October 2026 shipped three CVSS 10.0 flaws, a 1,413-CVE Patch Tuesday, and an emergency patch to PHP core. The severity numbers are the least interesting part. What changed is the discovery side, and that changes what your job is.
The month, in advisories
| Date | Thing | Score |
|---|---|---|
| Oct 8 | Bricksforge CVE-2026-85097 — unauth arbitrary file upload to RCE, affected ≤ 3.1.8.9, fixed 3.1.8.10 |
10.0 |
| Oct 12 | GitLab CVE-2026-97229 — integer overflow in the CI/CD regex compiler; 10.0 assumes the attacker can first plant a malicious CI config in a public project |
10.0 |
| Oct 13 | Microsoft Patch Tuesday — 1,413 CVEs, 75 Critical, 3 zero-days (1 exploited) | — |
| Oct 16 | Plex2Shell PoC published — CVE-2026-96652 / 96654 / 96655 / 96656
|
9.8 |
| Oct 21 | PHP core CVE-2026-109618 / CVE-2026-109619
|
9.2 (v4.0) |
| Oct 21 | GitLab CVE-2026-110264 — second regex integer overflow, all self-managed from 7.0 |
10.0 |
Three details worth flagging for anyone running these:
The GitLab 10.0 is not a no-preconditions 10.0. Rapid7 reproduced execution against 19.4.1, and noted the vendor score treats the final trigger as unauthenticated. The step before it is the constraint: an attacker first needs a way to plant a malicious .gitlab-ci.yml and a UTF-8 repository path into a public project. If your instance lets anyone self-register and create projects, that costs an ordinary account and nothing more. Which is worth deciding explicitly, because it changes the exploitability of both GitLab CVEs on your install.
GitLab shipped two 10.0s nine days apart. CVE-2026-110264 affects every self-managed version from 7.0 before 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1. GitLab's own wording is "under certain conditions", and it has not published a technical description of those conditions. No workaround was named. GitLab.com ran patched versions, so this was self-managed only. If you took the October 12 patch and stopped, you are still exposed.
Plex2Shell went from PoC to observed exploitation in under 24 hours. Entry point is an SSRF in /player/timeline; an unauthenticated attacker makes the server POST to arbitrary destinations, including its own internal APIs. Fixed in 1.43.3.10861.
The discovery-side change
Wiz Research found the PHP flaws on August 19, 2026 using Wiz Atlas plus Gemini 4 Argon and GPT-5.6 Sol. Drupal RCE confirmed Aug 20, WordPress Aug 21, reported to the PHP team Aug 24, acknowledged Sept 21, patched and disclosed Oct 21.
Wiz's framing is the part to internalize:
Pre-AI, this manual work would be difficult to implement and even harder to scale.
The finding was never the hard part. The hard part was chaining multiple memory-safety bugs and re-deriving the exploit for each version, config and memory layout — the tedious per-target adaptation that used to cost a specialist weeks per deployment. That is now grind work a model can do.
Same story on the Windows side: Microsoft's exploited October zero-day (CVE-2026-96951, a Mark of the Web bypass, CVSS 8.8) carries a credit line naming a researcher using Claude with Anthropic.
The data point that should reframe your backlog
CISA added 28 entries to the KEV catalog in October, as of the October 26 catalog update (catalogVersion 2026.10.26). Six of them predate 2026. Five date from 2015 to 2023 and were added in a single batch on October 8: ProFTPD CVE-2015-3306, ISC BIND CVE-2015-5477, Apache Struts CVE-2016-3081, ONLYOFFICE CVE-2021-3199, Strapi CVE-2023-22894.
You can reproduce that count yourself. The feed is free and unmetered:
curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
| jq -r '.vulnerabilities[]
| select(.dateAdded | startswith("2026-10"))
| [.dateAdded, .cveID, .vendorProject] | @tsv' \
| sort
# observed at catalogVersion 2026.10.26 — 28 rows, trimmed here
2026-10-01 CVE-2026-104286 Fortinet
2026-10-02 CVE-2026-102489 Zammad GmbH
2026-10-02 CVE-2026-102490 Zammad GmbH
2026-10-04 CVE-2026-88779 Citrix
2026-10-08 CVE-2015-3306 ProFTPD
2026-10-08 CVE-2015-5477 ISC
2026-10-08 CVE-2016-3081 Apache
2026-10-08 CVE-2021-3199 ONLYOFFICE
2026-10-08 CVE-2023-22894 Strapi
...
2026-10-23 CVE-2026-110447 Collabora
2026-10-23 CVE-2026-114625 Arista
2026-10-26 CVE-2026-109618 PHP Group
2026-10-26 CVE-2026-109619 PHP Group
That October 8 block is the whole argument. Five vulnerabilities from 2015 to 2023, still being exploited, flagged in one go. None were new. All were patchable for years.
What this means for your ops stack
The scarce resource moved. It used to be finding; it is now inventory.
Concretely, the questions that decide your exposure in 2027 are not "did we patch this week's CVE" but:
- Do we have an authoritative list of everything answering on our domains, including shadow subdomains, forgotten staging hosts and self-hosted tools someone stood up for a two-week project?
- Can we answer "do we run GitLab / Plex / Bricksforge / PHP under mod_php" in under five minutes without asking anyone?
- Is our triage driven by KEV (actually exploited) or by CVSS score (theoretically severe)? October had 1,413 Microsoft CVEs, and roughly 1% of 2026's Microsoft CVEs are known-exploited.
Two habits that pay for themselves:
Correlate against KEV, not raw CVSS. The pipeline above drops straight into any inventory you keep. KEV answers "known to be exploited", which is not the same as "a complete list of active attacks" — treat it as a prioritization signal, not a substitute for the vendor advisories on the software you actually run.
Treat "not internet-facing" as a control, not an accident. Several of October's urgent items stop mattering when the service is not reachable from the internet. That is a cheaper fix than a patch window.
One caveat on the argument
A single month cannot prove a permanent shift in the economics of discovery. The PHP findings are strong evidence of what a well-resourced team with frontier models and real test infrastructure can now achieve; they are not evidence that every serious bug will be found and weaponized on that timescale. Similarly, Computer Weekly attributes much of Microsoft's record CVE volume to AI-assisted discovery, but that is an attribution rather than a controlled measurement — CVE counts also move with reporting and disclosure practice.
Plan for the direction, not the calendar.
If you self-host any of it
- GitLab self-managed: get to a release covering
CVE-2026-110264, not just the October 12 fix. Also decide deliberately whether self-registration is open. It is the difference between both GitLab CVEs requiring an account and requiring nothing. - Plex exposed to the internet: 1.43.3.10861, or stop exposing it.
- Bricksforge on WordPress: 3.1.8.10.
- PHP: the action depends on your runtime, and mod_php versus PHP-FPM are not the same risk profile.
The full writeup, with the government response and per-CVE detail, is on the WardenBit blog: AI Helped Find the Worst Bugs in October's Vulnerability Storm.
Sources: Wiz Research, Patchstack, CrowdStrike, Rapid7, Brandefense, CISA KEV feed (catalogVersion 2026.10.26). Counts stated as of October 26, 2026.
Top comments (0)