IT security 2026-10-28

Level Critical — 100/100 — 2026-10-28

Critical day: 30 stories ranked, 6 of the top 10 reported as actively exploited, 4 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: PHP out-of-memory flaw can allow remote code execution (94/100).

1. PHP out-of-memory flaw can allow remote code execution — 94/100 (CVE-2026-109618)
2. PHP stale internal request-state flaw CVE-2026-109619 exploited, added to CISA KEV — 90/100 (CVE-2026-109619)
3. Exploited Google Brotli decoder vulnerability can corrupt memory and potentially execute code — 89/100 (CVE-2026-111497)
4. Adobe Commerce and Magento file upload vulnerability is actively exploited — 84/100 (CVE-2026-48356)
5. Apple backports fixes for exploited CoreGraphics vulnerability to older iPhones and iPads — 82/100 (CVE-2026-86950)
6. Gheist campaign uses stolen GitHub tokens to plant workflows that exfiltrate secrets from private repositories — 70/100
7. Node.js security updates affect RCE and traffic interception — 65/100
8. HPE patches networking vulnerabilities with code execution and authentication bypass risks — 65/100
9. Tailscale is preparing fixes for SSH flaws involving credential theft and root access — 63/100
10. Microsoft issues out-of-band Windows updates to distrust certificates tied to compromised eMudhra CA keys — 60/100