Recorded Future Identifies 82 High-Impact Vulnerabilities in October 2026
Summary
Recorded Future's October 2026 review identifies 82 high-impact CVEs, including 69 actively exploited or operationally weaponized. It highlights PHP2Shell exploitation, ransomware activity, and vulnerability trends.
Key points
- The report identifies 82 high-impact vulnerabilities across 51 vendors; 52 received a Very Critical Recorded Future Risk Score.
- Of the 82 vulnerabilities, 36 appeared in CISA's KEV catalog, 33 were found in open sources and validated by Insikt Group, and 13 were surfaced exclusively through honeypot data.
- The report says 69 vulnerabilities were actively exploited or operationally weaponized in October; 37 enabled RCE, and Insikt Group found public PoCs or scanners for 37. The PoCs were not tested for accuracy or efficacy.
- A reported campaign chained PHP2Shell CVEs CVE-2026-109618 and CVE-2026-109619 with the Fragnesia Linux kernel vulnerability, CVE-2026-46300. Dream Research reported root access on 25 servers; other PHP2Shell activity included suspected preparations that did not establish a successful compromise.
- Insikt Group published detection rules for suspicious shell spawning by web or PHP workers and for certain HTTP requests. The report cautions that network detection requires visible HTTP bodies and alerts should be correlated because individual matches can be benign.
- The report describes Longlegs exploiting SharePoint vulnerabilities to deploy Warlock ransomware, and Unit 42 reporting CL-STA-0954 exploitation of Fortinet products involving data theft associated with more than 500 managed FortiGate firewalls.
Article Details
- Publisher
- Recorded Future
- Report Period
- 2026-10
- Scope
- High-impact vulnerabilities identified for remediation and reported exploitation activity during October 2026.
- Sample Size
- 82 high-impact vulnerabilities; the table lists 69 actively exploited or operationally weaponized vulnerabilities and excludes 13 surfaced exclusively through honeypot data.
- Key Statistics
- Insikt Group identified 82 high-impact vulnerabilities; 52 had a Very Critical Recorded Future Risk Score.
- The report's 69-entry table covers vulnerabilities reported as actively exploited or operationally weaponized in October 2026; it excludes 13 honeypot-only CVEs.
- 37 of the 82 vulnerabilities enabled remote code execution.
- Insikt Group identified public PoC exploits or scanners for 37 of the 82 vulnerabilities; the listed PoCs were not tested for accuracy or efficacy.
- The 82 vulnerabilities affected products from 51 vendors.
- Recommendations
- Prioritize vulnerabilities based on likelihood of exploitation, not severity alone.
- Verify the validity of public PoCs before testing them.
- Correlate detection alerts with process creation, worker errors, and outbound activity; individual matches can be benign.
- Disable PHP session upload progress pending a separate fix for CVE-2026-115560, as PHP recommended.
CVE
CVE-2024-47575Fortinet · Fortimanager; Fortinet · Fortimanager cloudA Validated Intelligence Event linked CL-STA-0954 to exploitation of CVE-2024-47575 (FortiManager) and CVE-2025-61624 (FortiOS).CVE-2025-1055K7 Security · K7 Security Anti-MalwareA separate Vulnerability Intelligence note described Longlegs exploiting CVE-2025-1055 (K7 Anti-Malware) through the signed K7RKScan driver to terminate protected security processes.CVE-2025-49704Microsoft · Microsoft SharePoint Enterprise Server 2016; Microsoft · Microsoft SharePoint Server 2019A Validated Intelligence Event detailed Longlegs, also known as Storm-2603, exploiting CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771 (all related to SharePoint Server).CVE-2025-49706Microsoft · Microsoft SharePoint Enterprise Server 2016; Microsoft · Microsoft SharePoint Server 2019; +1 moreA Validated Intelligence Event detailed Longlegs, also known as Storm-2603, exploiting CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771 (all related to SharePoint Server).CVE-2025-53770Microsoft · Microsoft SharePoint Enterprise Server 2016; Microsoft · Microsoft SharePoint Server 2019; +1 moreA Validated Intelligence Event detailed Longlegs, also known as Storm-2603, exploiting CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771 (all related to SharePoint Server).CVE-2025-53771Microsoft · Microsoft SharePoint Enterprise Server 2016; Microsoft · Microsoft SharePoint Server 2019; +1 moreA Validated Intelligence Event detailed Longlegs, also known as Storm-2603, exploiting CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771 (all related to SharePoint Server).CVE-2025-61624Fortinet · Fortios; Fortinet · Fortipam; +3 moreA Validated Intelligence Event linked CL-STA-0954 to exploitation of CVE-2024-47575 (FortiManager) and CVE-2025-61624 (FortiOS).CVE-2026-0257Palo Alto Networks · PAN-OS; Palo Alto Networks · Prisma Access; +1 moreA Vulnerability Intelligence note linked exploitation of CVE-2026-0257 (PAN-OS) to Qilin, Settra, and Tarnished Scorpius, which overlaps with activity Recorded Future tracks as INC Ransom.CVE-2026-109618Vendor / Product unavailableInsikt Group created a Nuclei template to detect the two PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619).CVE-2026-109619Vendor / Product unavailableInsikt Group created a Nuclei template to detect the two PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619).CVE-2026-115560Vendor / Product unavailableSeparate PHP vulnerability: A TTP Instance reported on CVE-2026-115560 (PHP), a vulnerability distinct from PHP2Shell that could enable unauthenticated RCE in applications switching session serializers while uploadCVE-2026-46300Linux · Linux; Red Hat · NVIDIA for RHEL 10; +28 morereferred to as “PHP2Shell”), drew attention from threat actors, who also chained them with CVE-2026-46300, a Linux kernel vulnerability known as Fragnesia.
