Exploited vulnerabilities and patch alerts: latest coverage
Every actively exploited flaw and urgent patch we have covered, in one place, with the data on how fast flaws are now exploited and a short dated summary of where things stand. It also lists the updates that broke things, because rolling one back removes its security fixes too. This page adds no new reporting. Each line links to the full piece.
Newest piece 28 Oct 2026 · summary checked 28 Oct 2026 · coverage since 9 Sept 2025
Where things stand, as of 28 Oct 2026
- The volume is the first problem. Microsoft’s September 2026 release listed a record 974 CVEs, after 622 in July; our Microsoft vulnerability statistics put that in context. Patching everything at once is no longer realistic, so triage by exploitation status first.
- Exploitation often starts before disclosure. Mandiant puts the mean time to exploit at minus seven days, and VulnCheck found that 28.96% of 2025’s known-exploited vulnerabilities were exploited on or before the day their CVE was published. Our exploitation speed index has the detail.
- Internet-facing appliances are still the front door. Since mid-September we have covered actively exploited flaws in Citrix NetScaler (two, confirmed by the NCSC), Ivanti Connect Secure (exploited since at least 1 October), Palo Alto PAN-OS and Cisco Secure Email Gateway.
- PHP2Shell is the latest major case. Our census of 92 PHP release lines found 50 had a fix on release day and 13 still had none a week later. A working exploit exists and CISA lists both flaws as known-exploited, but no widespread compromise had been publicly evidenced by 27 October.
- Patches can break things. September’s Windows Server updates broke Remote Desktop Services for some admins on Server 2019, 2022 and 2025, and rolling them back to restore service also removed fixes for two actively exploited zero-days. A September update could also break Active Directory sign-in for some Credential Guard machine accounts.
- Unsupported systems fall further behind every month. A Windows 10 22H2 PC without Extended Security Updates had missed 1,486 Microsoft security fixes between support ending in October 2025 and 20 September 2026, 12 of them for flaws CISA lists as actively exploited.
Still unclear
- Whether PHP2Shell will be exploited at scale. As of 27 October, working exploits had been built in the lab, real code execution had been caught on a honeypot deliberately made favourable to the flaw, attempts were widespread and CISA had listed both flaws as known-exploited, but no widespread compromise had been publicly evidenced.
- How long a compromise can predate the patch. Google researchers traced Citrix NetScaler exploitation back to at least early September, before the 27–28 September disclosure, so patching does not prove a device was never breached.
- Whether a device is clean after an Ivanti compromise. CISA warns that Ivanti’s own Integrity Checker Tool may miss attacks that run in memory.
Read these first
Scroll the chart sideways to see all of it →
Counts are every published piece linked from this page. Each section does a different job, so read across them rather than down one.
Everything we have published on exploited vulnerabilities and patch alerts
Scroll the chart sideways to see all of it →
Hover or tap a month for its breakdown. Every piece counted is listed below.
One story each (16): 7-Zip, AI agent frameworks, Arista, BeyondTrust, Collabora, Drupal, Fastjson, Fortinet, Ivanti, Langflow, Other, PTC, Redis, Server BMCs, Several OS vendors, UEFI firmware.
Scroll the chart sideways to see all of it →
News stories on exploited or critical flaws, by vendor. Updates that broke things are counted separately below.
