The cybersecurity community has started calling October 2026 "Black October," and the name is well earned. In a single month, critical vulnerabilities landed across PHP, GitLab, Next.js, Node.js, Oracle E-Business Suite, Veeam, llama.cpp, Mistral Vibe, RuoYi, Plex Media Server, and the entire Windows ecosystem. Many are actively exploited. Several earned CVSS scores of 9.2 to 10.0.
At Peham, we build and operate SaaS products on modern stacks including PHP, Node.js, and Next.js on self-hosted infrastructure. This month hit close to home. Below is our complete breakdown of every major vulnerability that landed in October 2026, what each one means, and what to act on first.
PHP2Shell: CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2)
PHP2Shell is a pair of remote code execution vulnerabilities in the PHP language runtime itself, patched on October 21. Both were discovered by researchers at Calif and reported to the PHP team.
CVE-2026-109618 triggers when an out-of-memory condition interrupts PHP while request data is only partially initialized. The cleanup code then treats the invalid data as valid. CVE-2026-109619 is a different angle on the same problem: request-owned internal state survives after its backing memory has been freed, and the next request handled by the same worker picks it up before normal initialization resets it.
Both are unauthenticated and actively exploited. CISA added CVE-2026-109618 to its KEV catalog on October 26. Details leaked on social media two days before the planned coordinated disclosure, giving attackers a head start. We covered the full attack timeline in our PHP2Shell articles: the original vulnerability breakdown (https://peham.ltd/updates/php2shell-critical-php-vulnerability), the patch guide (https://peham.ltd/updates/how-to-fix-php2shell), and the week-two CISA update (https://peham.ltd/updates/php2shell-week-two-cisa-kev-public-exploit).
Action: Update PHP immediately from your distro's official security repository. The PHP team explicitly warned that third-party mirrors may lag.
Next.js Two Critical RCEs: CVE-2026-96889 and GHSA-673q (CVSS 9.5)
On October 14, Vercel released an emergency out-of-band security update for Next.js fixing two critical unauthenticated RCEs and one high-severity DoS. Both critical flaws are rated CVSS 9.5.
CVE-2026-96889 lives in the Image Optimization API. It stems from a memory-safety bug in librsvg inside the sharp image library. Any Next.js app that processes untrusted SVG files on glibc-based Linux is vulnerable to unauthenticated code execution. Affected versions span 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0.
The second flaw, GHSA-673q-mjm6-r5xr, affects Next.js 16.x apps using App Router with Cache Components. When a use cache function returns multiple typed arrays, an unauthenticated attacker can achieve remote code execution. The root cause sits in React itself (GHSA-xqc2-xf4c-x3h3). There is no workaround for this one. Only upgrading fixes it.
The same release also fixed a high-severity DoS in Server Actions (GHSA-p3m5-59mp-jv5r). No active exploitation has been confirmed yet, but Vercel urged immediate upgrades.
Action: Upgrade to Next.js 15.5.28 or 16.4.1. Run npm ls sharp and confirm it shows 0.35.5 or later. Upgrading Next.js makes package managers pull the fixed sharp version automatically.
GitLab RCE: CVE-2026-110264 (CVSS 10.0)
A perfect 10. GitLab released an emergency patch on October 21 for a flaw that lets an unauthenticated attacker run arbitrary code on any self-managed GitLab CE or EE server. The flaw lives in the Org-mode document renderer, where an integer overflow in the regular expression compiler is triggered by a specially crafted .org file. Every GitLab release going back to version 7.0 (roughly 12 years of versions) is affected.
This is the second CVSS 10.0 GitLab RCE in October. CVE-2026-97229, also in the regex compiler and reported by the same researcher, was patched on October 12. Teams that updated on the 12th are still exposed. We covered both flaws in our article on NGINX, GitLab, Go, and the hacked certificate authority (https://peham.ltd/updates/not-just-php-and-nodejs-nginx-gitlab-go-emudhra).
Fixed versions: 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, 19.5.1.
