[{"data":1,"prerenderedAt":260},["ShallowReactive",2],{"publication:en:D202610":3},{"meta":4,"copy":19,"relatedArticles":218,"terms":252,"term":253,"resourceParent":254,"glossaryParent":257},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":17,"preparedOn":18},"D202610","\u002Fblog\u002Fvulnerability-digest-2026-10","article","October 2026 website vulnerability digest","Cybersecurity digest for October 2026","October 2026: vulnerabilities, breaches and cyber incidents","October 2026 security digest: software vulnerabilities, incidents involving Capcom \u002F CAPCOM ID and ASOS, sources and practical checks for businesses.",[13,14,15,16],"\u002Fblog\u002Fmonthly-website-checklist","\u002Fservices\u002Fphp-update","\u002Fservices\u002Fwordpress-support","\u002Fservices\u002Flinux-vps","2026-11-03","2026-11-06",{"intro":20,"sections":21,"checklistTitle":160,"checklist":161,"faq":168,"links":181,"sources":197,"cta":213},"October brought security updates for PHP, Node.js, WordPress and libcurl. This digest selects four product groups relevant to business websites and hosting, including five named CVEs and a WordPress release covering several issues. Check the running software and affected configuration first, then agree the update and verify the business workflows that depend on it. The issue also covers incidents involving Capcom \u002F CAPCOM ID and ASOS, with the reported impact and checks relevant to a business using similar services.",[22,50,71,86,98,110,129,140,149,154],{"title":23,"paragraphs":24,"table":27},"October at a glance",[25,26],"The selection covers public disclosures and security releases from 1 to 31 October 2026. Sources were checked on 6 November 2026. Versions below identify the October fix threshold. Before deploying, select a currently supported release or the distributor package that contains the fix.","The table gives a work priority for the stated environment. PHP attack observations are attributed to ELLIO. For the other entries, the cited notices establish the vulnerability or update, while exploitation status remains unconfirmed in this review.",{"caption":28,"headers":29,"rows":33},"Selected October disclosures and security releases",[30,31,32],"Event","Where to check","Action from the October notice",[34,38,42,46],[35,36,37],"2026-10-21 | PHP | CVE-2026-109618 \u002F CVE-2026-109619","Web PHP processes in affected 8.2 to 8.5 branches","Urgent review of exposure and update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 in the respective branch",[39,40,41],"2026-10-21 | Node.js | CVE-2026-111497","Services that decompress untrusted Brotli data","Prioritize exposed paths and update to 22.23.4, 24.22.1 or 26.12.1",[43,44,45],"2026-10-28 | WordPress 7.1.4 security release","WordPress installations and their update process","Apply the supported security release and verify the site",[47,48,49],"2026-10-14 | libcurl | CVE-2026-86415 \u002F CVE-2026-86411","Windows Schannel or pooled FTP client-certificate connections","Check the specific backend and connection use before prioritizing",{"title":51,"paragraphs":52,"sources":55},"PHP vulnerabilities and the running web process",[53,54],"CVE-2026-109618 concerns memory state after an out-of-memory error. CVE-2026-109619 concerns stale global state. The PHP advisories describe conditions that can lead to remote code execution and identify fixes in 8.2.35, 8.3.36, 8.4.27 and 8.5.12 for the corresponding branches.","Ask the host to identify the PHP version serving the website, its package revision and the restart procedure for workers. After the agreed update, check forms, scheduled tasks and integrations. ELLIO reports attack activity in its deception network around disclosure. Attribute that observation to the report and its sensors when discussing urgency.",[56,59,62,65,68],{"label":57,"url":58},"PHP security advisory GHSA-w8hw-w9fx-j79w","https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-w8hw-w9fx-j79w",{"label":60,"url":61},"PHP security advisory GHSA-6wmf-4rv5-p3rp","https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-6wmf-4rv5-p3rp",{"label":63,"url":64},"CVE-2026-109618, PHP CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2026-109618",{"label":66,"url":67},"CVE-2026-109619, PHP CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2026-109619",{"label":69,"url":70},"ELLIO research, PHP2Shell, 21 October 2026","https:\u002F\u002Fellio.tech\u002Fen\u002Fblog\u002Fphp2shell-what-we-observed-and-what-to-do\u002F",{"title":72,"paragraphs":73,"sources":76},"Node.js and Brotli processing",[74,75],"CVE-2026-111497 affects the Brotli decoder used by Node.js 22.x, 24.x and 26.x. The relevant path accepts attacker-controlled compressed data and passes it to the decoder. The Node.js notice lists crashes, memory disclosure and remote code execution among the possible consequences.","The October releases are 22.23.4, 24.22.1 and 26.12.1. Ask the application maintainer which service performs decompression and which deployed image or process uses the patched runtime. Rebuild affected images and check the actual running deployment after release.",[77,80,83],{"label":78,"url":79},"Node.js security releases, 21 October 2026","https:\u002F\u002Fnodejs.org\u002Fen\u002Fblog\u002Fvulnerability\u002Foctober-2026-security-releases",{"label":81,"url":82},"Node.js 24.22.1 release