October 2026 14
- 28 Oct 2026Oracle EBS CVE-2026-101767: Patch Now, UK Buyers ToldNewsOther
- 28 Oct 2026PHP2Shell (CVE-2026-109618 / CVE-2026-109619): what the flaws are, how the world responded, and who had shipped a fixResearch
- 27 Oct 2026PHP2Shell CVE Patching UK 2026: Why Britain Lags EUNewsPHP
- 26 Oct 2026PHP2Shell RCE Exploited: UK Hosting Patch Alert 2026NewsPHP
- 25 Oct 2026BlackX UEFI Bootkit Exploits Secure Boot Gap in 2026NewsUEFI firmware
- 23 Oct 2026Arista VeloCloud Orchestrator Zero-Day 2026: Patch NowNewsArista
- 19 Oct 2026Linux KVM Guest-Host Escape 2026: What UK Buyers Must DoNewsLinux and KVM
- 18 Oct 2026Drupal Critical RCE Patch 2026: Act Before Exploits HitNewsDrupal
- 17 Oct 2026BlockStrap CVE-2026-103849: Magento RCE Patch Guide 2026NewsAdobe Commerce
- 16 Oct 2026BeyondTrust Zero-Day Patch 2026: UK Action NeededNewsBeyondTrust
- 16 Oct 2026Collabora RCE CVE-2026-110447: Nextcloud Under AttackNewsCollabora
- 15 Oct 2026Palo Alto PAN-OS RCE Exploit 2026: UK Patch GuideNewsPalo Alto Networks
- 14 Oct 2026Ivanti Connect Secure Zero-Day: Patch Now in 2026NewsIvanti
- 12 Oct 2026GitLab Max-Severity RCE 2026: Patch CI/CD Pipelines NowNewsGitLab
September 2026 19
- 30 Sept 2026Citrix NetScaler CVE-2026-88772 Exploit: UK Action 2026NewsCitrix
- 29 Sept 2026Apple CoreGraphics Zero-Day 2026: What UK Buyers Must DoNewsApple
- 28 Sept 2026Citrix NetScaler Zero-Days 2026: UK Patch DeadlineNewsCitrix
- 25 Sept 2026File Security Flaws Hit Android, Linux, macOS & Windows 2026NewsSeveral OS vendors
- 21 Sept 2026Penetration Testing Cost UK: 2026 Rates & Scoping GuideInsights
- 20 Sept 2026Windows 10, one year on: the security fixes a non-ESU PC did not receiveResearch
- 20 Sept 2026Microsoft Vulnerabilities Per Year: 2026 Stats and Historical TrendsResearch
- 20 Sept 2026CVSS Score Explained: CVE, CVSS 4.0 and KEV in 2026Learn
- 18 Sept 2026Check Point Critical RCE Vulnerability 2026: Act NowNewsCheck Point
- 15 Sept 2026VMware vCenter RCE Ransomware Exploit 2026 — Why You Should Patch NowNewsVMware
- 15 Sept 2026Cisco Secure Email Gateway zero-day CVE-2026-76461 under active exploitationNewsCisco
- 14 Sept 2026GitLab CVE-2026-85706 Path Traversal Flaw Under Active AttackNewsGitLab
- 12 Sept 2026Check Point VPN Flaw 2026: Patch Now, NCSC WarnsNewsCheck Point
- 12 Sept 2026JFrog Artifactory Vulnerabilities 2026: Patch UrgentlyNewsJFrog
- 11 Sept 2026JFrog Artifactory Exploit 2026: Key Actions for DevOps TeamsNewsJFrog
- 10 Sept 2026Cisco Secure FMC CVE-2026-20079: UK Patch Alert 2026NewsCisco
- 9 Sept 2026Microsoft's 974-CVE Patch Tuesday: UK Buyer Guide 2026NewsMicrosoft
- 8 Sept 2026Magento StyleSmuggler Zero-Day RCE 2026: Patch NowNewsAdobe Commerce
- 7 Sept 2026N-central Hotfix 4 2026: UK On-Prem RCE Fix NowNewsMicrosoft
August 2026 13
- 21 Aug 2026GitLab CVE-2026-19478: Active Exploitation Risk in 2026NewsGitLab
- 21 Aug 2026Microsoft Entra ID CVSS 10 RCE Flaw: 2026 UK AlertNewsMicrosoft
- 17 Aug 2026VMware vCenter Exploitation 2026: UK Patch UrgencyNewsVMware
- 14 Aug 2026macOS Screen Sharing Vulnerability Exploited in 2026NewsApple
- 13 Aug 2026End of Support Server Security 2026: UK Buyer's PlaybookInsights
- 12 Aug 2026SharePoint RCE Exploit 2026: Why UK Firms Must Patch NowNewsMicrosoft
- 12 Aug 2026ShieldBreak Defender Zero-Day 2026: UK Buyer Action GuideNewsMicrosoft
- 12 Aug 2026Cisco ASA/FTD VPN Flaw CVE-2026-20349: Patch NowNewsCisco
- 11 Aug 2026SharePoint RCE Now Fuels Ransomware: UK Patch Priority 2026NewsMicrosoft
- 11 Aug 2026CVE Exploitation Speed Index 2026: The Patch-Gap RaceResearch
- 10 Aug 2026SonicWall SMA1000 Ransomware Exploit 2026: Patch NowNewsSonicWall