Action: Verify your exact build. Versions 19.4.2, 19.3.5, and 19.2.8 are all still vulnerable even though they were the October 12 patch releases.
Node.js Brotli RCE, Node2Shell: CVE-2026-111497 (CVSS 9.2)
An out-of-bounds write in Google's Brotli compression library affects Node.js and any application that decompresses Brotli-encoded HTTP responses from user-controlled URLs. A crafted compressed stream can corrupt adjacent decoder state memory and lead to remote code execution. CISA added Node2Shell to its KEV catalog after confirming active exploitation.
The October Node.js release also covers TLS hostname validation issues (CVE-2026-106069, CVE-2026-106072) and DNS resolution bugs worth patching in the same window. Fixed versions: Node.js 22.23.4, 24.22.1, and 26.12.1. We have a dedicated breakdown in our article The Brotli Bomb (https://peham.ltd/updates/the-brotli-bomb-nodejs-vulnerability).
Action: Upgrade Node.js. If you run services that fetch external URLs and decompress the responses, treat this as critical.
Plex Media Server, Plex2Shell (CISA KEV, 4 CVEs)
CISA added four Plex Media Server vulnerabilities, collectively named Plex2Shell, to its KEV catalog on October 20. A researcher published a proof of concept on October 16 after Plex shipped a fix in version 1.43.3.10861 back in August. Attackers were using the chain to install cryptominers and proxy malware within 24 hours of the PoC going public.
Action: Update Plex Media Server to 1.43.3.10861 or later. This is actively exploited in the wild and should be treated as urgent even on home or office servers.
Oracle E-Business Suite SQL Injection: CVE-2026-101767 (CVSS 9.8)
Discovered by Horizon3.ai and patched in Oracle's October 20 Critical Patch Update, this unauthenticated SQL injection in the EBS Thin Client Framework servlet chains to full remote code execution. The APPS database user that a successful attack reaches holds financial, payroll, HR, and procurement data. Active probing began October 27 via Defused's honeypots.
Action: Apply the October 2026 CPU, including separate patches for the EBS Database and Fusion Middleware. Do not expose EBS directly to the internet.
Veeam Backup and Replication Auth Bypass: CVE-2026-108142
Veeam patched a critical unauthenticated authorization bypass in Backup and Replication that allows access to the CDP Coordinator Service without credentials. Veeam is a recurring ransomware target. Attackers go after backup infrastructure specifically because compromising backups eliminates a victim's recovery options.
Action: Patch immediately. Network-segment Veeam infrastructure so it is not reachable from internet-facing zones.
RuoYi Framework SQL Injection: CVE-2024-57521 (CVSS 10.0)
RuoYi is a widely used open-source Java rapid-development framework with millions of deployments, particularly across Asia. CVE-2024-57521 is a SQL injection in the createTable function of SqlUtil.java that lets an authenticated administrator run arbitrary SQL and achieve code execution. The CISA SSVC assessment rates technical impact as total and confirms the attack is automatable. Two public proofs of concept are available on GitHub.
Though published in December 2025, this CVE has circulated actively this week after fresh community attention. If you have any internal tooling built on RuoYi, assume your admin credentials are in scope for attackers who have already compromised a machine in your network.
Action: Upgrade RuoYi Framework to 4.8.0. Audit who has admin access to any instance.
AI Tooling Under Attack: Mistral Vibe and llama.cpp
Black October also hit the AI developer toolchain directly, a category that barely existed two years ago and now runs on millions of developer machines.
CVE-2026-116843 (CVSS 8.7) affects Mistral Vibe, the command-line coding assistant from Mistral AI. An attacker who supplies a malicious repository can get commands executed with the user's full OS privileges when the tool runs in worktree mode. The attack works through Git filter drivers defined in the repository's .git/config, which run before Mistral Vibe's trusted-folder check, letting arbitrary smudge, clean, or process commands execute on checkout. Fixed in Mistral Vibe 3.0.3.
