cKEV Index Launches to Prioritize Vulnerabilities as AI Accelerates Exploit Development
CyberOK has launched the cKEV Index, an open catalog of prioritized vulnerabilities based on the Urgent Patch Score (UPS) methodology. The index aims to help security teams decide which issues to address first as AI tools speed up vulnerability discovery and exploit creation while patch deployment timelines remain unchanged.
AI assistance now allows attackers to analyze unfamiliar applications, refine existing exploits, and scan more systems faster. Anthropic documented two campaigns, GTG-50014 and GTG-50029, where threat actors used AI agents for reconnaissance, code analysis, credential extraction from Android apps, and exploit development that succeeded against at least four websites. These cases show how small teams or even single operators can now perform work previously requiring larger groups.
The same AI capabilities benefit defenders. CyberOK researchers developed the open rust-in-peace framework that combines multiple AI-driven techniques for vulnerability discovery, hypothesis testing, exploit reproduction, and patch verification. The project has already reported nearly one hundred findings to open-source maintainers, including the Linux kernel.
Vendors are also feeling the impact. