October 2026 set records on every axis that matters to a patch team: the most CVEs ever published in a month, the largest Microsoft Patch Tuesday in history, a certificate authority forced out of the web PKI, and two "2Shell" remote-code-execution bugs in software that runs most of the internet. This report counts what was reported, what was fixed, and what was exploited, and gives a source for every number.
Fixed (six vendors)
3,814
Microsoft 1,413 · Oracle 1,209 · Chrome 662 · Apple 329 · Adobe 176 · Android 25[4–9]
What is a CVE?
A CVE (Common Vulnerabilities and Exposures) is a public ID number for one specific, known security flaw, for example CVE-2026-109618. It lets vendors, security tools and defenders all refer to the same bug. IDs are issued by hundreds of approved organisations, including Microsoft, Google and the Linux kernel team, and collected in one public list[77]. A CVE count measures flaws disclosed, not attacks.
Who pays for it: the program was started in 1999. It is run by the non-profit MITRE Corporation and funded by the US government through CISA, the Department of Homeland Security's cyber agency. The funding nearly lapsed in April 2025 and was saved by a last-minute extension[78]. In early 2026 it was moved to a protected line in CISA's budget[79].
1. The numbers
CVEs published per month, Oct 2025 – Oct 2026
PublishedOct 2026, 1–27 OctOct 2026 projection (16,208)
Source: cve.0xosprey.com raw data (CVEProject/cvelistV5 published records, by publish date), generated 2026-10-28 07:02 UTC[1]. September cross-checked against NVD API (14,933 excluding rejected)[2]. October 2026 to date is 3.4× October 2025; 2026 year-to-date (87,315) is already 1.8× all of 2025 (48,151).
Table view
| Month | CVEs published |
|---|---|
| Oct 25 | 4,274 |
| Nov 25 | 3,020 |
| Dec 25 | 5,493 |
| Jan 26 | 4,302 |
| Feb 26 | 4,616 |
| Mar 26 | 6,236 |
| Apr 26 | 5,813 |
| May 26 | 6,933 |
| Jun 26 | 7,949 |
| Jul 26 | 9,759 |
| Aug 26 | 12,259 |
| Sep 26 | 14,934 |
| Oct 26 | 14,514 |
| Oct 26 (projected) | ~16,208 |
How long it used to take to publish October's 14,500 CVEs
Months from 1 January needed to reach about 14,500 published CVEs in each year. October 2026 got there in 27 days.
- 1999–2016: no single year reached that number. The busiest, 2014, published 7,928. All of 2015 and 2016 combined came to 12,951, still fewer than October 2026's first 27 days.
- 2017 was the first year to get there, and it took all twelve months (14,642 for the year).
- Since then the time has shrunk almost every year, from a year to under a month in less than a decade.
Computed from the cve.0xosprey.com monthly series (cvelistV5 published records, by publish date; rejected records excluded)[1]. Threshold: 14,514, the October 2026 count for 1–27 Oct. Historical totals reflect today's CVE list, so they can differ slightly from figures reported at the time.
Table view
| Year | Time to ~14,500 CVEs | Note |
|---|---|---|
| 2017 | 12 months | Full year: 14,642 |
| 2018 | 11 months | Full year: 16,510 |
| 2019 | 11 months | Full year: 17,308 |
| 2020 | 10 months | Full year: 18,363 |
| 2021 | 9 months | Full year: 20,177 |
| 2022 | 8 months | Full year: 24,999 |
| 2023 | 7 months | Full year: 28,847 |
| 2024 | 5 months | Full year: 39,924 |
| 2025 | 4 months | Full year: 48,151 |
| 2026 (from Jan) | 3 months | Jan–Mar 2026: 15,154 |
| October 2026 | 27 days | 14,514 in 1–27 Oct |
| 1999–2016 | never in one year | Largest year: 2014, 7,928 |
Vulnerabilities fixed in October 2026, by vendor
Microsoft: 1,413 per SecurityWeek[4] (outlets report 1,403–1,416 depending on scope; MSRC's own feed lists 1,416 entries first published 13 Oct[5]). Oracle: 1,209 unique CVEs (1,295 patches)[6]. Chrome: sum of security fixes in four stable releases (247 + 10 + 353 + 52)[7]. Apple: unique CVE IDs across ten 26 Oct advisories[8]. Adobe: 176 CVEs in 11 bulletins on 13 Oct, counted from Adobe's own bulletins (175 after one ColdFusion CVE was withdrawn on 21 Oct; four more bulletins followed on 27 Oct and are not included)[88][9]. Android: October bulletin[10]. SAP shipped 16 new notes (4 critical) and is not charted because notes are not CVEs[11]. Cisco has no verifiable monthly total.
Table view
| Vendor | Fixed | Basis |
|---|---|---|
| Microsoft | 1,413 | CVEs, 13 Oct Patch Tuesday (SecurityWeek) |
| Oracle | 1,209 | Unique CVEs in Oct CPU (1,295 patches) |
| Google Chrome | 662 | Security fixes, 4 stable releases |
| Apple | 329 | Unique CVEs, 10 advisories (26 Oct) |
| Adobe | 176 | CVEs, 11 bulletins (13 Oct) |
| Android | 25 | CVEs, Oct bulletin |
CVEs added to CISA's Known Exploited catalog, by month (2026)
Computed from the CISA KEV JSON feed, catalog version 2026.10.27 (1,760 entries), filtered on dateAdded[3]. October is to 27 Oct. 2026 has 276 additions so far vs 245 in all of 2025. September's 43 is the year's peak; October is on pace to match it. None of October's 30 additions is flagged as known ransomware use, and most carry a 3-day remediation deadline.
Table view
| Month | KEV additions |
|---|---|
| Jan | 17 |
| Feb | 28 |
| Mar | 26 |
| Apr | 31 |
| May | 21 |
| Jun | 23 |
| Jul | 26 |
| Aug | 31 |
| Sep | 43 |
| Oct* | 30 |
Notable vulnerability incidents over the last 12 months, tracked by pwn.watch
pwn.watch is a live tracker of significant "patch now" vulnerability incidents, the kind that send teams scrambling. It logged 231 in the last 12 months, and 60 in October 2026 alone: double September and four to seven times a typical month earlier in the year. Each square below is one day; darker means more, and more severe, incidents.
Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½Less More
- It sped up during the month: 5 incidents started in the first week of October, 11 in the second, 23 in the third and 21 in the fourth (to 28 Oct).
- They got more serious, too: 35 of October's incidents were rated critical, against 3 in September.
