A quick heads-up

If you’ve been doing anything on the internet at all over the last two weeks it’s been a bit of a hell of a time. Critical vulnerabilities have been uncovered in PHP, Microsoft Office, Cisco Secure Email Gateway, Catalyst SD-WAN Manager, Atlassian Data Center, Ivanti Connect Secure, NGINX and the Linux kernel. A number of those are already being exploited in the wild.

The thing that gets me isn’t that software has bugs (we all know that) but the speed at which things are moving. The time between a vulnerability being made public and attackers having a working exploit is now measured in days rather than months. In some cases you can have an exploit out there before the defenders even know that a vulnerability exists.

If you’re the guy who’s got responsibility for the infrastructure in your organisation there’s a very good chance you’re running something unpatched and exploitable at this very moment. The question isn’t whether you’re going to be the target. The question is whether you’re going to find out first.

PHP2Shell — the one that caught my attention

On 21 October PHP issued an emergency out-of-cycle update for what they refer to as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). These are memory safety bugs in the PHP engine itself (the engine code goes right back to 2012) and affect everything from PHP 5.4 up through the current branches.

Here’s why this one stuck out to me:

  • Remote code execution. A remote attacker with network access can execute code on your server with a single HTTP request. No password is required.
  • It’s in the engine, not in your app. Magento, WordPress, Drupal, Laravel, Symfony, Nextcloud, MediaWiki, phpMyAdmin, WHMCS… even if your own code is pristine the PHP engine underneath is vulnerable.
  • Memory leakage. CVE-2026-109618 can leak server memory (passwords, session tokens, API keys, TLS private keys) via the PHPSESSID cookie even if your application never calls session_start().
  • Already being exploited. CISA have added it to their Known Exploited Vulnerabilities catalog as of 26th October and there are security teams that have confirmed working exploits against unpatched PHP 8.2-8.5.

If you’re running PHP anywhere (and you very probably are) this isn’t a “we’ll look at it in the next quarter” issue. Patch it now or at the very least put the affected systems behind very tight network controls until you can.

Everything else that showed up in the last two weeks

PHP2Shell got the headlines, but it wasn’t the only thing that had a bad fortnight in the enterprise.

Microsoft’s October Patch Tuesday saw the release of approximately 1,413 vulnerabilities (around 70 of which are Critical). One of the more notable of these is CVE-2026-21509, a Microsoft Office zero-day which circumvents OLE/COM protections via malicious documents and is already being exploited. Windows and Office endpoints remain the high value targets.

Cisco have two criticals: CVE-2026-76461 (unauthenticated SQLi in Secure Email Gateway) and CVE-2026-76504 (API auth bypass in Catalyst SD-WAN Manager which gives the attacker admin rights). Both are actively exploited. Ivanti Connect Secure has CVE-2026-104935 (auth bypass resulting in RCE) with very limited exploitation in the wild.

Atlassian’s data centre products (Confluence, Jira, Crowd and Jira Service Management) were hit by a batch of dependency vulnerabilities disclosed on 20 October. The notable ones are CVE-2026-75595 (RCE via netty-handler) and CVE-2026-58062 (a Bouncy Castle issue). Separately, CVE-2026-21589 (arbitrary file read which can chain to full admin control) was disclosed earlier in October and is already in CISA’s Known Exploited Vulnerabilities catalog.

NGINX (used in everything from ingress controllers to web application firewalls) has CVE-2026-42945 affecting versions from 0.6.27 up to and including 1.30.0. If you’re running NGINX as a load balancer in front of Kubernetes, you might also be interested in my post on building an on-prem K8s cluster without an external load balancer.

Moving on, the Linux kernel has had a number of critical issues too, including CVE-2026-99999 (a guest to host escape rated 9.3) and CVE-2026-31431 (a local privilege escalation that can lead to container escape).

The pattern is clear: critical infrastructure is being actively exploited and is being disclosed faster than we can patch.

AI is speeding things up — for both sides

I’m not being alarmist at all, it’s just that AI is dramatically accelerating the rate at which vulnerabilities get discovered and then weaponised.

Historically the median time from public disclosure to confirmed exploitation was 756 days in 2018. By 2023 that had dropped to about five days. In 2024 the average was actually negative (so attackers are exploiting the vulnerability before the CVE is even publicly disclosed). One projection has the 2026 figure at around negative thirteen days (again that’s an extrapolation, not a hard measurement, but the trend is the point).

AI is driving this in three ways:

  • AI finds bugs faster than humans. Project Zero at Google (in conjunction with DeepMind as part of the Big Sleep initiative) have already used AI agents to find previously unknown bugs in widely used open source software (including zero-days which were at risk of being exploited before anyone had even heard of them).
  • AI writes the exploits in minutes rather than weeks. What used to be days of expert reverse engineering can now be attempted in 10-15 minutes for around a dollar. There are studies where language models have been shown to successfully write exploits for real world vulnerabilities simply from the CVE description. The same language models that can help your developers write code can also be used to write the exploits for attackers.
  • There’s no defensive moat. The same model weights, the same agent frameworks, the same vulnerability data are being used to run both the defensive code review and the offensive zero-day discovery. AI assisted hunting only helps you if you’re doing it prior to the attackers doing it and they’re already doing it.

The data on whether AI discovered vulnerabilities are being exploited at scale is actually mixed. The bigger, more immediate threat is that attackers are using AI to accelerate the exploitation of known vulnerabilities that you simply haven’t patched. PHP2Shell has been public for over a week. If your PHP instances are still unpatched then you’re not up against a sophisticated AI attacker at all. You’re up against inertia.

What I’d do this week

You don’t need to be a security researcher. If I were in your shoes, here’s where I’d start.

  1. PHP. Inventory all PHP instances (including those embedded in third party apps) and apply PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 as appropriate. If you can’t patch today then isolate those systems behind very tight network controls.

  2. Microsoft: accelerate the October Patch Tuesday cycle. Office (in particular CVE-2026-21509) and Windows endpoints are the priority.

  3. Perimeter and identity gear. Audit the Cisco Secure Email Gateway, the Catalyst SD-WAN Manager, the Ivanti Connect Secure and the Atlassian Data Centre. Those are the edge and identity systems - precisely where the attacker is going to get in.

  4. Patch faster than it feels comfortable. The window between disclosure and exploitation is now days not weeks. Critical, actively exploited vulnerabilities need to be patched in the 24-72 hour window not in the next quarter’s maintenance window.

  5. Look at AI-augmented defence. If the bad guys are using AI to find the bugs then your tooling should at least be on that level. AI assisted code review, agentic vulnerability discovery and automated patch prioritisation are all becoming table stakes rather than something exotic that you’re just playing around with.

Wrapping up

I’ll be honest, writing this post has made me a bit nervous. It’s not that the vulnerabilities themselves are in any way surprising (software has bugs, that’s the norm), it’s the speed at which they’re being found and exploited that’s so very different from what we’re used to. PHP2Shell has been public for over a week. If you haven’t patched yet you’re not up against some sophisticated AI attacker, you’re up against inertia.

My advice is don’t let perfect be the enemy of good. Pick the one thing from that list that’s relevant to your environment and get it fixed this week. Patch the PHP instances. Test the Office update. Check your Cisco and Atlassian perimeter gear. You don’t have to do them all at once, just don’t do nothing.

That’s it from me. Hopefully that saves you a bit of digging.