NanoBrief | October 2026 roundup
The trade press landed on 'Black October' as the label for this month, and the volume justifies it. Here's what actually mattered.
The headline story was PHP. Two critical remote code execution flaws (CVE-2026-109618 and -109619) were disclosed around 21 October, but Amazon Threat Intelligence observed exploitation attempts from roughly 17 October - a four-day window where attackers had working exploits and defenders had nothing. NCSC and CISA both issued emergency guidance: patch immediately or pull the service offline. A further unpatched RCE was reportedly flagged shortly after the emergency fix landed. Given PHP's presence across web infrastructure, this one had real reach.
Microsoft's Patch Tuesday was unusually large, covering around 1,400 CVEs with 70-plus rated critical. Two deserve immediate attention. CVE-2026-70242 is a zero-click RCE triggered through the Outlook reading pane - CVSS 9.8, no user interaction required beyond receiving a crafted email. CVE-2026-96951 is a Windows Shell Mark-of-the-Web bypass already confirmed exploited in the wild. There were also critical flaws in AD DS, AD FS, and NDES - directly relevant to any organisation running Microsoft identity infrastructure, and to any AD or ADCS assessment currently in scope.
GitLab disclosed CVE-2026-110264, a CVSS 10.0 unauthenticated RCE affecting self-managed instances. If any of your environments or supplier environments self-host GitLab, this needs to be confirmed patched.
Secondary but worth noting: CISA added four Plex Media Server CVEs to the Known Exploited Vulnerabilities catalogue, Signal patched a RingRTC flaw, and a CA (eMudhra) revoked eight intermediate certificates after a scripting error produced weak private keys - a quiet PKI trust issue that tends to get overlooked in months like this one.
The practical takeaway: if the Outlook RCE and the PHP patching haven't been confirmed closed, those are the first two calls to make this week.