- Confirmed exploitation hasn't caught up (yet): 186 of the 231 incidents are tagged as exploited (on CISA's list, a zero-day, or "exploited"), including 29 of September's 30. Only 19 of October's 60 carry those tags so far. October's surge is mostly critical flaws that need patching now, not yet confirmed attacks, and tags can lag behind for very recent incidents.
- Counting data breaches and supply-chain attacks as well, pwn.watch logged 107 incidents that started in October.
Recreated from pwn.watch's public incidents feed (incidents.json, generated 2026-10-28 10:45 UTC), "patch now" category, by incident start date, using pwn.watch's severity weighting; "update ½" adds half a point on the day an incident was last updated[90]. pwn.watch is a curated list of notable incidents, not a complete census; a saved copy of the feed is in sources/.
Table view
| Month | Incidents |
|---|---|
| Nov | 11 |
| Dec | 18 |
| Jan | 8 |
| Feb | 13 |
| Mar | 11 |
| Apr | 14 |
| May | 12 |
| Jun | 13 |
| Jul | 17 |
| Aug | 21 |
| Sep | 30 |
| Oct* | 60 |
Why the gap matters. About 1 in 480 of October's published CVEs has so far landed in CISA's exploited catalog (30 of 14,514). At this volume, triage by "is it exploited, and do we run it" is the only workable filter. Patch-everything is no longer a plan.
2. The headline incidents
The Wikipedia article that named the month lists five defining events: eMudhra, PHP2Shell, LiteLLM, GitLab and Brotli[12]. Mainstream coverage (The Guardian, Washington Post, CNBC) framed the month around AI-assisted vulnerability discovery[13].
Microsoft Patch Tuesday: a record 1,413 fixes 1 exploited zero-day
13 Oct · CVE-2026-96951 (exploited) · CVE-2026-108398, CVE-2026-92707 (publicly disclosed)
- 1,413 vulnerabilities fixed: Windows 1,102, Office 134, developer tools 61, SharePoint 36. SecurityWeek reports this single month exceeds Microsoft's entire 2025 total[4].
- Other outlets count 1,411 (BleepingComputer, 70 critical), 1,416 (PCWorld) and 1,403 (SonicWall, 77 critical), because they scope differently[14].
- The previous record was September 2026: 974, so October is about 1.45× it[15].
- Exploited zero-day CVE-2026-96951, a Windows Shell Mark-of-the-Web bypass (CVSS 8.8), was added to KEV the same day with a 16 Oct deadline[3]. Outlook Reading Pane RCE CVE-2026-70242 (CVSS 9.8) was also fixed, with no reported exploitation[16].
PHP2Shell: unauthenticated RCE in PHP Exploited · KEV 26 Oct
CVE-2026-109618 · CVE-2026-109619 · CVSS v4 9.2 · disclosed and patched 21 Oct
eMudhra: CA private keys you could guess Root distrusted
17–22 Oct · no CVE for the CA itself · Go fix tracked as CVE-2026-111943 · Mozilla bug 2083449
- Eight eMudhra intermediate certificate authorities had private keys small enough to guess. One key was literally 4. Browsers blocked them within hours, the eMudhra root is being removed from browser trust stores, and eMudhra is leaving the public TLS business[21][23].
- See the close look in section 4.
Brotli "Node2Shell": decoder out-of-bounds write Exploited · KEV 27 Oct
CVE-2026-111497 · CVSS v4 9.2 (Google) · published 22 Oct
- An invalid block switch was reported as "needs more input" rather than an error, so the streaming decoder kept writing past an 8-byte buffer. Brotli 1.0.3–1.2.0 are affected, along with everything that embeds them: Node.js, Firefox, Thunderbird, curl builds and Python bindings[26][27].
- Fixed in Brotli 1.0.10 / 1.1.1 / 1.2.1 and Node.js 22.23.4 / 24.22.1 / 26.12.1. Node 20 and older are end-of-life and get no fix[28][26].
- Red Hat rates it Important (CVSS 8.1) and lists RHEL 7, 8, 9 and 10 as affected[85].
- Press up to 24 Oct reported no exploitation, but CISA added it to KEV on 27 Oct. No public detail of the attacks has been found[3].
LiteLLM supply-chain compromise Malware published
21 Oct · litellm 1.107.0 (PyPI, Docker Hub, GHCR) · safe version 1.106.2
- Attackers used stolen GitHub CLI OAuth tokens to publish an info-stealer build. It was live on PyPI 11:39–13:23 UTC and on the container tags until about 14:20 UTC[29][30].
- This is LiteLLM's second compromise of 2026, after versions 1.82.7 and 1.82.8 in March (TeamPCP). It caps a year of open-source supply-chain attacks, most from TeamPCP's March cascade and the self-spreading "Mini Shai-Hulud" worm of late April–May[41][42].
2026 supply-chain compromises for context (15 incidents)
| Package | Date (2026) | Malicious versions | Campaign |
|---|---|---|---|
| dydx-v4-client | ~5 Feb | PyPI 1.1.5post1; npm versions disputed | Unattributed |
| xygeni-action | 3–10 Mar | @v5 tag poisoned (CVE-2026-31976) | Unattributed |
| trivy-action / setup-trivy | 19 Mar | 76 of 77 tags force-pushed | TeamPCP |
| litellm | 24 Mar | 1.82.7, 1.82.8 | TeamPCP |
| telnyx | 27 Mar | 4.87.1, 4.87.2 | TeamPCP |
| axios | 31 Mar | 1.14.1, 0.30.4 (RAT dropper) | Sapphire Sleet (DPRK), per Microsoft |
| @cap-js (SAP) | 29 Apr | sqlite 2.2.2, postgres 2.2.2, db-service 2.10.1 | Mini Shai-Hulud |
| lightning (pytorch-lightning) | 30 Apr | 2.6.2, 2.6.3 | Linked by secondary sources |
| intercom-client | 30 Apr | 7.0.4 | Mini Shai-Hulud |
| @tanstack | 11 May | 84 artifacts (react-router, history…) | Mini Shai-Hulud |
| mistralai | 11 May | PyPI 2.4.6; npm mistralai-gcp 1.7.1–1.7.3 | Mini Shai-Hulud |
| guardrails-ai | 11 May | 0.10.1 | Mini Shai-Hulud |
| nx-console (VS Code) | 18 May | 18.95.0 (CVE-2026-48027) | TeamPCP |
| pantheon-agents | 8 Jun | 0.6.1, 0.6.2 | Shai-Hulud "Hades" wave |
| litellm | 21 Oct | 1.107.0 | Unattributed |
GitLab pre-auth RCE, CVSS 10.0 Patched · not yet exploited
CVE-2026-110264 · out-of-band patch 21 Oct (19.5.1 / 19.4.3 / 19.3.6)
Other actively exploited October bugs
| CVE | Product | What | KEV added | Patch | Source |
|---|---|---|---|---|---|
| CVE-2026-104935 | Ivanti Connect Secure | Auth bypass, chained by UTA0576 since ~1 Oct | 13 Oct | Partial one chained flaw still open at last report | [32] |
| CVE-2026-0322 | Palo Alto PAN-OS | Mgmt-interface code injection (auth, root), CVSS v4 8.6 | 14 Oct | Yes | [33] |
| CVE-2026-76519 | Cisco Secure Email Gateway | Root via crafted attachment, CVSS 9.8 | 14 Oct | Yes | [34] |
| CVE-2026-21589 | Atlassian Data Center (8 products) | Unauth file read, CVSS 9.3; attacked ~2 h after PoC | 15 Oct | Yes | [35] |
| CVE-2026-102764 | BeyondTrust Remote Support | Auth bypass, CVSS v4 9.3; exploited since 29 Aug | 16 Oct | Yes | [36] |
| CVE-2026-110447 | Collabora CODE / Nextcloud | OS command injection, CVSS v4 9.2; web shells deployed | 23 Oct | Yes | [37] |
| CVE-2026-48356 | Adobe Commerce / Magento | Unrestricted file upload (APSB26-73) | 27 Oct | Yes | [38] |
3. Spotlight: PHP2Shell, the scale of a single bug
Most CVEs affect one product. PHP2Shell affected the language that most of the web is written in. Within 48 hours, governments on five continents told organisations to take their websites offline if they couldn't patch, and many governments did exactly that to their own sites.
