Critical Vulnerabilities, October 17 to 24, 2026: What to Patch First

TL;DR - Exploited now, patch first: PHP (PHP2Shell), Plex Media Server, Collabora Online, Arista VeloCloud Orchestrator, Siemens Software Center and SiteGuard Server Edition. - Check whether you were already hit: LiteLLM 1.107.0 (a two-hour window on October 21), UpdraftCentral-connected WordPress sites, and ConnectWise Cloud Backup customers. - Critical but no exploitation reported yet: GitLab CVE-2026-110264 (CVSS 10.0) and the eMudhra certificate compromise. Fix them this week, after the items above. - Several of these were exploited or abused before a fix existed, so patching is not the end of the job. Look back to the dates given below.

This was a heavy week for security teams. Between October 17 and 24, 2026, we published advisories on seven separate stories, and CISA added eight vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. They are not equally urgent, and most teams cannot do everything on Monday morning.

This page ranks them by one question: is there evidence that attackers are using it right now? Exploited issues come first. Incidents where the damage may already be done come second. Critical issues without reported exploitation come third. Exploitation status is as of CISA’s KEV catalog version 2026.10.23 and the sources linked below.

Tier 1: exploited now, patch first#

CISA’s KEV due dates (October 23 to November 3 for these entries) are binding only on US federal civilian agencies, but they are a reasonable signal of how fast CISA thinks everyone should move.

PHP2Shell deserves extra attention because of its reach. W3Techs data cited by Tenable puts PHP on 69.3% of websites whose server-side language is known. That does not mean 70% of the web is vulnerable, but it does mean almost every organization has PHP somewhere, often inside products that do not advertise it. Because exploitation started four days before the patch, Amazon recommends investigating from October 17, not from the day you patched.

Tier 2: check whether you were already hit#

These are incidents rather than bugs. Patching or updating closes the door, but it does not tell you whether someone already walked through it.

The common thread is trust that was borrowed rather than earned: a release pipeline, a plugin vendor’s connection keys, a backup provider’s access to customer tenants. In each case the victim’s own systems were not the weak point. The researcher reports of backdoored WordPress sites have not been confirmed by TeamUpdraft itself; our advisory separates what the vendor confirmed from what researchers reported.

Tier 3: critical, no exploitation reported yet#

GitLab is in this tier only because nobody has reported attacks yet. A CVSS 10.0 unauthenticated flaw on an internet-facing code server should not wait long: if your GitLab is reachable from the internet, treat it as Tier 1.

If you only have an hour#

1. Find your PHP. Web servers, appliances and products that bundle it. Patch what you can reach, and start log review from October 17. The Dutch NCSC keeps a list of software with a PHP dependency.
2. Search for LiteLLM 1.107.0 in lockfiles, build logs and container images from October 21. If you find it, start credential rotation today.
3. Patch internet-facing Plex, Collabora, VeloCloud and GitLab.
4. Ask your WordPress and managed-service providers whether UpdraftCentral or ConnectWise Cloud Backup touched your environment.
5. Put the eMudhra trust-store updates into your next image rebuild, and check that your own certificates do not chain to the affected intermediates.

What this week shows#

Two patterns stand out, and both argue against a “patch everything by severity score” approach.

Exploitation is starting before disclosure. PHP2Shell was being probed on October 17, four days before the fix. The UpdraftCentral keys were taken over a weekend before most customers knew. For defenders, the date that matters is when attackers started, which is often earlier than the date of the advisory. Logging that goes back a few weeks is what makes that look-back possible.

The risk sits in what people do not inventory. CA bundles inside container images, a library pulled in by another library, a backup connector with access to a cloud tenant, a plugin’s remote-management key. None of these show up in a list of “our servers.” The teams that move fastest in weeks like this are the ones that already know where TLS verification happens, which packages are pinned, and which third parties hold keys to their environment.

We cover each story in full in our Breaking news section, and each advisory is updated as vendors publish more.

This page is informational. Confirm versions and actions against each vendor’s own guidance for your environment.

Sources

• CISA, Known Exploited Vulnerabilities catalog (catalog version 2026.10.23)
• PHP Group, Security advisory: Critical remote code execution vulnerabilities (October 21, 2026)
• Amazon Threat Intelligence, PHP2Shell exploitation prior to public disclosure (October 21, 2026)
• Tenable, PHP2Shell FAQ
• LiteLLM, v1.107.0 incident post and attack chain
• TeamUpdraft, Security incident notice
• ConnectWise, Trust Center advisories
• GitLab, Patch release 19.5.1
• Cloudflare, 8 eMudhra certificates are compromised and the disclosure site
• NCSC-NL, php2shell repository