Daily threat watch, 29 October 2026: eight exploited CVEs in seven days, five that need action today

The short version

Our threat hub keeps two lists. The Day-0 Watch is every new critical-rated entry that arrives from the CVE record, GitHub, the vendors and the research blogs. Exploit Activity is the short list inside it: the vulnerabilities CISA says are being exploited now. From 23 to 29 October the first list grew by 198 entries and the second by eight. Read the second list first.

Five of the eight need action today, because CISA's due date has passed or falls within three days. Two of those, the Arista VeloCloud Orchestrator and the Collabora server inside Nextcloud, were due on 26 October. Each now has its own note and PDF. PHP is due today. The Linux kernel flaw is due on 31 October.

Do this today, in this order

• PHP, CVE-2026-109618 and CVE-2026-109619, due today. Update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later on every host that serves PHP. EPSS is 1.00.
• Linux kernel, CVE-2026-46300, due 31 October. Patch the kernel on any host where PHP or anything else exposed to the internet runs, because CISA says it can be chained with the PHP flaws to reach root.
• Collabora CODE server in Nextcloud, CVE-2026-110447, due 26 October. In Nextcloud, open Apps, find the built-in Collabora Online app (richdocumentscode) and update it to 26.4.303 or later.
• Arista VeloCloud Orchestrator, CVE-2026-114625, due 26 October. On-premises installs only: move to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later, and until then restrict the web interface to administrator networks.
• Then this week: Brotli and Adobe Commerce, both due 10 November. VMware ESX can wait for the next patch cycle, with one check described below.

• PHP2Shell: the two PHP flaws →Fixed versions per release line, how to find PHP you did not know you ran, and the PDF assessment.
• Linux kernel CVE-2026-46300 (Fragnesia) →Why a local 7.8 is the most urgent item on a shared host, and the PDF assessment.

Past due: two you may not have on a list

Both of these were added to CISA's list on 23 October with a three-day deadline. Neither is a product most small firms would call their security stack, which is the reason to look for them.

Arista VeloCloud Orchestrator (CVE-2026-114625) scores 9.9. The record classes the weakness as SQL injection (CWE-89) and says any authenticated user of an on-premises orchestrator can gain operator privileges. It names the lowest built-in tenant role, Enterprise Read Only, as enough, and says no configuration prevents it. Hosted and dedicated orchestrators were patched by the vendor. EPSS is 0.01, which is the lesson of the first figure: a high score with a low probability still sat on the exploited list. The account list is the exposure.

Collabora Online built-in CODE server (CVE-2026-110447) is reachable only where Nextcloud runs Collabora through its built-in app (richdocumentscode) before version 26.4.303. The record describes an operating-system command injection in proxy.php when the CODE server is not running, for example just after a restart, says it was exploited in the wild in September and October 2026, and says standalone Collabora servers are not affected. If your Nextcloud edits documents in the browser, check which of the two you have. EPSS is 0.73. Operators have found web shells on servers that were exposed, so the update is the first step and the search for an extra PHP file is the second.

CISA's required action on both now carries a second step beyond patching: follow its forensics triage requirements under BOD 26-04. For a system that stayed exposed past its due date, the question is no longer only "are we patched" but "did anyone use this before we were". Check web and application logs for the weeks before the update.

• Nextcloud's built-in Collabora server, CVE-2026-110447 →Who is affected, the update, and how to check for a web shell. With the PDF.
• Arista VeloCloud Orchestrator, CVE-2026-114625 →Why the lowest account is enough, the fixed releases, and what to look for on the host. With the PDF.

This week: two where finding the exposure is the hard part

Google Brotli (CVE-2026-111497, EPSS 0.83) is a library, not a product, so the work is finding where it lives: your own code, a web server module, a language runtime, a container image. Adobe Commerce (CVE-2026-48356, EPSS 0.45) was patched in July. The exploited-list entry in October means every store that skipped that update is now the target, not only the ones that never heard of it. Each has its own note with fixed versions and the PDF.

• Brotli CVE-2026-111497 →Which Brotli and Node.js versions fix it, and how to find the copies you ship.
• Adobe Commerce CVE-2026-48356 →The July patch gap and what to check on a store you run.

The 2.7 that matters more than its score

VMware ESX CVE-2026-41709 scores 2.7 and has been on CISA's exploited list since 28 October. It is a logging gap: an administrator can perform certain operations without them being logged. The probability that anyone mass-exploits it is low (EPSS 0.01), and the score was never written to measure what it does to an investigation. The cost is not a break-in. It is that after a break-in, the record you would rely on may have holes.

So patch it in the normal cycle, and do one thing now: decide whether the logs from your hypervisors are the only copy of what administrators did. If they are, send them somewhere an administrator on the host cannot edit.

• VMware ESX CVE-2026-41709 →Which builds fix it, and the critical flaws that shipped in the same advisory.

How to read the Day-0 Watch without drowning

Of the 198 entries this week, 164 are new NVD records rated critical, 16 are GitHub advisories, nine are vendor bulletins, eight are on CISA's exploited list and one is a research blog. Only one is tagged zero-day, and it is the blog: Cisco Talos describing a command-and-control framework, not a flaw you can patch. The word "day-0" in the panel means "new and critical", not "unpatched and exploited".

That has a practical consequence. A critical entry that is not on the exploited list has a score and a description and nothing else. Sort those by what you run, not by the number. If you run none of it, the list is a reading list, and the exploited list is the work list.

Check it yourself in two minutes

Everything above comes from public sources. This command prints CISA's additions since 23 October with their due dates, which is the list the figure is drawn from:

curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
  | jq -r '.vulnerabilities[] | select(.dateAdded >= "2026-10-23")
    | [.cveID,.dateAdded,.dueDate,.vendorProject,.product] | @tsv' | sort -k2

Run on 29 October 2026 it prints eight rows, the eight in the figure. Then take each product you recognise to its vendor page. The method for the next step, reading the record, finding the precondition and deciding, is in the handbook.

• The CVE Triage Handbook →Fifty-three pages: how to check, analyse and triage a CVE. Free with registration.

What we could not confirm

• CISA records ransomware use as Unknown for all eight. That means not recorded, not that none has happened.
• EPSS is a probability for the next 30 days, recalculated daily. The figures are as at 29 October and will have moved.
• The exploited list names no attacker. The Exploit Activity panel shows the actor as unattributed for that reason, and we do not guess one.
• The counts are the hub's, as at midday US Central on 29 October. A different cut of the same feeds will give a slightly different number.
• We have not tested any of these against an environment. This note says what the sources say and what we would do first.

If you want a person to do this for you

If you run Nextcloud, an on-premises Arista orchestrator, PHP or a store on Adobe Commerce and cannot say which of the five applies to you today, that is what our IT and security review answers: what you run, what is exposed, and in what order to fix it.