What happened, in plain terms
PHP is the engine behind most websites. When you load a page on a news site, a shop or a council website, there is a good chance a PHP program on the server builds it. That includes every WordPress site, along with Drupal, Joomla and the cPanel and Plesk hosting panels[57][60].
The bug: when PHP runs out of memory or hits a fatal error partway through handling a visitor's request, it doesn't clean up properly. Leftover scraps of that request stay behind, and the next visitor's request reuses them. A specially crafted request can turn those scraps into control of the server[17].
Why it's so serious: the attacker needs no password, no account and no help from anyone inside. Sending web requests to the site is enough. Once in, the attacker is running code on the server and can reach its files, its database and whatever else it is connected to. The bug has existed since PHP 5.4, roughly 14 years of releases[17][66].
An analogy: imagine a flaw in the lock fitted to 7 out of 10 buildings in the world, which lets a stranger open the front door without a key. Instructions on how to do it leaked on the same day the fix was announced.
The scale, in numbers
No official fix
59%
of version-reporting PHP hosts run versions PHP no longer supports (883,717 hosts)[59]
Attack attempts
Millions
blocked by Cloudflare within a day of disclosure; attempts started ~10 h before it[61]
Governments saying "go offline"
10 + EU
national governments plus EU bodies advised taking, isolating or suspending unpatched systems (table below)
Timeline
| Date (2026) | What happened |
|---|---|
| 19 Aug | Wiz researchers find the first bug. Within two days they can take over default Drupal and WordPress sites[17]. |
| 24 Aug | Reported privately to the PHP project[17]. |
| 17 Oct | Amazon honeypots log an exploitation attempt, four days before anything is public[19]. |
| 20 Oct | PHP pre-announces an emergency release, and CERT-EU issues an advance advisory[51]. |
| 21 Oct, early | A leaked copy of the details appears on VirusTotal (02:29 UTC). Cloudflare begins blocking attacks at 03:02 UTC[20][61]. |
| 21 Oct | Fixes released (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35). The US, UK, Canada, France, the Netherlands, Germany, the EU and others publish warnings the same day, and government websites start going offline[18][44][48]. |
| 21 Oct, evening | Japan's Prime Minister Sanae Takaichi and the National Cybersecurity Office post on X that temporarily stopping websites is an effective way to reduce the risk[86]. |
| 22 Oct | Japan (IPA), New Zealand, Ghana and South Korea follow. South Korea raises its national cyber alert level[53][68]. |
| 23 Oct | Canada's Cyber Centre flags a third bug, CVE-2026-115560, that the 21 Oct patches do not fix. The workaround is to set session.upload_progress.enabled=0[45]. |
| 24 Oct | Researchers' honeypots record 35 successful takeovers. Some payloads are Mirai-family botnet malware[62][60]. |
| 26 Oct | CISA adds both CVEs to its exploited list. US federal agencies must fix them by 29 Oct, a 3-day deadline[43]. |
| 27 Oct | No victim organisation has been publicly confirmed yet. Delft University's tracker counts 50,000+ attack requests from 600+ addresses in 70 countries[62]. Fastly reports about 250,000 requests from about 3,200 addresses, roughly a third of them defensive scanning[84]. |
Governments that said "patch it, or take it offline"
Governments almost never tell the public to switch websites off. For PHP2Shell, at least 10 national governments and the EU said, in some form, that if you can't patch you should take the system offline, disconnect it, isolate it from the internet or suspend the service. There was no single joint "Five Eyes" advisory. Each agency published separately and the US CISA alert links to the others[18]. The EU's statement was co-signed by the Commission, ENISA, CERT-EU, Europol and the national CSIRTs network[52].
