Vulnerability Report – October 2026: PHP2Shell, Ivanti, and 200 newly known-exploited vulnerabilities (www.vulnerability-lookup.org)
from cedric@lemmy.ml to security@lemmy.ml on 04 Nov 13:15
https://lemmy.ml/post/54896064

Vulnerability-Lookup (vulnerability.circl.lu) is an open-source platform run by CIRCL, the Luxembourg CERT. It aggregates vulnerability data from many sources (CVE, GitHub advisories, PySec, CSAF feeds and more). It also collects “sightings”: mentions, proofs of concept and exploitation reports seen on social media, in exploit databases, from honeypots and from the community. Every month we publish a report built from that data.

Highlights for October 2026:

• PHP2Shell (CVE-2026-109618 / CVE-2026-109619): two memory-safety flaws in the PHP interpreter leaked before their coordinated release on 21 October and drew 1,773 sightings. Exploitation was observed on disclosure day, five days before CISA listed them.
• 17,097 CVEs were published, a third record month in a row. Total sightings rose 20%, but proof-of-concept sightings fell 38% and exploitation sightings 20%.
• 200 vulnerabilities entered at least one of the five Known Exploited Vulnerabilities catalogs we track: CISA, CIRCL, ENISA / EU CSIRTs Network, The Shadowserver Foundation and Previdian. The catalogs are federated through GCVE (gcve.eu), and the report includes a matrix showing which catalog covers what.
• Ivanti Connect Secure had three CISA entries. CIRCL confirmed the first one before its CVE record was published.
• Previdian covered all 36 CISA additions and flagged 19 of them earlier, in one case by 77 days.

Severity levels come from our open VLAI models (arxiv.org/abs/2507.03607). The report was generated with AI assistance using VulnMCP (github.com/vulnerability-lookup/VulnMCP). Feedback is welcome on GitHub (github.com/vulnerability-lookup/…/issues/).

#security