Weekly CVE Report Flags PHP2Shell and FortiSIEM Attacks Still Missing From CISA KEV
Do Son 
Between October 19 and 25, 2026, CVE Watchtower logged 4,222 new CVEs. This weekly CVE report tracks 12 exploited vulnerabilities from that period. Daily Cybersecurity’s intelligence sources flagged six of them, and four of those six are still missing from the CISA KEV catalog.
The Week in Numbers
- New CVEs: 4,222
- Critical: 348, with 344 scored CVSS 9.0 or higher
- High: 1,459, with 1,435 scored between 7.0 and 8.9
- Exploited flaws flagged by Daily Cybersecurity (DC): 6
- DC flaws that reached CISA KEV: 2
- DC-exclusive flaws: 4
- CISA KEV-only additions: 6
The Intelligence Lead: Daily Cybersecurity vs CISA KEV
The table below compares when DC marked each flaw exploited with when CISA added it to KEV. CISA data reflects catalog version 2026.10.23.
| CVE ID | Affected product | DC marked exploited | CISA KEV date added | Lead time |
|---|---|---|---|---|
| CVE-2026-114625 | Arista VeloCloud Orchestrator | 2026-10-22 | 2026-10-23 | 1 day earlier |
| CVE-2026-110936 | Siemens Software Center | 2026-10-20 | 2026-10-20 | Same day |
| CVE-2026-109618 | PHP (PHP2Shell) | 2026-10-22 | Not listed | Not listed / Exclusive to DC |
| CVE-2026-109619 | PHP (PHP2Shell) | 2026-10-22 | Not listed | Not listed / Exclusive to DC |
| CVE-2026-66373 | Redis | 2026-10-20 | Not listed | Not listed / Exclusive to DC |
| CVE-2026-106173 | Fortinet FortiSIEM | 2026-10-25 | Not listed | Not listed / Exclusive to DC |
On shared flaws, DC led by one day on VeloCloud and matched CISA on Siemens. Meanwhile, four flaws surfaced only through DC, including both PHP2Shell bugs. This is a feed-to-feed comparison, not a controlled benchmark, and “Not listed” flaws may still join KEV later.
Exploited Vulnerabilities From CISA KEV Only
| CVE ID | Affected product | Vulnerability type | CVSS | CISA KEV date added |
|---|---|---|---|---|
| CVE-2026-110447 | Collabora Online Built-in CODE Server | OS command injection | 9.2 | 2026-10-23 |
| CVE-2026-106931 | EG Secure Solutions SiteGuard Server Edition | OS command injection | 8.5 | 2026-10-20 |
| CVE-2026-96656 | Plex Media Server | Arbitrary file write | 8.6 | 2026-10-20 |
| CVE-2026-96654 | Plex Media Server | Encoded URI scheme injection | 6.9 | 2026-10-20 |
| CVE-2026-96652 | Plex Media Server | Server-side request forgery | 5.3 | 2026-10-20 |
| CVE-2026-96655 | Plex Media Server | Server-side request forgery | 5.3 | 2026-10-20 |
The Flaws That Stand Out
PHP2Shell hits the web at scale
CVE-2026-109618 and CVE-2026-109619 let unauthenticated attackers run code on PHP servers. Amazon Threat Intelligence says PHP2Shell “is now being broadly exploited in the wild,” with the first attempt on October 17. In addition, Cloudflare CEO Matthew Prince reported attempts climbing into the millions. Yet neither CVE is in KEV as of version 2026.10.23.
FortiSIEM and VeloCloud
Canada’s Cyber Centre says open-source reporting shows FortiSIEM flaw CVE-2026-106173 “is being exploited in the wild.” Horizon3 had already published a working proof-of-concept. Separately, Arista confirmed active attacks on VeloCloud Orchestrator SQL injection CVE-2026-114625, and CISA added it one day after DC flagged it.
Plex2Shell and Collabora
Attackers chained four Plex flaws a day after details went public on October 16, according to The Hacker News. They dropped cryptominers and a proxy backdoor. Meanwhile, BleepingComputer reports that attackers used Collabora flaw CVE-2026-110447 to plant webshells on Nextcloud servers since September 10.
What Defenders Should Do
- Patch PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then check appliance vendors for PHP2Shell fixes.
- Upgrade FortiSIEM 7.5 to 7.5.1 and block TCP port 27918 from untrusted networks.
- Upgrade on-prem VeloCloud Orchestrator to 5.2.3.18, 6.1.3.10 or 6.4.2.12.
- Update Plex Media Server to 1.43.3.10861 or later.
- Upgrade Collabora’s richdocumentscode app to 26.4.303 or remove it.
- Patch Redis, Siemens Software Center and SiteGuard Server Edition.
Get the Full Data
This premium content is securely locked. You must upgrade your subscription to access the full threat intelligence report, including detailed mitigation steps, deep-dive analysis, and active exploitation metrics. Your attempt to inspect the DOM will only reveal this placeholder text. Please support our work to read the actual coverage.
Unlock Premium Threat Intelligence
This is a premium content. Upgrade to Pro or Team to unlock full access and remove all reading restrictions.
Buy Me a Coffee
