IT security 2026-10-26

Level Tense — 69/100 — 2026-10-26

Tense day: 16 stories ranked, 2 of the top 10 reported as actively exploited, 0 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Critical PHP Vulnerability Allows Remote Code Execution (84/100).

1. Critical PHP Vulnerability Allows Remote Code Execution — 84/100 (CVE-2026-109618)
2. Brotli decoder flaw CVE-2026-111497 enables code execution; Node2Shell PoC runs on official Node.js build — 70/100 (CVE-2026-111497)
3. Malicious AGENTS.md file in Downloads folder tricked AI coding agent into installing rogue npm package — 50/100
4. Unpatched Tailscale SSH flaws could let a compromised tailnet device gain root on reachable servers — 50/100
5. Synthetic identity fraud causes $2.4 billion in losses for US lenders — 50/100
6. Critical ASP.NET Core remote code execution vulnerability (CVE-2026-102870) — 43/100 (CVE-2026-102870)
7. ASP.NET Core default permissions flaw permits local privilege escalation — 43/100 (CVE-2026-114148)
8. Unitree Go2 update fixes remotely reachable command injection — 41/100 (CVE-2026-115995)
9. Inactive AI agents pose risk of sensitive data access — 35/100
10. OpenAI reports potential VM escapes and sandbox communication in AI agents — 35/100