| Country | Agency | Date | What they told organisations (quoted) | Checked | Src |
|---|---|---|---|---|---|
| 🇺🇸 United States | CISA | 21 Oct | "take PHP-based systems offline until they can be patched or updated" | Primary | [18] |
| 🇺🇸 United States | NSA, FBI Cyber Division | 21 Oct | "take the system offline until it can be fully mitigated" | Primary | [56] |
| 🇬🇧 United Kingdom | NCSC | 21 Oct | "you should consider taking the system offline until it can be fully mitigated" | Primary | [44] |
| 🇨🇦 Canada | Canadian Centre for Cyber Security (AL26-026) | 21 Oct | "consider isolating internet-facing applications from public networks until a fix can be applied" | Primary | [45] |
| 🇦🇺 Australia | business.gov.au (links ASD's critical alert) | 23 Oct | "consider taking impacted websites or systems offline until you can" | Primary | [46] |
| 🇮🇪 Ireland | NCSC Ireland | 21 Oct | isolate end-of-life PHP systems if the published mitigations can't be applied | Primary | [81] |
| 🇳🇱 Netherlands | NCSC-NL | 21 Oct | make "a risk assessment per system that uses PHP" (primary). Press quotes add: consider taking sites offline preventively. NCSC-NL took its own site offline | Primary + press | [48] |
| 🇩🇪 Germany | BSI (warning level 3 / orange) | 21 Oct | temporarily disconnecting the web server from the internet until the patch is installed; by the third revision, "the BSI recommends" it | Primary | [49] |
| 🇫🇷 France | CERT-FR / ANSSI (CERTFR-2026-ALE-014) | 21 Oct | "isoler les équipements affectés" (isolate affected equipment), then migrate to a supported version | Primary | [50] |
| 🇯🇵 Japan | IPA; PM and National Cybersecurity Office | 21–22 Oct | decide whether "blocking external access or temporarily suspending the service" is needed | Primary | [53] |
| 🇬🇭 Ghana | Cyber Security Authority and NITA | 22 Oct | unpatched services "should be taken offline temporarily", with a 7-day deadline for government bodies | Press quote | [54] |
| 🇪🇺 European Union | CERT-EU; joint statement with the Commission, ENISA, Europol EC3 and the CSIRTs Network | 20–21 Oct | "consider isolating internet-facing resources from public networks until the fix is applied and verified" | Primary | [51][52][87] |
| 🇰🇷 South Korea | MSIT and KISA | 22 Oct | raised the national cyber crisis alert to "Caution", notified ~28,000 companies; no offline wording found | Press | [68] |
| 🇸🇬 Singapore | CSA / SingCERT (AL-2026-151) | 21 Oct | "update to the latest versions immediately". Patch only, no offline advice | Primary | [55] |
Who actually went offline
Governments followed their own advice. These are precautionary shutdowns, not breaches.
| Country | Sites or services taken offline | Src |
|---|---|---|
| 🇳🇱 Netherlands | NCSC.nl, Overheid.nl, MijnOverheid, Tweede Kamer (parliament), the tax authority and benefits office | [48] |
| 🇫🇷 France | Several Interior Ministry sites (at ANSSI's request), parts of impots.gouv (tax), the CNIL data-protection authority and some universities | [64] |
| 🇫🇮 Finland | Central-government web services being shut down as a precaution by state IT centre Valtori; some stayed available | [65] |
| 🇬🇧 United Kingdom | Edinburgh and Oxford councils and the Metropolitan Police; 32 government digital services reported unavailable | [63][60][89] |
| 🇩🇪 Germany / 🇩🇰 Denmark | Federal IT service (ITZBund) sites, district councils; Denmark's Kombit and the national school platform | [63] |
| 🇦🇺 Australia | cyber.gov.au (the national cyber agency's own site) and the Bureau of Statistics | [66] |
| 🇨🇦 Canada | Some federal government websites and apps, plus Montreal's transit authority (STM) and Quebec's liquor board (SAQ) | [67] |
| 🇯🇵 Japan | Services at Mizuho, MUFG units, Shizuoka Bank, ANA, JAL, JR East and Seven-Eleven Japan | [61] |
| 🌐 Wikimedia | Supporting services such as Phabricator, as a precaution | [71] |
It's not just websites: products with PHP inside
PHP is built into firewalls, routers, NAS boxes, hosting control panels and business appliances, often where the owner can't see it or patch it themselves. The Dutch NCSC's public list of affected products held 751 entries by 23 Oct. 220 were marked vulnerable (many as a precaution), 109 fixed and 389 still under investigation[69].
- Palo Alto PAN-OS and Panorama (firewalls) were affected and unfixed as of 22 Oct[19].
- Fortinet said FortiOS, FortiManager, FortiAnalyzer and FortiWeb are not affected[70].
- Sophos found a vulnerable PHP version on one of its own customer portals. cPanel and CloudLinux shipped patched PHP builds to hosting providers[60].
Where it stands (27 Oct)
- Attacks are real and widespread, but no victim has been confirmed. CISA lists the bug as exploited, and honeypots were successfully taken over. Still, no organisation has publicly confirmed a breach, and several early claims were withdrawn[62].
- The long tail is the problem. About 59% of PHP servers that report a version run releases the PHP project no longer fixes. Those owners depend on hosting providers, Linux distributions or the unofficial backports PHP published[59][19].
- Patched is not the same as clean. The UK NCSC warns that patching doesn't remove a backdoor that was already planted, and CISA's exploited-list entry requires forensic triage. Check for compromise after updating[44][3].
For a non-technical reader: one programming mistake, in software most people have never heard of, led governments in a dozen countries to switch off their own websites within two days. That is the scale problem in one example. October 2026 published more than 14,500 CVEs. Most will never matter to your organisation, but any one of them can turn out to be PHP2Shell.
4. Close look: eMudhra and the private key that was "4"
PHP2Shell showed how far one bug can reach. eMudhra shows how fragile the web's trust system is when a single step goes wrong. A certificate authority generated keys that should have been impossible to guess, and one of them was the number four.
What happened, in plain terms
Certificate authorities are the web's notaries. The padlock in your browser means a certificate authority (CA) vouched that the site really is who it claims to be. Browsers trust a short list of root CAs, and the roots delegate day-to-day signing to intermediate CAs. Anyone holding an intermediate's private key can issue certificates that every browser accepts, for any website, including your bank.
A private key is supposed to be an unguessable number. For the type of key eMudhra used (P-384), that number is chosen at random from roughly 10115 possibilities. That is far more than the number of atoms in the observable universe.
eMudhra's weren't. Eight of its intermediate CAs had private keys below 256, so anyone could find them by trying at most 255 numbers, which takes a fraction of a second. The key for "EM OV TLS CA - G3C" was published by a researcher: it was 4[21]. The full set of eight keys was 4, 56, 66, 115, 155, 156, 230 and 237[80].
An analogy: a notary's official seal turned out to be a pattern anyone could copy, and it had been sitting in the notary's drawer, unnoticed, for 18 months.
When a joke becomes an incident report. In 2007 the webcomic xkcd published "Random Number": a function that always returns 4, with the comment "chosen by fair dice roll. guaranteed to be random."[74] For nearly two decades it has been the security world's shorthand for fake randomness. In October 2026 a real certificate authority shipped a private key equal to 4, and the comic was being shared again as a straight description of what had happened.
How it happened
- 30 April 2025, key ceremony: eMudhra generated 24 new intermediate keys in a formal key ceremony. A flaw in a wrap/unwrap test step of the generation script created a second, weak key pair inside the hardware security module[22].
- The wrong keys were used: the weak keys had labels resembling the real ones, so they were used to request certificates from eMudhra's root and from Sectigo, which cross-signed them. eMudhra calls this "human errors in multiple steps"[22].
- Nobody caught it: the keys passed two annual audit cycles[22]. Certificate-revocation errors logged from May 2025 were an earlier warning sign that went unheeded[73].
- 17 October 2026, discovery: a researcher scanning public certificate data spotted the trivially small keys and reported them to the browser makers[21].
