Attackers began probing CVE-2026-101767, a critical Oracle EBS vulnerability rated CVSS 9.8, on the morning of October 27, about a week after Oracle shipped the fix. If your company runs E-Business Suite for payroll, HR or finance, the server hosting your public website may be closer to that data than anyone has checked.
CISA added the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog on October 26, after honeypots caught attackers running code on an unpatched PHP server. The flaws are in the PHP runtime itself, so updating WordPress or Joomla does not close them.
The Brotli vulnerability CVE-2026-111497, nicknamed HTTP2Shell, is a buffer overflow in Google's compression decoder that can crash processes, leak memory and allow remote code execution in Node.js, Python and .NET applications. Proof-of-concept exploits are public, and updating the system Brotli package, the fix most admins try first, leaves many deployments still vulnerable.