Published on 28 October 2026, version 2.0 of the GCVE-BCP-02 guide describes vulnerability handling and coordinated disclosure as a complete operational process, from preparation to lessons learned, and ties it to the reporting obligations of the European Cyber Resilience Act. It adds an annex on coordination between upstream projects, distributions, integrators and manufacturers in open source ecosystems.
On 21 October 2026, the PHP project issued emergency fixes for php2shell, two critical vulnerabilities in the core of the engine, CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution across every web serving mode. The unsupported branches, from PHP 5 to PHP 8.1, are listed as affected by CERT-FR but absent from the CVE records, and receive no fixed release.
Microsoft publishes 1,413 CVEs on 13 October 2026, above September’s 973. Only one is exploited, a Mark of the Web bypass added the same day to CISA’s KEV catalogue, and this Patch Tuesday is the last one scheduled under the ESU programmes for Windows Server 2012, 2012 R2, Exchange Server 2016 and 2019. TLP:CLEAR …
Ukraine’s government incident response team describes a ClickFix campaign served from more than a hundred compromised sites and steered through a smart contract. One of its three installation chains loads a vulnerable AMD driver whose sample does not appear in the April 2026 copy of the Microsoft blocklist examined here.
CVE-2026-19490 is a SAML authentication bypass on NetScaler, not the two RCE zero-days disclosed on 26 September. Here is how to tell them apart.
Three Linux kernel CVEs enter CISA’s KEV catalogue with a three-day deadline and mandatory forensic triage. Fixes, scope and how to read the scores.
CISA justifies its new directive and its three-day deadline by pointing to AI-accelerated exploitation. Tested against the two public datasets available, that justification holds on one indicator and gives way on the others.
SIM3 v2 interim measures a team over 45 parameters and 5 levels. Free for internal use, tooled online, and soon extended to SOCs and PSIRTs
Cisco has published an unauthenticated SQL injection in Secure Email Gateway, already exploited. No workaround, and a second critical advisory the same day.
HiddenLayer published six critical CVEs in Mistral’s coding agent. All target the same authorisation layer, and no fix has shipped.
