SOLUTIONSQuick answer
October 2026 brought a record Microsoft Patch Tuesday (about 1,411 fixes, one Windows zero-day exploited), the critical PHP2Shell flaws now under attack, a CVSS 10.0 GitLab bug affecting self-managed servers back to version 7.0, and exploited flaws in Citrix, Fortinet, Palo Alto and Plex. Patch internet-facing servers and Windows machines first.
Key takeaways
- Microsoft fixed a record ~1,411 vulnerabilities on 13 October, including an exploited Windows Shell bypass (CVE-2026-96951).
- PHP2Shell (CVE-2026-109618/109619) affects every PHP website; fixed PHP versions shipped on 21 October and attacks followed.
- GitLab's CVE-2026-110264 scores the maximum CVSS 10.0; self-managed servers need 19.5.1, 19.4.3, 19.3.6 or another fixed release.
- Edge devices remain a favourite target: Citrix NetScaler, FortiMail, PAN-OS, Ivanti and SonicWall all had exploited flaws.
- Windows 11 24H2 Home and Pro reached end of support; October is their last security update.
What should I patch first?
| Priority | What | Why |
|---|---|---|
| 1 | PHP on any web server | PHP2Shell is critical, unauthenticated and exploited in the wild |
| 2 | Firewalls, VPNs and gateways (Citrix, Fortinet, Palo Alto, Ivanti, SonicWall) | Exploited flaws on internet-facing devices |
| 3 | Windows PCs and servers | Exploited Windows Shell bypass in the October update |
| 4 | Self-managed GitLab | CVSS 10.0, unauthenticated; no exploitation reported yet |
| 5 | Plex Media Server and other self-hosted apps | Four Plex flaws added to CISA's exploited list |
The rule of thumb: anything reachable from the internet and known to be exploited comes first, then everything your staff use every day.
What was in Microsoft's October 2026 Patch Tuesday?
On 13 October Microsoft fixed a record number of vulnerabilities: BleepingComputer counts 1,411 (other outlets report slightly different totals depending on what they include), with 70 rated Critical and 317 remote code execution bugs. BleepingComputer attributes the record count to Microsoft's use of AI platforms to find and fix flaws.
- CVE-2026-96951 (exploited): a Windows Shell security feature bypass that gets around Mark of the Web, the warning Windows shows for downloaded files. CISA added it to its Known Exploited Vulnerabilities catalog.
- CVE-2026-108398 (publicly disclosed): a .NET Framework bypass of Windows Defender Application Control, found by Google Project Zero.
- CVE-2026-92707 (publicly disclosed): a denial-of-service bug in the MessagePack-CSharp library for .NET.
What is PHP2Shell and does it affect my website?
Two critical bugs in PHP itself (CVSS v4.0 9.2) let an attacker run code on a web server without logging in. Details leaked before disclosure, PHP released fixes on 21 October (8.5.12, 8.4.27, 8.3.36 and 8.2.35), and watchTowr reports exploitation since the same day. WordPress, Drupal, Joomla and custom PHP sites are all exposed until the server is patched. Read our full guide: PHP2Shell: critical PHP flaws and how to patch your site.
How serious is the GitLab CVSS 10.0 vulnerability?
CVE-2026-110264 is an integer overflow in Onigmo, the regular-expression engine inside Ruby that GitLab ships. GitLab says a crafted regular expression could lead to arbitrary code execution by an unauthenticated attacker. It affects self-managed GitLab back to version 7.0 (2014). GitLab.com is already patched.
Fixed releases (21 October): 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 for anything from 7.0 to 18.11. There is no workaround. GitLab reported no exploitation as of 22 October, but code-hosting servers hold source code and deployment secrets, so patch quickly. Note that 19.4.3 and 19.3.6 include database migrations, so single-node servers will have brief downtime.
Which other actively exploited flaws matter?
- Citrix NetScaler (CVE-2026-88779) and Fortinet FortiMail (CVE-2026-104286): exploited, per BleepingComputer's roundup.
- Palo Alto Networks PAN-OS (CVE-2026-0322): an exploited zero-day, patched this month.
- Ivanti Connect Secure and SonicWall SMA1000: exploited; the SonicWall flaw within two days of disclosure.
- Atlassian (CVE-2026-21589): exploited after a public proof of concept appeared.
- Plex Media Server: four flaws added to CISA's Known Exploited Vulnerabilities catalog on 20 October.
VPNs, firewalls and gateways sit at the edge of your network and are attacked within days of a patch. If your business relies on one, check the vendor's advisory today rather than waiting for a maintenance window.
What is the bigger trend behind October's vulnerabilities?
AI is speeding up both sides. AI tooling helped researchers find the PHP2Shell bugs and is cited for Microsoft's record patch count. Attackers use it too: one operator reportedly breached more than 100 company websites with AI agents for about $5,000 (see how to protect your website from AI agents). Expect more fixes, faster exploitation and less time between them. A habit of patching within days, not months, is now the baseline.
Need help keeping your websites and servers patched? Naarvix can audit your stack and set up a maintenance routine. See our web development service or contact us.
Sources
- BleepingComputer: Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
- SecurityWeek: Microsoft patches record 1,413 vulnerabilities
- The Hacker News: critical GitLab flaw (CVSS 10.0)
- Huntress: php2shell leaked critical PHP vulnerabilities
- CISA: six known exploited vulnerabilities added (20 October 2026)
Frequently asked questions
What was the zero-day in October 2026 Patch Tuesday?
CVE-2026-96951, a Windows Shell security feature bypass that lets attackers get around the Mark of the Web warning on downloaded files. Microsoft and CISA confirmed it was exploited in the wild.
Is GitLab.com affected by CVE-2026-110264?
No. GitLab.com already runs the fixed version. Self-managed GitLab installations need to upgrade to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13.
How quickly should a small business apply security patches?
For anything internet-facing with a known exploited flaw, within days. For routine updates, set a monthly schedule and test on a staging copy where you can. The gap between a patch and attacks is now often hours.