IT security 2026-10-29

Level Critical — 100/100 — 2026-10-29

Critical day: 30 stories ranked, 7 of the top 10 reported as actively exploited, 3 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Oracle PeopleSoft PeopleTools flaw CVE-2026-35273 exploited by ShinyHunters is three chained bugs, patched in June (95/100).

1. Oracle PeopleSoft PeopleTools flaw CVE-2026-35273 exploited by ShinyHunters is three chained bugs, patched in June — 95/100 (CVE-2026-35273)
2. PHP out-of-memory flaw can allow remote code execution — 94/100 (CVE-2026-109618)
3. PHP Stale Internal Request-State Vulnerability (CVE-2026-109619) — 90/100 (CVE-2026-109619)
4. Exploited Google Brotli decoder flaw can expose memory or potentially execute code — 89/100 (CVE-2026-111497)
5. Cisco SD-WAN Controller Authentication Bypass Vulnerability (CVE-2026-20127) — 88/100 (CVE-2026-20127)
6. Exploited Linux kernel flaw can support PHP attack chains leading to root commands — 75/100 (CVE-2026-46300)
7. Attackers probe recently patched Oracle E-Business Suite code execution flaw — 70/100 (CVE-2026-101767)
8. Cisco ASA and FTD SSL VPN flaw can cause device reloads with secondary authentication configured — 64/100 (CVE-2026-76418)
9. Cisco advisory covers Node.js vulnerabilities with code execution and interception risks — 62/100
10. Broadcom VMware ESX insufficient logging vulnerability — 60/100 (CVE-2026-41709)