Threat Actors
CL-STA-0954A Validated Intelligence Event linked CL-STA-0954 to exploitation of CVE-2024-47575 in FortiManager and CVE-2025-61624 in FortiOS, reporting data theft, traffic interception, and PEERSTITCH deployment.CyberXeroThe report lists CyberXero among the actors associated with AI-assisted exploitation activity in October 2026.INCA Recorded Future Vulnerability Intelligence note linked Tarnished Scorpius to exploitation of CVE-2026-0257 in PAN-OS. The article says this activity overlaps with activity Recorded Future tracks as INC Ransom; it does not state that these names are aliases.INC RansomThe article says the reported PAN-OS exploitation activity attributed to Qilin, Settra, and Tarnished Scorpius overlaps with activity Recorded Future tracks as INC Ransom; it does not state that these names are aliases.Lazarus GroupCYFIRMA assessed suspected North Korean preparations involving checks of 216 hosts from 21 compromised nodes as linked to Lazarus Group with moderate confidence; the reporting did not establish a successful PHP2Shell compromise.LonglegsReportedly exploited SharePoint Server vulnerabilities to access critical infrastructure organizations, move laterally, and deploy Warlock ransomware; separately, it exploited CVE-2025-1055 using the signed K7RKScan driver to terminate protected security processes. The article also identifies Longlegs as Storm-2603.QilinA Recorded Future Vulnerability Intelligence note linked Qilin to exploitation of CVE-2026-0257 in PAN-OS and described use of BloodHound and SharpHound to examine Active Directory relationships.SettraA Recorded Future Vulnerability Intelligence note linked Settra to exploitation of CVE-2026-0257 in PAN-OS and described use of BloodHound and SharpHound to examine Active Directory relationships.Storm-2603The article states that Storm-2603 is another name for Longlegs, which it reports exploited SharePoint Server vulnerabilities and deployed Warlock ransomware.
Malware
PEERSTITCHransomware groups exploiting PAN-OS; CL-STA-0954 targeting Fortinet products for data theft; PEERSTITCH deployment; Integrity Technology Group-enabled espionage; CyberXero’s AI-assisted exploitation; andPotassiumPHP2Shell reporting covered confirmed honeypot shell execution, a Fragnesia chain yielding root access on 25 servers, and Potassium-associated payload attempts.WarlockOther exploitation activity this month included Longlegs deploying Warlock ransomware; ransomware groups exploiting PAN-OS; CL-STA-0954 targeting Fortinet products for data theft; PEERSTITCH deployment; Integrity
Vendors
Products
FortiManagerFortinet FortiManagerFortinet FortiGateUnit 42 reported command execution, theft of sensitive data associated with more than 500 managed FortiGate firewalls, traffic interception, and deployment of PEERSTITCH.FortiOSFortinet FortiOSK7 Anti-MalwareA separate Vulnerability Intelligence note described Longlegs exploiting CVE-2025-1055 (K7 Anti-Malware) through the signed K7RKScan driver to terminate protected security processes.Linux kernelto as “PHP2Shell”), drew attention from threat actors, who also chained them with CVE-2026-46300, a Linux kernel vulnerability known as Fragnesia.PAN-OSPalo Alto Networks PAN-OSPHPIn October, two vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619 (collectively referred to as “PHP2Shell”), drew attention from threat actors, who also chained them with CVE-2026-46300, a Linux kernelSharePoint ServerMicrosoft SharePoint Server
Tools
BloodHoundThe reporting described the use of BloodHound and SharpHound to examine Active Directory relationships.NucleiInsikt Group created a Nuclei template to detect the two PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619).SharpHoundThe reporting described the use of BloodHound and SharpHound to examine Active Directory relationships.SigmaDetection rule coverage: Insikt Group created Sigma rules for Linux and Windows to detect web or PHP workers spawning shells, including PowerShell, and Suricata and Snort rules for multipart session-ID andSnortLinux and Windows to detect web or PHP workers spawning shells, including PowerShell, and Suricata and Snort rules for multipart session-ID and upload-progress requests.Suricatarules for Linux and Windows to detect web or PHP workers spawning shells, including PowerShell, and Suricata and Snort rules for multipart session-ID and upload-progress requests.