It also warned that container images must be rebuilt and redistributed because updating the host does not update the PHP included in the image. This point is crucial: many organizations believe they have closed the gap because they patched the node or VM, but if the application runs from an old image, the vulnerable component remains in circulation. The risk multiplies when operations depend on accelerated deployment pipelines and artifacts that are reused across environments.

AWS added to that idea by noting that a remote unauthenticated attacker can send web requests designed to execute arbitrary code, read data accessible to the process, or trigger a denial of service in affected PHP workers. It also said PHP 5.4 through 8.1 did not have an available compiled upstream fix. That observation forces a more mature inventory review: if an organization is still running older branches or dependencies that can only be fixed through backports, the priority is no longer just "install the newest version," but to assess whether the stack's support cycle allows a realistic response or whether external exposure must be removed.

The appearance of vendor, CERT and response-team material in several countries during the same interval suggests a cascade effect typical of ubiquitous vulnerabilities: first comes the technical warning, then regulatory or institutional alerts, and finally local containment measures. The risk for the region is not only technical but also one of coordination. An exposed PHP service can be critical for government, banking, telecom, education or e-commerce; if updating depends on several layers of approval, the exposure window gets longer. In that context, the most sensible recommendation for CISOs is to establish expedited patch paths for critical runtimes, continuous version inventory, and temporary Internet removal policies when immediate updating is not feasible.

Cisco Secure Firewall ASA and FTD: denial of service in SSL VPN with real-world exploitation

The third major incident of the month was CVE-2026-76418 in Cisco Secure Firewall ASA and Cisco Secure Firewall Threat Defense (FTD). Cisco's official advisory described a denial-of-service vulnerability in the remote access SSL VPN service. A remote unauthenticated attacker could send a specially crafted request when secondary authentication was configured in a tunnel group, which could cause the device to reboot unexpectedly and result in a denial of service. The picture is clear: this is not about code execution or data theft, but about operational interruption in a perimeter control that is often indispensable for remote secure access.

Confirmation of real-world exploitation came through official agencies and response centers. CTIR Gov.br reported that Cisco confirmed real-world exploitation and that the vulnerability affects ASA and FTD; CISA also added it to its Known Exploited Vulnerabilities catalog, reinforcing that this was not an isolated hypothesis. The Canadian Centre for Cyber Security echoed Cisco's guidance and listed the affected and fixed versions. That set of advisories has an important practical meaning: when several independent authorities agree that exploitation is occurring, the margin for a gradual prioritization effectively disappears.

SecurityWeek added a useful operational detail: the attack required an unpatched firewall, an accessible SSL VPN login service, and secondary authentication configured in an affected tunnel group. That precision should not be used to downplay the problem; on the contrary, it helps narrow the set of devices at risk and focus remediation. For network and security teams, the message is that the combination of remote exposure, advanced authentication settings and critical access services can create unexpected failure surfaces. The presence of "secondary authentication" does not always reduce risk, in this case, it is part of the trigger.

Cisco published fixes for multiple ASA and FTD branches, including ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48 and 9.24.1.27/9.24.10.1, and FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1. The breadth of fixed branches indicates that the issue affected a wide range of operating environments. For many teams, the challenge will not only be installing a newer version, but also fitting the update into maintenance windows, high-availability policies and remote access service validations that cannot be interrupted without planning.

From a continuity perspective, this incident is a reminder that edge devices should not be treated as simple self-contained appliances. A firewall with SSL VPN is not just a barrier, it is also a point of access for users, administrators and contingency operations. If it reboots unexpectedly, the effect can go far beyond a momentary connectivity loss, it can disrupt remote operations, technical support, emergency access and administrative sessions. In organizations that depend on VPN for distributed work or incident response, that can mean significant operational degradation.

The comparison with the other cases in the month is useful. Unlike PHP2Shell, where the issue is unauthenticated remote code execution in a general-purpose runtime, Cisco's flaw affects a specific service with a narrower trigger condition. Unlike Collabora/Nextcloud, where the issue is activated in a state where the CODE server is not running, here the trigger depends on a tunnel group with secondary authentication. That diversity of conditions shows why defensive teams cannot rely on generic severity lists, they need to understand the exact preconditions of each vulnerability to know whether they are truly exposed.

Other alerts during the period: background context and signs of operational pressure

Although this report prioritizes incidents with confirmed active exploitation, the material from the period includes other signals that help frame the context. The CISC/MJSP bulletin published on the official gov.br domain on October 6 acts as a cybersecurity alert roundup for Brazil and included, among other items, active exploitation of an authentication bypass in Fortinet devices and CVE-2025-20265 with CVSS 10.0, as well as "Zero-Days TOOLSHELL - SharePoint Servers", a CrowdStrike product update flaw, a campaign targeting .gov.br domains, CVE-2026-42031 and CVE-2026-44277 in FortiAuthenticator. The presence of multiple alerts in a single publication suggests simultaneous pressure on Brazilian administrators, although it does not by itself establish any relationship among all the events.

In the case of Fortinet, the available material in this period is not enough to attribute confirmed active exploitation to CVE-2026-44277; The Hacker News text only identifies the flaw as an improper access control problem in FortiAuthenticator and makes clear that the available fragment does not confirm active exploitation or provide additional details. The correct way to use that data in a report like this is as an exposure indicator, not as a confirmed incident. Even so, the fact that it appears in the Brazilian bulletin alongside other critical alerts reinforces the need to watch authentication and access-control products, which often become preferred targets when attackers look to pivot inside infrastructure.