A flaw that lets an attacker run their own code on someone else's machine over a network, without physical access.
It is among the most serious kinds of vulnerability, because it can hand over control of the whole system.
Phones on Android 14 through 17 need the security patch dated 2026-11-01 or later, and the second tranche must follow for kernel and chipset fixes.
The top-tier reward targets attacks needing no prior access, stolen credentials or user action, a bar that raises the stakes for cloud security research.
Operators still on unpatched GitLab releases remain exposed, with more than 1,000 internet-facing servers yet to be fixed.
Organisations running internet-exposed Oracle EBS instances face a remotely exploitable critical flaw that is now being probed, so the October patch matters now.
Federal agencies have until October 29, 2026 to patch, and tens of millions of PHP services still run a vulnerable version.
Many sites were running end-of-life PHP versions, so the one-point-release fix could not be applied quickly everywhere.
Operators running industrial control systems now have to check which vendor products carry the PHP engine flaws, several of which still lack full patches.
Operators running unpatched PHP are exposed, and a further flaw has no patch yet, only a configuration workaround.
Organisations running unpatched PHP servers face active exploitation, and defenders are being told to watch for a specific pattern of errors in their logs.
Operators running any unpatched PHP since version 5.4 are exposed, and the advisories say updating and restarting every worker is the only safe fix.
Server operators running affected configurations must disable one setting now, while attackers have so far mostly probed the PHP2Shell flaws without confirmed compromises.
Defenders should not treat the public disclosure date as the earliest point at which the flaws were exploited.
Self-managed administrators on the affected releases need to upgrade, since over 2,700 Community Edition instances are publicly visible.
Operators running PHP 8.1 or older have no official fix and must move to a supported branch.
Affected servers need patches for a PHP bug, and some certificates from one authority may still be trusted by a macOS utility.
Operators running PHP on public sites face urgent patching, and no temporary workaround fully blocks the attacks.
Admins running affected Plex servers need to treat the patched bugs as in-use, not theoretical, after exploit activity moved quickly from scanning to infection attempts.
Adobe has issued a fix, and merchants on affected versions need to update to close a path to code execution.
Artifex has patched the flaw, but operators still need to check what version is actually running.
The update also closes three zero-days and marks the last security update for Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016.