notes","https:\u002F\u002Fnodejs.org\u002Fen\u002Fblog\u002Frelease\u002Fv24.22.1",{"label":84,"url":85},"CVE-2026-111497, CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2026-111497",{"title":87,"paragraphs":88,"sources":91},"WordPress core and the update window",[89,90],"WordPress released 7.1.4 on 28 October. The security notice includes a weakness in the upgrade process that may lead to remote code execution during the upgrade window, several stored XSS fixes and other corrections. Use the release notice for the scope of this group.","Coordinate the update with the maintainer, retain a usable rollback copy and check login, forms and checkout afterwards. For another WordPress branch, verify that the relevant security backport is available and installed.",[92,95],{"label":93,"url":94},"WordPress 7.1.4 security release, 28 October 2026","https:\u002F\u002Fwordpress.org\u002Fnews\u002F2026\u002F10\u002Fwordpress-7-1-4\u002F",{"label":96,"url":97},"WordPress 7.1.4 release documentation","https:\u002F\u002Fwordpress.org\u002Fdocumentation\u002Fwordpress-version\u002Fversion-7-1-4\u002F",{"title":99,"paragraphs":100,"sources":103},"Two libcurl cases with different fix thresholds",[101,102],"CVE-2026-86415 concerns automatic client certificates and connection reuse in Windows Schannel builds. curl identifies versions 8.21.0 through 8.22.0 as affected and 8.23.0 as fixed. CVE-2026-86411 concerns pooled FTP connections with client certificates. Its affected version is 8.21.0 and its fix shipped in 8.22.0.","Both advisories were published on 14 October, although the FTP fix had shipped on 2 September. Review integrations using these configurations and identify the library loaded by the application. A distribution may provide a patched package with its own revision.",[104,107],{"label":105,"url":106},"curl advisory CVE-2026-86415, 14 October 2026","https:\u002F\u002Fcurl.se\u002Fdocs\u002FCVE-2026-86415.html",{"label":108,"url":109},"curl advisory CVE-2026-86411, 14 October 2026","https:\u002F\u002Fcurl.se\u002Fdocs\u002FCVE-2026-86411.html",{"title":111,"paragraphs":112,"table":114},"Breaches and cyber incidents reported this month",[113],"These cases were publicly reported during October 2026. Discovery dates are stated separately where known. The summaries retain the limits of the cited notices: an outage alone does not establish data theft, and exposed records are not automatically a count of people.",{"caption":115,"headers":116,"rows":120},"Incident notices: October 2026",[117,118,119],"Organization","Public notice","Incident",[121,125],[122,123,124],"Capcom \u002F CAPCOM ID","2026-10-22","Unauthorized account access",[126,127,128],"ASOS","2026-10-06","Information exposure",{"title":130,"paragraphs":131,"sources":134},"Capcom: CAPCOM ID information and unauthorized password changes (2026-10-22)",[132,133],"Capcom's October 22 notice reported compromised CAPCOM ID customer information after detection on October 19. Its October 23 follow-up confirmed unauthorized password changes on 196 accounts and access to 19 Japanese e-Capcom account pages. Changing a password without authorization does not itself prove theft of the original password.","Review session revocation, password-reset controls and alerts for account changes. For affected services, follow the operator's notices through its official website and check what linked store accounts or saved contact details can be reached.",[135,138],{"label":136,"url":137},"Capcom: incident notice","https:\u002F\u002Fwww.capcom.co.jp\u002Fir\u002Fenglish\u002Fnews\u002Fhtml\u002Fe261022.html",{"label":136,"url":139},"https:\u002F\u002Fwww.capcom.co.jp\u002Fir\u002Fenglish\u002Fnews\u002Fhtml\u002Fe261023.html",{"title":141,"paragraphs":142,"sources":145},"ASOS: an unauthorized push notification and exposed contacts (2026-10-06)",[143,144],"The UK NCSC's 2026-10-06 notice reported an unauthorized ASOS push notification and access to customer names and contact details. It recorded ASOS's assessment that payment-card information and account passwords were not believed to be affected. The investigation was ongoing at that time.","Treat app notifications and marketing platforms as channels that can be misused. Confirm unusual requests through a separately opened official website, and review who controls notification delivery, provider integrations and emergency access revocation.",[146],{"label":147,"url":148},"UK National Cyber Security Centre: incident notice","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fnews\u002Fincident-affecting-asos-customers",{"title":150,"paragraphs":151},"An update is complete after the workflow is checked",[152,153],"For a business website, useful evidence connects a software change to a working function. Record the package or image before and after the update, the affected service, the agreed maintenance window and the test result. Include an owner for each unresolved dependency.","Use controlled test data to check an enquiry from the form to its destination, a store order through its agreed test route and the jobs or API calls affected by the change. Retain the result with the update record so a later failure can be investigated.",{"title":155,"paragraphs":156},"Coverage, sources and corrections",[157,158,159],"This is a selected retrospective review. Technical conditions and fix thresholds come from the linked project advisories, release notes and CNA records. Each section provides its supporting links. Records retrieved in November may include edits