Wednesday, October 21, 2026 Your daily roundup of the most critical cybersecurity developments from the past 24–48 hours, curated for security practitioners and IT professionals. 🔴 ACTIVELY EXPLOITED VULNERABILITIES PHP2Shell — CVE-2026-109618 & CVE-2026-109619 (CVSS 9.2): Two critical PHP core Remote Code Execution flaws patched today, October 21, 2026. These vulnerabilities allow attackers to execute arbitrary code via malicious multipart uploads on PHP 8 servers. Only PHP

ACTIVELY EXPLOITED VULNERABILITIES CVE-2026-8452 — Citrix NetScaler ADC/Gateway Memory Buffer Vulnerability: Originally patched Jun 30 as a denial-of-service issue; researchers demonstrated unauthenticated remote code execution capability. CISA added to KEV Aug 26; FCEB remediation deadline was Aug 29. CVE-2026-66384 — JFrog Artifactory Path Traversal | CVE-2026-53362 — Linux Kernel Unspecified | CVE-2023-49105 — ownCloud Improper Authentication: All three added to CISA KEV o

ACTIVELY EXPLOITED VULNERABILITIES CISA KEV Update (Aug 26) — CISA added six CVEs to its Known Exploited Vulnerabilities catalog. FCEB agencies must patch CVE-2019-1068 (Microsoft SQL Server RCE) and CVE-2026-8452 (Citrix NetScaler ADC/Gateway memory buffer) by TODAY, August 29, 2026. Remaining four (CVE-2015-3246 Red Hat Libuser Race Condition, CVE-2015-5287 Red Hat ABRT Privilege Escalation, CVE-2021-23758 Ajax.NET Deserialization, CVE-2022-0995 Linux Kernel Out-of-Bounds W

ACTIVELY EXPLOITED VULNERABILITIES CVE-2026-33824 | Microsoft IKE Service Extensions | Double Free | CVSS 9.8 — CISA KEV added Aug 18. Allows remote code execution over the network. FCEB patch deadline: August 21, 2026. CVE-2026-55040 | Microsoft SharePoint | Weak Authentication | CVSS 9.1 — CISA KEV added Aug 18. Chains four weak authentication checks to forge valid tokens. FCEB patch deadline: August 21, 2026. CVE-2026-59310 | Broadcom VMware vCenter | Path Traversal | CVSS