HIGH/ OCTOBER 29, 2026TODAY’S BRIEFING — #223
Volt Typhoon dismantled; PHP RCE active; Microsoft patches 1,400+ flaws
Volt Typhoon's “Silent Train” covert network dismantled after four zero-day campaigns. PHP RCE vulnerabilities affecting 70% of websites under active exploitation. Microsoft releases record 1,400+ patches.
CVE-2026-109618PHP Group PHP — PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. · In CISA KEVCVE-2026-109619PHP Group PHP — PHP has various global state that temporarily points into request memory. · In CISA KEVCVE-2026-46300Linux Kernel — In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach… · In CISA KEVCVE-2026-101767Oracle E-Business Suite — Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).
Read the full briefing →