made after October, so their current state is identified by the review date.","This first edition was prepared and checked on 6 November 2026. The month in the title is the coverage period. This first edition has no corrections recorded. A substantive correction will be dated here and reflected in the article metadata.","A missing exploitation assessment or CVSS score remains unknown in this selection. CISA KEV membership and historical EPSS values were not used as selection claims. A relevant later report can be included in a dated follow-up.","Checks to assign to the site maintainer",[162,163,164,165,166,167],"List the PHP and Node.js processes actually serving the website and related jobs.","Match each selected advisory to the installed product, branch and affected configuration.","Confirm the patched package or supported release with the hosting provider.","Agree backup, update, restart and rollback steps before changing production.","Test enquiries, login, checkout and relevant integrations with controlled data.","Record the result, remaining dependencies and the person responsible for follow-up.",[169,172,175,178],{"question":170,"answer":171},"Does every website need every update in this digest?","Match the product and the stated conditions to your deployment. The libcurl cases depend on specific connection configurations, while the Node.js item depends on handling untrusted Brotli data. Ask the maintainer to document applicability.",{"question":173,"answer":174},"Which date decides whether an item belongs to October?","This issue uses public disclosure or a security-release event during October. The FTP libcurl advisory was published in October even though the fixed version had already shipped in September.",{"question":176,"answer":177},"How should a hosting provider confirm an update?","Request the installed package revision or deployed image, the affected process and the result of relevant checks after any required restart. Include the business workflow that was tested.",{"question":179,"answer":180},"Why can the date of an attack differ from the digest month?","This section groups public notices by the month in which they were issued. The text states an earlier discovery date when the source provides one. A later investigation or a newly released old database is not silently presented as a new attack.",[182,185,187,190,192,194],{"path":183,"label":184},"\u002Fblog\u002Fvulnerability-digest-2026-09","Previous issue: September 2026",{"path":14,"label":186},"Plan a PHP update",{"path":188,"label":189},"\u002Fblog\u002Fwhy-website-updates-matter","Prepare a website update",{"path":15,"label":191},"WordPress maintenance and checks",{"path":13,"label":193},"Monthly website checklist",{"path":195,"label":196},"\u002Fblog","All articles",[198,199,200,201,202,203,204,205,206,207,208,209,210,211,212],{"label":57,"url":58},{"label":60,"url":61},{"label":63,"url":64},{"label":66,"url":67},{"label":69,"url":70},{"label":78,"url":79},{"label":81,"url":82},{"label":84,"url":85},{"label":93,"url":94},{"label":96,"url":97},{"label":105,"url":106},{"label":108,"url":109},{"label":136,"url":137},{"label":136,"url":139},{"label":147,"url":148},{"title":214,"description":215,"button":216,"type":217},"Review the updates relevant to your website","Send the website URL and the hosting or application details you know. We will agree the systems, access and verification scope.","Discuss an update review","check",[219,231,238,246],{"id":220,"path":183,"title":221,"description":222,"category":223,"artwork":224,"order":225,"publishedOn":226,"period":227,"related":228},"D202609","Cybersecurity digest for September 2026","September 2026 security digest: software vulnerabilities, incidents involving Gyazo \u002F Helpfeel and Elekta, sources and practical checks for businesses.","digest","vulnerability-digest",2,"2026-10-03","2026-09",[229,6,230,188],"\u002Fblog\u002Fvulnerability-digest-2026-08","\u002Fblog\u002Fvulnerability-prioritization",{"id":232,"path":230,"title":233,"description":234,"category":235,"artwork":236,"order":237,"publishedOn":123},"P083","Vulnerability prioritization for small business: decide what to fix first","Prioritize vulnerabilities by applicability, exposure, exploitation evidence, business impact and repair. Record an owner, decision and acceptance check.","operations","security",82,{"id":239,"path":240,"title":241,"description":242,"category":243,"artwork":236,"order":244,"publishedOn":245},"P057","\u002Fblog\u002Fwordpress-plugin-vulnerability-response","Vulnerable WordPress plugin: decide what to fix first","Confirm affected versions, prerequisites and exposure. Plan an update, restriction or replacement, test business workflows and investigate compromise separately.","websites",66,"2026-10-14",{"id":247,"path":188,"title":248,"description":249,"category":243,"artwork":243,"order":250,"publishedOn":251},"updates","How to Update WordPress Safely","To update WordPress safely, check theme, plugin and PHP compatibility, back up files and the database, and prepare a recovery procedure before changing versions. After the update, test login, forms and checkout. Pause when a critical dependency is incompatible or recovery has not been prepared.",107,"2026-04-21",[],null,{"path":255,"label":256},"\u002Fresources","Website security resources and templates",{"path":258,"label":259},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134058046]