Tuesday, 27 October 2026
CISA added the PHP flaws CVE-2026-109618 and CVE-2026-109619 (unauthenticated RCE) to its KEV catalog on 26 Oct, with a federal due date of 29 Oct. Also: AWS KMS gets ML-KEM post-quantum key encapsulation, EC2 Auto Scaling gets account-level Launch Before Terminate, and ECR can backfill replication.
Added on 26 Oct with a due date of 29 Oct. CVE-2026-109618 is a PHP out-of-memory corruption flaw and CVE-2026-109619 is a stale internal request-state flaw. Both allow unauthenticated remote code execution. These are the PHP2Shell flaws we covered on 25 Oct. Check the PHP version in your containers and web servers, and patch.
Added on 20 Oct with a 3 Nov due date: Plex Media Server SSRF flaws CVE-2026-96655 and CVE-2026-96652, and Siemens Software Center CVE-2026-110936 (uncontrolled search path, a local attacker can place a crafted DLL). CVE-2026-96654 for Plex had a due date of 23 Oct.
KMS supports ML-KEM (NIST FIPS 203), which lets two parties establish a shared secret and is meant to replace ECDH and RSA-based key transport. It addresses the harvest now, decrypt later threat. All three ML-KEM key specs are supported.
You can make Launch Before Terminate the default for every Auto Scaling group in the account. A replacement instance is launched and must pass health checks before the old one is terminated. It applies to instance refresh, rebalancing, health check and max-instance-lifetime replacements. Set it once in the account settings.
Replication used to apply only to images pushed after the rule was enabled, so existing images had to be re-tagged. Backfill replicates the whole existing catalog to new or existing destinations with one API call. Useful when adding a Region or testing disaster recovery.
Published on 26 Oct. Read the changelog entry for the exact behaviour before turning it on in an organisation.