- 6 Aug 2026AI Agent Framework Vulnerability Risks for UK Buyers 2026NewsAI agent frameworks
- 4 Aug 2026INC Ransomware Dominates SonicWall SMA 1000 in 2026NewsSonicWall
July 2026 17
- 31 Jul 2026Broadcom VMware Critical Patches 2026: UK Buyer GuideNewsVMware
- 29 Jul 2026JFrog Zero-Days: AI Sandbox Escape Risks for UK DCs 2026NewsJFrog
- 28 Jul 2026Server BMC Vulnerability 2026: UK Data Centre RiskNewsServer BMCs
- 28 Jul 2026FastJson RCE Zero-Day 2026: Java Patch Steps for UK FirmsNewsFastjson
- 28 Jul 2026PTC Windchill Ransomware Vulnerability 2026: Patch NowNewsPTC
- 28 Jul 2026End of Support Attack Surface 2026: The Unpatched WaveResearch
- 24 Jul 2026Redis Zero-Day RCE 2026: What UK Buyers Must Patch NowNewsRedis
- 22 Jul 2026Langflow RCE 2026: CISA's Urgent Patch Order ExplainedNewsLangflow
- 22 Jul 2026SharePoint CVE-2026-50522 Exploitation: UK Guide 2026NewsMicrosoft
- 21 Jul 2026Palo Alto PAN-OS Bug Fuels Qilin Ransomware: Patch Now 2026NewsPalo Alto Networks
- 21 Jul 2026Januscape Hypervisor Bug 2026: What UK Buyers Must PatchNewsLinux and KVM
- 19 Jul 2026SonicWall SMA 1000 Zero-Day Exploit 2026: UK Risk & FixNewsSonicWall
- 19 Jul 20267-Zip RCE Vulnerability Patch 2026: Update NowNews7-Zip
- 17 Jul 2026FortiSandbox CVE Patch CISA 2026: UK Action NeededNewsFortinet
- 15 Jul 2026SharePoint Zero-Day Patch 2026: CISA Alert for UK AdminsNewsMicrosoft
- 15 Jul 2026SonicWall SMA1000 Zero-Day CVE-2026-15409: Patch NowNewsSonicWall
- 9 Jul 2026GhostLock Linux Kernel Flaw 2026: UK Patch PrioritiesNewsLinux and KVM
March 2026 1
- 10 Mar 2026Server BMC and firmware security in 2026: the attack surface beneath the OSInsights
September 2025 1
When the update is the problem
Updates that broke something in production. Each forces a trade-off between keeping the security fixes and keeping the system working.
- 17 Sept 2026Windows AD Logins Can Fail After Sept 2026 Patch: Fix ItNews
- 11 Sept 2026Windows Server September 2026 RDS Patch Break: What UK Admins Should Do NowNews
- 15 Jul 2026Dell Windows Patch Failure 2026: UK Buyer Action PlanNews
Acting on it
Common questions
What does “actively exploited” mean?
Attackers are using the flaw in real attacks, not just in a proof of concept. CISA’s Known Exploited Vulnerabilities (KEV) catalogue lists such flaws with fix deadlines for US federal agencies, and cyber insurers, auditors and NCSC-aligned frameworks routinely use it as a benchmark for what should have been patched first. Our explainer on CVE, CVSS and KEV covers how the three fit together.
How quickly should we patch?
Cyber Essentials expects critical and high-risk updates within 14 days. For internet-facing systems with a known-exploited flaw, that is too slow: exploitation now often begins before disclosure, and India’s CERT-In sets a 12-hour deadline, where feasible, for that class. Patch exploited, internet-facing flaws first, then work down.
Should we roll back an update that breaks something?
Only knowingly. Admins reported that rolling back September 2026’s Windows Server updates restored Remote Desktop Services, but it also removed fixes for two actively exploited zero-days. If you roll back, reduce exposure another way, for example by restricting access to the affected service, until a fixed update ships.
Other running coverage
Topic pages summarise Servnet’s own published coverage for information only; they are not security, legal or financial advice. Facts and sources are in the linked pieces, which follow our editorial standards. Spotted something out of date? Tell us at webmaster@servnetuk.com.
Talk to a UK specialist
Get expert advice or a no-obligation quote — servers, storage, networking, maintenance, finance and cloud. We reply the same working day.