How fast the web reacted
| When (2026, UTC) | Who | What |
|---|---|---|
| 17 Oct 18:05 | Google Chrome | Report received. |
| 17 Oct 19:45 | Google Chrome | Keys blocked for all Chrome users via CRLSet, 1 hour 40 minutes after the report[23]. |
| 17 Oct 22:59 | Mozilla Firefox | Revocation (OneCRL) reaches all users, under 3 hours after Mozilla's report at 20:06[24]. |
| 18 Oct | eMudhra | All eight intermediates revoked as "CA compromise". Mozilla opens public incident bug 2083449[22]. |
| 19 Oct | Sectigo, Android | Sectigo revokes its eight related cross-signatures. Android devices receive the block via Play Services[22][23]. |
| 20–21 Oct | Mozilla, Node.js, Go | Firefox 158.0.1 and ESR releases ship. Node.js updates its bundled CA list, and Go patches (CVE-2026-111943)[24][26][21]. |
| 22 Oct | Apple; eMudhra | Apple adds protections. eMudhra announces it is leaving the global public TLS business and moves customers to Sectigo-issued certificates[21][25]. |
| ~27 Oct | Chrome, Mozilla | Removal of the emSign ECC Root CA - G3 from their trust stores (Chrome release expected 27 Oct; Mozilla via NSS 3.131.1)[23][24]. |
The damage, and what was avoided
- No evidence of misuse: Google found no TLS certificates from these intermediates in public Certificate Transparency logs before the block. eMudhra says none of the eight issued customer certificates, and seven were never used in production[23][22].
- The cost of distrust: removing the root means about 30,800 unexpired certificates chaining to it stop being trusted. Every site using one has to switch CA. About 97% were issued through automated ACME tooling, which makes the switch easier[23][22].
- Who is actually at risk: abusing a forged certificate requires an attacker who can sit in the middle of a connection. That is hard on the open internet, but much easier for whoever controls a local network (public Wi-Fi, a campus or corporate network) or for a state-level interceptor. Ars Technica singles out VPN users in such countries as the most immediately exposed[80].
- The long tail: browsers were fixed within hours, but many systems carry their own copy of the trusted roots: Linux distributions, Docker images, IoT and embedded devices, and Python tools. Go cryptography maintainer Filippo Valsorda called it "a massive cleanup job, bigger than Heartbleed"[80].
- The business outcome: a single key-generation mistake ended eMudhra's public TLS business. The browser trust programmes treat key compromise as unrecoverable, and they acted in hours, not weeks[25][75][87].
Lessons for any organisation
- Know your certificates: keep an inventory of which CAs issue your certificates. A CA can disappear in a week.
- Be able to switch CA quickly: automated issuance (ACME) turned a potential crisis into a configuration change for most affected sites.
- Trust stores live in more places than browsers: Go, Node.js, Java, Python and many appliances ship their own CA lists, and those need updates too.
- Audits are not verification: two clean audits missed keys that a researcher found with a public scan. Verify the critical controls (key generation, randomness, HSM handling) directly.
Deep dive: for a detailed narrative of the discovery and the browser makers' response, read Dan Goodin's "The Internet goes on high alert after discovery of 8 compromised TLS certs" in Ars Technica (20 Oct 2026)[80].
5. Every CVE CISA marked exploited in October
All 30 additions to the KEV catalog dated 1–27 October 2026[3]. Six are old bugs (2015–2025) newly confirmed as exploited.
| Added | CVE | Vendor | Product | Due |
|---|---|---|---|---|
| 10-01 | CVE-2026-104286 | Fortinet | FortiMail | 10-04 |
| 10-02 | CVE-2026-102489 | Zammad GmbH | Zammad | 10-05 |
| 10-02 | CVE-2026-102490 | Zammad GmbH | Zammad | 10-05 |
| 10-04 | CVE-2026-88779 | Citrix | NetScaler | 10-07 |
| 10-08 | CVE-2015-3306 | ProFTPD | ProFTPD | 10-11 |
| 10-08 | CVE-2015-5477 | ISC | BIND | 10-11 |
| 10-08 | CVE-2016-3081 | Apache | Struts | 10-11 |
| 10-08 | CVE-2021-3199 | ONLYOFFICE | Docs | 10-11 |
| 10-08 | CVE-2023-22894 | Strapi | Strapi | 10-11 |
| 10-13 | CVE-2026-104935 | Ivanti | Connect Secure | 10-16 |
| 10-13 | CVE-2026-96951 | Microsoft | Windows | 10-16 |
| 10-14 | CVE-2026-0322 | Palo Alto Networks | PAN-OS | 10-17 |
| 10-14 | CVE-2026-105133 | Ahsay | AhsayCBS | 10-17 |
| 10-14 | CVE-2026-105134 | Ahsay | AhsayCBS | 10-17 |
| 10-14 | CVE-2026-76519 | Cisco | Secure Email Gateway | 10-17 |
| 10-15 | CVE-2026-21589 | Atlassian | Multiple Products | 10-18 |
| 10-16 | CVE-2025-61624 | Fortinet | Multiple Products | 10-19 |
| 10-16 | CVE-2026-102764 | BeyondTrust | Remote Support | 10-19 |
| 10-20 | CVE-2026-106931 | EG Secure Solutions | SiteGuard Server Edition | 10-23 |
| 10-20 | CVE-2026-110936 | Siemens | Software Center | 11-03 |
| 10-20 | CVE-2026-96652 | Plex | Media Server | 11-03 |
| 10-20 | CVE-2026-96654 | Plex | Media Server | 10-23 |
| 10-20 | CVE-2026-96655 | Plex | Media Server | 11-03 |
| 10-20 | CVE-2026-96656 | Plex | Media Server | 10-23 |
| 10-23 | CVE-2026-110447 | Collabora | Online – Built-in CODE Server | 10-26 |
| 10-23 | CVE-2026-114625 | Arista | VeloCloud Orchestrator | 10-26 |
| 10-26 | CVE-2026-109618 | PHP Group | PHP | 10-29 |
| 10-26 | CVE-2026-109619 | PHP Group | PHP | 10-29 |
| 10-27 | CVE-2026-111497 | Brotli | 11-10 | |
| 10-27 | CVE-2026-48356 | Adobe | Commerce and Magento | 11-10 |
6. Satire as a signal: Black October in 90 seconds
Vulnerability data is dry, and the people who most need to hear about it, such as boards, executives and non-technical staff, rarely read advisories. This month a 90-second satirical short by @exploit.engineer (also @_xploitEngineer on X), captioned "me presenting the October 2026 CVE chart to the CISO like it's good news", circulated in security circles. It is a good example of how humour can carry dry, technical material to a much wider audience.[76]
What it packs into a minute and a half
- The chart: monthly CVE counts climbing steadily for a decade, then going nearly vertical in 2026. It uses the same cve.0xosprey.com dataset as section 1[1].
