The critical vulnerabilities of the week in the server software we watch and what it runs on: those that score CVSS 7.0 or more, and those CISA says are being exploited in the wild. This week, 3 vulnerabilities.
| Software | Vulnerabilities | Exploited | Highest score |
|---|---|---|---|
| Kubernetes | 1 | – | 10.0 |
| PHP | 1 | – | 9.8 |
| Windows Server | 1 | – | 9.8 |
Kubernetes
CVE-2026-83938
CVSS 10.0, critical · published October 22, 2026
Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.
- Weakness: CWE-306
-
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Read more: NVD
PHP
CVE-2026-109618
CVSS 9.8, critical · published October 21, 2026
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
- Affected: PHP from 7.3.0 before 8.2.35; PHP from 8.3.0 before 8.3.36; PHP from 8.4.0 before 8.4.27; PHP from 8.5.0 before 8.5.12
- Weakness: CWE-416, CWE-755, CWE-824, CWE-1325
-
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Read more: NVD · github.com advisory
Windows Server
CVE-2026-83888
CVSS 9.8, critical · published October 13, 2026
Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over a network.
- Affected: Windows Server 2012, every version; Windows Server 2012 r2; Windows Server 2016 before 10.0.14393.9612; Windows Server 2019 before 10.0.17763.9376; Windows Server 2022 before 10.0.20348.5761; Windows Server 2025 before 10.0.26100.33650
- Weakness: CWE-126
-
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Read more: NVD · msrc.microsoft.com advisory
From the National Vulnerability Database (NVD), whose descriptions these are, and CISA's catalog of Known Exploited Vulnerabilities. A score is the highest the record gives, NVD's own or its source's. Software we watch: what servers commonly run, from the operating system to the database.
First published on Strongthium Lab Notes.
Top comments (0)