IT security 2026-10-27

Level Critical — 97/100 — 2026-10-27

Critical day: 24 stories ranked, 5 of the top 10 reported as actively exploited, 2 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: PHP out-of-memory flaw can allow remote code execution (94/100).

1. PHP out-of-memory flaw can allow remote code execution — 94/100 (CVE-2026-109618)
2. PHP stale internal request-state vulnerability exploited in the wild — 90/100 (CVE-2026-109619)
3. Dahua surveillance cameras exploited by hackers — 88/100 (CVE-2021-33044)
4. Critical out-of-bounds write in Node.js Brotli decoder — 71/100 (CVE-2026-111497)
5. Fortinet advisory lists multiple Node.js vulnerabilities with differing release coverage — 71/100
6. Gheist Campaign Weaponizes GitHub Tokens to Steal Cloud Secrets — 70/100
7. Ubuntu nginx notice describes configuration-dependent denial of service and possible code execution — 67/100
8. Magento Store Infection Campaign — 65/100
9. Fortinet ships security updates for FortiOS and other products, withholds vulnerability details until November 10 — 62/100
10. libwebsockets MQTT Protocol PUBACK Vulnerability — 60/100 (CVE-2026-114550)