- A roll call of the year's big bugs: SharePoint, Chrome, Langflow, PAN-OS, F5 BIG-IP, Drupal, Exchange and more, grouped by bug class (use-after-free, race conditions, buffer overflows). Most of them were published earlier in 2026 rather than in October, so treat it as a year in review.
- A cartoon explanation of PHP2Shell: a request is half-built, freed, and then picked up by the next visitor on the same worker. It is arguably clearer than many written explainers (see section 3).
- The eMudhra private key "d = 4", captioned "chosen by fair dice roll, guaranteed to be random". This is a nod to a 2007 xkcd comic that suddenly became literal (see section 4).
- The year's compromised open-source packages, from axios to TanStack to LiteLLM (see the supply-chain table in section 2).
- Linux kernel CVE counts, which have roughly doubled in a year, presented as a podium.
Why it matters for security leaders: satire works as a gateway. A funny clip gets a non-specialist to ask "is that real?", and that question is the opening for a sourced conversation about exposure and priorities. Use the humour to start the discussion and the data to finish it.
7. What to do this week
- PHP: upgrade to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 (KEV deadline 29 Oct), and set
session.upload_progress.enabled=0for the unfixed CVE-2026-115560. Anything you can't patch, including appliances such as PAN-OS and Panorama, should be isolated or taken offline, as CISA, the UK NCSC and others advise. Then check for backdoors. - Brotli / Node.js: upgrade Node to 22.23.4 / 24.22.1 / 26.12.1, and bump Brotli to 1.2.1 in Python, curl and container base images. Retire Node ≤ 20.
- eMudhra: inventory any certificate chaining to emSign ECC Root CA - G3 and reissue from another CA. Update Go (1.27.3 / 1.26.10) and other bundled trust stores.
- LiteLLM: if 1.107.0 ran anywhere, treat the host as compromised and rotate every credential it could reach.
- Edge devices: Ivanti Connect Secure, PAN-OS, Cisco Secure Email Gateway, BeyondTrust, Atlassian Data Center, GitLab and Nextcloud/Collabora. Patch, then hunt for compromise, because several were exploited before patches existed.
- Microsoft: deploy the 13 Oct cumulative updates, prioritizing CVE-2026-96951 and Outlook CVE-2026-70242.
8. Where this is heading
October was not a one-off. The forces behind it are structural, and every published 2026 forecast has already been overtaken. The more useful finding, though, is that the number of flaws actually being exploited has not grown at the same rate.
Why the numbers are climbing
- AI is finding bugs faster than people can. Anthropic reported in February that Claude had found and validated more than 500 high-severity vulnerabilities in open-source code. By April its Mythos Preview model was finding thousands across every major operating system and browser[91][92]. OpenAI's Codex Security reported 792 critical and 10,561 high-severity findings across 1.2 million scanned commits[94]. Google's Big Sleep agent found a SQLite bug that was otherwise known only to attackers[95]. DARPA's AI Cyber Challenge showed automated systems finding and patching bugs at about $152 a task[96]. Several of October's headline bugs, including PHP2Shell and Brotli, were reported with AI help.
- CVE counts understate the bug counts. Mozilla fixed 271 AI-found bugs in a single Firefox release but filed them under just three CVEs[93]. The real volume of fixes is larger than the CVE chart suggests.
- More organisations now issue their own CVEs. The Linux kernel team became a CVE Numbering Authority in 2024 and now assigns a CVE to almost every fixed kernel bug, which is why it is on course for about 8,000 this year[97][39].
- Regulation is pushing disclosure. Since 11 September 2026 the EU Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities within 24 hours[99].
- The databases can't keep up. NIST reports CVE submissions grew 263% from 2020 to 2025. In April it stopped enriching every CVE, keeping full analysis for exploited and federal-critical software only[98]. Many new CVEs now arrive without an official severity score.
Where it's going
- The forecasts have already broken. FIRST's February forecast put 2026 at a median of 59,427 CVEs, revised to about 66,000 in June. Jerry Gamblin projected 71,000–72,000 at mid-year[100][101]. The year passed 87,000 by 27 October[1]. If November and December run at the September–October pace, 2026 will finish around 120,000. That is our own extrapolation, and it is above the top of FIRST's 90% range (117,673).
- But exploitation is rare and roughly flat. Gamblin found only 0.24% of first-half 2026 CVEs in CISA's exploited list. VulnCheck puts the ratio at 1.4%, and only 1.3% of AI-discovered CVEs have been confirmed exploited[101][102]. FIRST calls it "rain vs. flood": far more rain, but no bigger flood[100]. October's 1-in-480 ratio (section 1) fits that pattern.
- Patch speed matters more than ever. The same AI that finds bugs can turn a published patch into a working exploit. Anthropic built 8 working exploits from 18 Firefox patches and 8 Windows privilege-escalation chains from 21 kernel patches[103]. The gap between "patch released" and "exploit available" is shrinking.
What this means for security leaders: CVE volume will keep rising, and trying to patch everything is no longer a plan. The organisations that cope will prioritise by evidence of exploitation (CISA KEV, FIRST's EPSS scores, CISA's SSVC decision model), know exactly what software they run, and shorten the time from patch to deployment for the small set of flaws that matter[104].
Further reading
- Anthropic, "Evaluating and mitigating the growing risk of LLM-discovered 0-days" (Feb 2026) — how AI models are being used to find serious vulnerabilities, and the safeguards around it.
- Anthropic, "Claude Mythos Preview's cybersecurity capabilities" (Apr 2026) and Project Glasswing — the scale of AI-found vulnerabilities, with practical suggestions for defenders.
- Mozilla Hacks, "Behind the Scenes Hardening Firefox with Claude Mythos Preview" (May 2026) — what it looks like for a large project to absorb hundreds of AI-found bugs.
- OpenAI, "Codex Security: now in research preview" (Mar 2026) — AI security scanning at scale, and the problem of low-quality reports overwhelming maintainers.
- DARPA, AI Cyber Challenge results (Aug 2025) — automated find-and-fix systems, now open source.
- NIST, "NIST Updates NVD Operations to Address Record CVE Growth" (Apr 2026) — why many new CVEs no longer come with official severity data.
- FIRST, "The 2026 Vulnerability Forecast Update: Navigating the AI Epoch" (Jun 2026) — the industry-standard forecast and the "rain vs. flood" argument.
