Research

October 2026 CVE Landscape

In October 2026, Insikt Group® identified 82 high-impact vulnerabilities that should be prioritized for remediation, 52 of which had a Very Critical Recorded Future Risk Score. This represents a 13% decrease from last month.

Read at Recorded Future Insikt Group

EPSS

0.83 (p100)

• Recorded Future Insikt Group (recordedfuture.com)
• CVE-2026-109618 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-109619 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-87902 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-86124 on this site · NVD · CVE.org · Vulnpedia
• CVE-2015-3306 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 58
   Research Check Point Research 7h ago

   PHP2Shell Exploitation on Check Point Gateway

   EPSS 1.00 CVE-2026-109618CVE-2026-123039CVE-2026-109619 Check Point PHP
2. 70
   ICS advisory CISA ICS 9h ago

   Siemens RUGGEDCOM APE1808

   EPSS 1.00 CVE-2026-109618CVE-2026-109619 Palo Alto Networks PHP
3. 57
   ICS advisory CISA ICS 9h ago

   Siemens Building Automation and Energy Products

   EPSS 1.00 No fix yet CVE-2026-109618CVE-2026-109619 PHP Siemens
4. 54
   Qualys TRU Qualys 12h ago

   PHP2Shell and Node2Shell: Find, Fix, and Verify Across Your Web Apps and APIs

   EPSS 0.83 Fix available CVE-2026-109618CVE-2026-109619CVE-2026-111497 Node.js PHP
5. 85
   Ivanti advisory Ivanti 47h ago

   November 2026 Patch Tuesday

   Exploited CVSS 6.5 EPSS 0.83 Fix available CVE-2026-109618CVE-2026-109619CVE-2026-111497+10 more Ivanti PHP
6. 58
   Research Eclypsium 2d ago

   Php2shell: A Network Edge Risk Playbook

   CVSS 9.2 EPSS 0.83 CVE-2026-109618CVE-2026-109619CVE-2026-111497+2 more PHP
7. 45
   Qualys TRU Qualys 8d ago

   PHP2Shell on Windows and macOS: Automating the PHP Upgrade, With or Without an Agent

   EPSS 1.00 Fix available CVE-2026-109618CVE-2026-109619 Microsoft Apple
8. 59
   Threat signal FortiGuard 8d ago

   Ivanti Connect Secure Zero-Day Exploitation

   Exploited CVE-2026-104935CVE-2026-111357CVE-2026-118527 Fortinet Ivanti
9. 34
   Research Censys 10d ago

   Thoughts on Vulnerability Response in the Era of the Vulnpocalypse and PHP2Shell

   EPSS 1.00 CVE-2026-109618CVE-2026-109619 PHP
10. 74
    Research Rapid7 10d ago

    Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

    Exploited CVSS 8.8 Fix available CVE-2026-111357CVE-2026-118527CVE-2026-104935+1 more Ivanti
11. 55
    Research Rapid7 13d ago

    Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)

    PoC public EPSS 0.78 CVE-2026-102764 BeyondTrust Rapid7
12. 82
    Tenable research Tenable 13d ago

    php2shell one week later: Why one exploit doesn’t work everywhere

    Exploited CVSS 9.2 EPSS 1.00 Fix available CVE-2026-109618CVE-2026-109619CVE-2021-44228+1 more PHP
13. 34
    News The Register 14d ago

    Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers

    EPSS 1.00 CVE-2026-109618CVE-2026-109619CVE-2026-46300 PHP
14. 52
    Research Censys 14d ago

    Censys takes census of the Internet like no one else

    CVSS 9.2 EPSS 1.00 CVE-2026-109618CVE-2026-109619 PHP
15. 36
    Research GreyNoise 15d ago

    Global Event: PHP2SHELL Live Activity Report

    EPSS 1.00 CVE-2026-109618CVE-2026-109619 PHP
16. 59
    News The Register 16d ago

    CISA confirms PHP2Shell under attack as researchers clock successful exploits

    Exploited EPSS 1.00 CVE-2026-109618CVE-2026-109619 PHP
17. 34
    Research Cloudflare 16d ago

    Introducing the Cloudflare PHP Capture the Flag challenge

    EPSS 1.00 CVE-2026-109618CVE-2026-109619 Cloudflare
18. 26
    ICS advisory CISA ICS 16d ago

    Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

    Fix available CVE-2023-4863CVE-2026-16436CVE-2026-16437+1 more Mitsubishi Electric
19. 39
    Tenable research Tenable 16d ago

    Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)

    EPSS 0.83 Fix available CVE-2026-111497CVE-2026-109618CVE-2026-109619 Google Node.js
20. 34
    Tenable research Tenable 17d ago

    Discover and remediate PHP2Shell exposure with Tenable

    EPSS 1.00 No fix yet CVE-2026-109618CVE-2026-109619 Tenable PHP