October at a glance
The selection covers public disclosures and security releases from 1 to 31 October 2026. Sources were checked on 6 November 2026. Versions below identify the October fix threshold. Before deploying, select a currently supported release or the distributor package that contains the fix.
The table gives a work priority for the stated environment. PHP attack observations are attributed to ELLIO. For the other entries, the cited notices establish the vulnerability or update, while exploitation status remains unconfirmed in this review.
| Event | Where to check | Action from the October notice |
|---|---|---|
| 2026-10-21 | PHP | CVE-2026-109618 / CVE-2026-109619 | Web PHP processes in affected 8.2 to 8.5 branches | Urgent review of exposure and update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 in the respective branch |
| 2026-10-21 | Node.js | CVE-2026-111497 | Services that decompress untrusted Brotli data | Prioritize exposed paths and update to 22.23.4, 24.22.1 or 26.12.1 |
| 2026-10-28 | WordPress 7.1.4 security release | WordPress installations and their update process | Apply the supported security release and verify the site |
| 2026-10-14 | libcurl | CVE-2026-86415 / CVE-2026-86411 | Windows Schannel or pooled FTP client-certificate connections | Check the specific backend and connection use before prioritizing |
PHP vulnerabilities and the running web process
CVE-2026-109618 concerns memory state after an out-of-memory error. CVE-2026-109619 concerns stale global state. The PHP advisories describe conditions that can lead to remote code execution and identify fixes in 8.2.35, 8.3.36, 8.4.27 and 8.5.12 for the corresponding branches.
Ask the host to identify the PHP version serving the website, its package revision and the restart procedure for workers. After the agreed update, check forms, scheduled tasks and integrations. ELLIO reports attack activity in its deception network around disclosure. Attribute that observation to the report and its sensors when discussing urgency.
Node.js and Brotli processing
CVE-2026-111497 affects the Brotli decoder used by Node.js 22.x, 24.x and 26.x. The relevant path accepts attacker-controlled compressed data and passes it to the decoder. The Node.js notice lists crashes, memory disclosure and remote code execution among the possible consequences.
The October releases are 22.23.4, 24.22.1 and 26.12.1. Ask the application maintainer which service performs decompression and which deployed image or process uses the patched runtime. Rebuild affected images and check the actual running deployment after release.
WordPress core and the update window
WordPress released 7.1.4 on 28 October. The security notice includes a weakness in the upgrade process that may lead to remote code execution during the upgrade window, several stored XSS fixes and other corrections. Use the release notice for the scope of this group.
Coordinate the update with the maintainer, retain a usable rollback copy and check login, forms and checkout afterwards. For another WordPress branch, verify that the relevant security backport is available and installed.
Two libcurl cases with different fix thresholds
CVE-2026-86415 concerns automatic client certificates and connection reuse in Windows Schannel builds. curl identifies versions 8.21.0 through 8.22.0 as affected and 8.23.0 as fixed. CVE-2026-86411 concerns pooled FTP connections with client certificates. Its affected version is 8.21.0 and its fix shipped in 8.22.0.
Both advisories were published on 14 October, although the FTP fix had shipped on 2 September. Review integrations using these configurations and identify the library loaded by the application. A distribution may provide a patched package with its own revision.
Breaches and cyber incidents reported this month
These cases were publicly reported during October 2026. Discovery dates are stated separately where known. The summaries retain the limits of the cited notices: an outage alone does not establish data theft, and exposed records are not automatically a count of people.
| Organization | Public notice | Incident |
|---|---|---|
| Capcom / CAPCOM ID | 2026-10-22 | Unauthorized account access |
| ASOS | 2026-10-06 | Information exposure |
Capcom: CAPCOM ID information and unauthorized password changes (2026-10-22)
Capcom's October 22 notice reported compromised CAPCOM ID customer information after detection on October 19. Its October 23 follow-up confirmed unauthorized password changes on 196 accounts and access to 19 Japanese e-Capcom account pages. Changing a password without authorization does not itself prove theft of the original password.
Review session revocation, password-reset controls and alerts for account changes. For affected services, follow the operator's notices through its official website and check what linked store accounts or saved contact details can be reached.
ASOS: an unauthorized push notification and exposed contacts (2026-10-06)
The UK NCSC's 2026-10-06 notice reported an unauthorized ASOS push notification and access to customer names and contact details. It recorded ASOS's assessment that payment-card information and account passwords were not believed to be affected. The investigation was ongoing at that time.
Treat app notifications and marketing platforms as channels that can be misused. Confirm unusual requests through a separately opened official website, and review who controls notification delivery, provider integrations and emergency access revocation.
An update is complete after the workflow is checked
For a business website, useful evidence connects a software change to a working function. Record the package or image before and after the update, the affected service, the agreed maintenance window and the test result. Include an owner for each unresolved dependency.
Use controlled test data to check an enquiry from the form to its destination, a store order through its agreed test route and the jobs or API calls affected by the change. Retain the result with the update record so a later failure can be investigated.
Coverage, sources and corrections
This is a selected retrospective review. Technical conditions and fix thresholds come from the linked project advisories, release notes and CNA records. Each section provides its supporting links. Records retrieved in November may include edits made after October, so their current state is identified by the review date.
This first edition was prepared and checked on 6 November 2026. The month in the title is the coverage period. This first edition has no corrections recorded. A substantive correction will be dated here and reflected in the article metadata.
A missing exploitation assessment or CVSS score remains unknown in this selection. CISA KEV membership and historical EPSS values were not used as selection claims. A relevant later report can be included in a dated follow-up.