- Jerry Gamblin, "CVE Mid-Year 2026 Check-In: Volume Vertical, Exploitation Rare" (Jul 2026) — the clearest short read on volume against real-world exploitation.
- VulnCheck, "State of Exploitation 1H-2026" (Jul 2026) — what actually got exploited, and how quickly.
- Anthropic, "Measuring LLMs' impact on N-day exploits" (Jun 2026) — why the time from patch to exploit is collapsing.
- Trend Micro, "Volume Is Not Risk" (Jul 2026) — a leadership-level case for exploitation-based prioritisation.
9. Method and caveats
- "Reported" is CVE records published (CVE List V5) by publish date. NVD totals differ slightly because of rejected records and timezone handling: 15,117 for 1–27 Oct vs 14,514 from cvelistV5.
- "Fixed" is each vendor's own October count, using that vendor's unit (CVEs, or unique CVEs for Oracle and Apple). The 3,814 total is a simple sum and overlaps are not removed. Microsoft's total varies by outlet; the most widely cited figure is used and the range is noted. Adobe's is counted from Adobe's own bulletins.
- "Exploited" is CISA KEV additions only. KEV requires reliable evidence and a federal remediation path, so it undercounts. VulnCheck's KEV (broader) needs an API token, and no October figure was published.
- Sources that block automated fetching (Reuters, nsa.gov, Ars Technica, X) were read via direct download, archive.org copies or Nitter mirrors. The few claims that still could not be checked against an original source are marked as press quotes. Raw research notes, with every URL, are in
sources/.
About this briefing. Balance Bits Consulting prepared this analysis from public sources to show how we turn a month of vulnerability noise into a prioritized, sourced picture for decision-makers. Every figure links to its source below. Questions about how this applies to your environment? Get in touch.
Sources
- cve.0xosprey.com data feed (generated 2026-10-28 07:02 UTC) — https://cve.0xosprey.com/data.json · site: https://cve.0xosprey.com/
- NVD API 2.0 (pubStartDate/pubEndDate, noRejected) — services.nvd.nist.gov/rest/json/cves/2.0
- CISA Known Exploited Vulnerabilities catalog, JSON feed v2026.10.27 — cisa.gov/…/known_exploited_vulnerabilities.json
- SecurityWeek, "Microsoft Patches Record 1,413 Vulnerabilities Including Exploited Windows Zero-Day" (14 Oct 2026) — securityweek.com
- Microsoft MSRC CVRF, October 2026 — api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Oct
- SecurityWeek, Oracle October 2026 CPU — securityweek.com
- Chrome Releases blog, October 2026 — chromereleases.googleblog.com/2026/10/
- Apple security releases — support.apple.com/en-us/100100 (advisories 149225, 149227, 149230, 149521–149527)
- PC-WELT, Adobe October patches — pcwelt.de; SecurityWeek — securityweek.com
- Android Security Bulletin, October 2026 — source.android.com
- SAP Security Patch Day, October 2026 — support.sap.com
- Wikipedia, "Black October (information security)" — en.wikipedia.org
- The Guardian (23 Oct) — theguardian.com; Washington Post — washingtonpost.com; CNBC — cnbc.com
- BleepingComputer, October 2026 Patch Tuesday — bleepingcomputer.com; PCWorld — pcworld.com; SonicWall — sonicwall.com
- The Hacker News, "Microsoft patches record 974 flaws" (Sep 2026) — thehackernews.com
- CrowdStrike, October 2026 Patch Tuesday analysis — crowdstrike.com
- Wiz Research, PHP2Shell — wiz.io/blog/php2shell-php-rce
- CISA alert, "Critical Vulnerabilities in PHP Require Immediate Patching" (21 Oct, rev. 26 Oct) — cisa.gov
- Help Net Security — helpnetsecurity.com; PHP ChangeLog — php.net/ChangeLog-8.php; BleepingComputer — bleepingcomputer.com
- Recorded Future, PHP2Shell exploitation — recordedfuture.com
- BleepingComputer, "Mozilla, Google, Apple block compromised eMudhra CA certificates" — bleepingcomputer.com
- eMudhra incident statement — emudhra.com; Mozilla Bugzilla 2083449 — bugzilla.mozilla.org
- Google, "Protecting Chrome and Android users from compromised eMudhra intermediate CA certificates" — blog.google
- Mozilla Security Blog (20 Oct) — blog.mozilla.org
- BankInfoSecurity — bankinfosecurity.com; Inc42 — inc42.com
- Node.js October 2026 security releases — nodejs.org
- Wiz, CVE-2026-111497 — wiz.io; OX Security — ox.security
- CVE record CVE-2026-111497 — cve.org; Brotli v1.2.1 release — github.com/google/brotli
- LiteLLM security incident, 21 Oct 2026 — docs.litellm.ai
- Wiz, "LiteLLM compromised" — wiz.io; SecurityWeek — securityweek.com
- The Hacker News, critical GitLab flaw (CVSS 10.0) — thehackernews.com
- Rapid7, Ivanti Connect Secure CVE-2026-104935 — rapid7.com
- Palo Alto Networks advisory CVE-2026-0322 — security.paloaltonetworks.com
- SecurityWeek, Cisco Secure Email Gateway — securityweek.com
- BleepingComputer, Atlassian exploitation after PoC — bleepingcomputer.com
- Rapid7, BeyondTrust CVE-2026-102764 — rapid7.com
- BleepingComputer, Collabora/Nextcloud — bleepingcomputer.com
- Adobe APSB26-73 — adobe.com
- Linux kernel CNA repository (counts computed by first-commit date) — git.kernel.org/pub/scm/linux/security/vulns.git
- CVE Services API / CVE.org records — cve.org (per-ID:
cve.org/CVERecord?id=<ID>); NVD — nvd.nist.gov. Per-CVE vendor links insources/research-video-cves.md - Cloud Security Alliance, TeamPCP supply-chain cascade — labs.cloudsecurityalliance.org
- Cloud Security Alliance, Mini Shai-Hulud — labs.cloudsecurityalliance.org
- CISA, "CISA Adds Two Known Exploited Vulnerabilities to Catalog" (26 Oct) — cisa.gov
- UK NCSC, "Critical security issue affecting PHP" — ncsc.gov.uk
- Canadian Centre for Cyber Security, AL26-026 — cyber.gc.ca
