Security roundup: October 17–23, 2026

Strongthium Labs — Sat, 24 Oct 2026 23:38:59 +0000

The critical vulnerabilities of the week in the server software we watch and what it runs on: those that score CVSS 7.0 or more, and those CISA says are being exploited in the wild. This week, 3 vulnerabilities.

Software	Vulnerabilities	Exploited	Highest score
Kubernetes	1	–	10.0
PHP	1	–	9.8
Windows Server	1	–	9.8

Kubernetes

CVE-2026-83938

CVSS 10.0, critical · published October 22, 2026

Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.

Weakness: CWE-306
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Read more: NVD

PHP

CVE-2026-109618

CVSS 9.8, critical · published October 21, 2026

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Affected: PHP from 7.3.0 before 8.2.35; PHP from 8.3.0 before 8.3.36; PHP from 8.4.0 before 8.4.27; PHP from 8.5.0 before 8.5.12
Weakness: CWE-416, CWE-755, CWE-824, CWE-1325
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Read more: NVD · github.com advisory

Windows Server

CVE-2026-83888

CVSS 9.8, critical · published October 13, 2026

Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over a network.

Affected: Windows Server 2012, every version; Windows Server 2012 r2; Windows Server 2016 before 10.0.14393.9612; Windows Server 2019 before 10.0.17763.9376; Windows Server 2022 before 10.0.20348.5761; Windows Server 2025 before 10.0.26100.33650
Weakness: CWE-126
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Read more: NVD · msrc.microsoft.com advisory

From the National Vulnerability Database (NVD), whose descriptions these are, and CISA's catalog of Known Exploited Vulnerabilities. A score is the highest the record gives, NVD's own or its source's. Software we watch: what servers commonly run, from the operating system to the database.

First published on Strongthium Lab Notes.