IT security 2026-10-22

Level Tense — 72/100 — 2026-10-22

Tense day: 27 stories ranked, 2 of the top 10 reported as actively exploited, 0 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: PHP fixes two critical unauthenticated RCE flaws ('php2shell', CVE-2026-109618 and CVE-2026-109619) (81/100).

1. PHP fixes two critical unauthenticated RCE flaws ('php2shell', CVE-2026-109618 and CVE-2026-109619) — 81/100 (CVE-2026-109618)
2. Cisco Expressway Series flaw allows unauthenticated remote command execution as root — 74/100
3. Exploited Plex Media Server SSRF vulnerability can be chained with other flaws — 66/100 (CVE-2026-96652)
4. ClickFix attacks use fake AI installers and chatbot platforms to lure users into running malware — 63/100
5. Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerability — 53/100
6. Multiple Cisco Products Snort 3 Denial of Service Vulnerabilities — 51/100
7. Ubuntu 26.10 receives U-Boot fixes for NFS response handling vulnerabilities — 47/100
8. USN-8946-1: Unbound vulnerabilities — 46/100
9. Snort 3 hardening releases address out-of-bounds write vulnerabilities — 45/100 (CVE-2026-20043)
10. Ubuntu USN-8951-1 fixes c-ares vulnerabilities causing crashes and possibly code execution — 44/100