IT security 2026-10-23

Level Critical — 85/100 — 2026-10-23

Critical day: 29 stories ranked, 5 of the top 10 reported as actively exploited, 2 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: PHP 'php2shell' critical flaws (CVE-2026-109618, CVE-2026-109619) allow unauthenticated RCE; CISA and NCSC urge immediate patching (80/100).

1. PHP 'php2shell' critical flaws (CVE-2026-109618, CVE-2026-109619) allow unauthenticated RCE; CISA and NCSC urge immediate patching — 80/100 (CVE-2026-109618)
2. Collabora Online CODE Server OS Command Injection Vulnerability — 75/100 (CVE-2026-110447)
3. Arista VeloCloud Orchestrator SQL Injection Vulnerability — 74/100 (CVE-2026-114625)
4. Multiple vulnerabilities in Langflow exposed by Metasploit modules — 70/100
5. zlib vulnerability allows for heap buffer overflow — 65/100
6. Capcom confirms CAPCOM ID breach exposing information for 11.7 million accounts — 63/100
7. Infostealer targeting AI tools and cloud credentials — 60/100
8. Compromised eMudhra Intermediate Certificates — 60/100