- business.gov.au, "Critical vulnerabilities found in PHP" — business.gov.au; ASD alert — cyber.gov.au (unreachable when checked)
- (Superseded by [82]) MLex on NCSC New Zealand guidance — mlex.com; Digital Policy Alert — digitalpolicyalert.org
- Rijksoverheid, "NCSC: ernstige kwetsbaarheden in PHP" — rijksoverheid.nl; government sites offline — rijksoverheid.nl
- BSI Cyber-Sicherheitswarnung 2026-297981-1032 — bsi.bund.de; t3n — t3n.de
- CERT-FR, CERTFR-2026-ALE-014 — cert.cyber.gouv.fr
- CERT-EU Security Advisory 2026-018 — cert.europa.eu
- ENISA et al., "Joint statement on critical PHP vulnerabilities" — enisa.europa.eu
- IPA (Japan) security alert, 22 Oct — ipa.go.jp
- Graphic Online, "Government agencies given 7 days to patch critical PHP flaws" — graphic.com.gh
- CSA Singapore, AL-2026-151 — csa.gov.sg
- NSA, "NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities" (21 Oct) — nsa.gov; FBI Cyber Division on X (21 Oct) — x.com/FBICyberDiv; Newsweek, FBI advice — newsweek.com; Defense One — defenseone.com; Unit 42 figure via WinBuzzer — winbuzzer.com
- W3Techs, PHP usage statistics (28 Oct 2026) — w3techs.com
- W3Techs, WordPress usage statistics — w3techs.com
- CybelAngel, citing Mallory/Shodan exposure data — cybelangel.com; mallory.ai
- The Hacker News, "PHP2Shell exploit attempts hit millions" — thehackernews.com; Huntress — huntress.com
- The Next Web, "PHP2Shell: millions of exploit attempts, no confirmed breaches" — thenextweb.com
- The Register, "CISA confirms PHP2Shell under attack…" (27 Oct) — theregister.com; Delft tracker — php2shell.delftintellab.com
- Insurance Business UK, councils and Met Police offline — insurancebusinessmag.com
- Maire-info, French public sites in maintenance — maire-info.com
- MTV Uutiset, Finnish government services shut down — mtvuutiset.fi
- iTWire, "PHP2Shell: the 14-year-old bugs that pulled cyber.gov.au … offline" — itwire.com
- CP24, Canadian government websites offline — cp24.com
- Digital Today (Korea), cyber alert raised to "Caution" — digitaltoday.co.kr
- Vanta, vendor blast radius (NCSC-NL inventory counts) — vanta.com
- Fortinet, "Understanding PHP2Shell vulnerabilities" — fortinet.com
- NBC News, PHP vulnerabilities — nbcnews.com
- Deccan Chronicle, Japan PM and FBI warnings — deccanchronicle.com
- Moneylife, "eMudhra: how a key-making blunder put the whole web's chain of trust at risk" — moneylife.in
- xkcd #221, "Random Number" (Randall Munroe, 2007) — xkcd.com/221
- The Register, eMudhra coverage — theregister.com
- @exploit.engineer on Instagram — instagram.com/exploit.engineer; X — x.com/_xploitEngineer
- CVE Program, "About" / overview — cve.org/About/Overview
- BleepingComputer, "CISA extends funding to ensure 'no lapse in critical CVE services'" (Apr 2025) — bleepingcomputer.com
- CSO Online, "CVE program funding secured, easing fears of repeat crisis" (9 Mar 2026) — csoonline.com
- Dan Goodin, Ars Technica, "The Internet goes on high alert after discovery of 8 compromised TLS certs" (20 Oct 2026) — arstechnica.com
- NCSC Ireland, advisory on CVE-2026-109618 / CVE-2026-109619 (21 Oct) — ncsc.gov.ie
- NCSC New Zealand, "CVE-2026-109618 and CVE-2026-109619 affecting PHP" (22 Oct) — ncsc.govt.nz
- CERT-In, CIVN-2026-0528 (27 Oct) — cert-in.org.in; JPCERT/CC, JPCERT-AT-2026-0033 (22 Oct) — jpcert.or.jp
- Fastly, "How Fastly detected and built a coordinated response to PHP2Shell" — fastly.com
- Red Hat, RHSB-2026-015 (Brotli CVE-2026-111497) — access.redhat.com
- Prime Minister Sanae Takaichi on X (21 Oct) — x.com/takaichi_sanae; National Cybersecurity Office (@cyber_forecast) on X — x.com/cyber_forecast
- Reuters, "Indian firm eMudhra exits global digital certificates business" (22 Oct) — reuters.com; Reuters, "EU agency warns websites may need to be taken offline as PHP prepares patches" (21 Oct) — reuters.com
- Adobe security bulletins and advisories — adobe.com
- The Register, "PHP2Shell puts dozens of UK government services out of service" (22 Oct) — theregister.com
- pwn.watch, live security incident tracker (by @thekitze) — pwn.watch; data feed — pwn.watch/incidents.json
- Anthropic Frontier Red Team, "Evaluating and mitigating the growing risk of LLM-discovered 0-days" (5 Feb 2026) — red.anthropic.com
- Anthropic, "Claude Mythos Preview's cybersecurity capabilities" and Project Glasswing (7 Apr 2026) — red.anthropic.com; anthropic.com/glasswing
- Mozilla Hacks, "Behind the Scenes Hardening Firefox with Claude Mythos Preview" (7 May 2026) — hacks.mozilla.org
- OpenAI, "Codex Security: now in research preview" (6 Mar 2026) — openai.com
- Google, "A summer of security" (15 Jul 2025) — blog.google
- DARPA, "AI Cyber Challenge marks pivotal inflection point for cyber defense" (8 Aug 2025) — darpa.mil
- Greg Kroah-Hartman, "Linux is a CNA" (13 Feb 2024) — kroah.com
- NIST, "NIST Updates NVD Operations to Address Record CVE Growth" (15 Apr 2026) — nist.gov
- ENISA, CRA Single Reporting Platform — enisa.europa.eu; Jones Day, "EU Cyber Resilience Act: 24-hour reporting duties start September 11, 2026" (Jul 2026) — jonesday.com
- FIRST, "Vulnerability forecast 2026: The Year Ahead" (11 Feb 2026) — first.org; "The 2026 Vulnerability Forecast Update: Navigating the AI Epoch" (15 Jun 2026) — first.org
- Jerry Gamblin, "CVE Mid-Year 2026 Check-In: Volume Vertical, Exploitation Rare" (1 Jul 2026) — jerrygamblin.com
- VulnCheck, "State of Exploitation 1H-2026" (28 Jul 2026) — vulncheck.com
- Anthropic, "Measuring LLMs' impact on N-day exploits" (8 Jun 2026) — red.anthropic.com
- FIRST EPSS — first.org/epss; CISA SSVC — cisa.gov; Trend Micro, "Volume Is Not Risk" (Jul 2026) — trendmicro.com