CVE-2026-116816 (CVSS 8.5) is a heap out-of-bounds write in llama.cpp's PLaMo-2 tokenizer. A maliciously crafted GGUF model file (the kind you would download from Hugging Face or a model repository) can corrupt heap memory during loading, leading to crashes or code execution. If your team runs local LLM inference with llama.cpp, every model file you load from an external source is a potential attack vector. Fixed in build b10261.
Action: Update Mistral Vibe to 3.0.3. Update llama.cpp to b10261 or later. Only load GGUF model files from sources you trust. AI dev tools are now an active attack surface.
Microsoft Patch Tuesday October 2026: 1,771 CVEs
October's Patch Tuesday addressed over 1,700 CVEs across the Windows ecosystem. Critical RCE highlights include Windows Message Queuing (CVE-2026-100202, CVSS 9.8), Windows Text Shaping (CVE-2026-102210, CVSS 9.8), Windows libarchive (CVE-2026-69639, CVSS 9.8), VS Code project-open RCE (CVE-2026-102238), AD FS spoofing (CVE-2026-108131), and Windows PDF RCE (CVE-2026-108457).
Action: Run Windows Update. Prioritise MSMQ, VS Code in shared or remote environments, and AD FS for SSO.
Linux Kernel and VMware ESX: CVE-2026-41709 and CVE-2026-46300 (CISA KEV)
CISA added a Broadcom VMware ESX insufficient logging flaw (CVE-2026-41709) and a Linux kernel missing-initialization-of-variable issue (CVE-2026-46300) to its KEV catalog on October 28. Both are confirmed under active exploitation.
Action: Apply kernel updates and available VMware patches.
What the Pattern Tells Us
Looking across Black October, a few things stand out. Development infrastructure is the primary target: GitLab, Next.js, VS Code, CI/CD pipelines, and AI coding tools. Owning a developer's toolchain often hands an attacker everything downstream, including production code, secrets, deployment keys, and AI model access. The PHP and Node.js vulnerabilities exist below your application code, which means you cannot patch them at the app layer.
The timeline from patch to active exploitation is also compressing. PHP2Shell details leaked before coordinated disclosure closed. Oracle EBS saw active probing seven days after the patch. The earlier GitLab flaw had a working Rapid7 demo four days after the fix. The Plex2Shell PoC triggered attacks within 24 hours of publication. Waiting a few weeks to patch is no longer viable.
One more shift worth naming: AI tooling is now an attack surface. Two of the vulnerabilities this month (Mistral Vibe and llama.cpp) target tools that did not exist in most security threat models a year ago. If your team uses local AI coding assistants or runs local inference, those tools need to be in your patch scope.
Priority Patch List
1. PHP runtime: exploited in the wild, CISA KEV.
2. Next.js: two critical unauthenticated RCEs, upgrade to 15.5.28 or 16.4.1.
3. GitLab self-managed: CVSS 10.0, verify you are on a patched build and not just the October 12 update.
4. Node.js: CISA KEV, upgrade to 22.23.4, 24.22.1, or 26.12.1.
5. Plex Media Server: CISA KEV, actively exploited with cryptominer payloads.
6. Veeam Backup: critical auth bypass, ransomware risk.
7. Oracle EBS: patch and pull it off the public internet.
8. RuoYi Framework: upgrade to 4.8.0, two public PoCs available.
9. Mistral Vibe: upgrade to 3.0.3.
10. llama.cpp: upgrade to b10261, audit untrusted model files.
11. Linux kernel and VMware ESX: CISA KEV, apply patches.
12. Windows ecosystem: standard Patch Tuesday, prioritise MSMQ, VS Code, and AD FS.
If your team needs help auditing your infrastructure, hardening your deployment pipeline, or assessing AI tooling exposure, this is exactly the kind of work we do at Peham. Our Cloud and DevOps service (https://peham.ltd/services/cloud-devops) covers reliable deployments, monitoring, and infrastructure hardening. Get in touch.
