Critical Vulnerabilities in PHP Require Immediate Patching
2026-10-21T15:24:04Z•a4468a4361e2c4416f49c79f6f5c8c8523bac2b4cec8adc55b5260445dc36627
CVE-2025-61624CVE-2026-0322CVE-2026-102764CVE-2026-104935CVE-2026-105133CVE-2026-105134CVE-2026-106931CVE-2026-109618CVE-2026-109619CVE-2026-110936CVE-2026-21589CVE-2026-76519CVE-2026-96652CVE-2026-96654CVE-2026-96655CVE-2026-96656AhsayCBSAtlassianBeyondTrust Remote SupportCISACisco Secure Email GatewayFortinetIvanti Connect SecureKEVPHPPalo Alto PAN-OSPlex Media ServerSiemens Software Centeractive-exploitationcritical-vulnerabilitiesincident-responseknown-exploited-vulnerabilitiespatch-managementremote-code-executionvulnerability-management
What happened
CISA advisories from October 2026 warn of critical PHP remote-code-execution vulnerabilities, actively exploited vulnerabilities added to the KEV Catalog, and urgent exploitation of BeyondTrust Remote Support and Ivanti Connect Secure flaws. Organizations should prioritize patching internet-facing systems, restrict exposure, investigate potential compromise, and monitor for post-exploitation activity.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- a4468a4361e2c4416f49c79f6f5c8c8523bac2b4cec8adc55b5260445dc36627
- Enrichment time
- 2026-10-21T15:24:04Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.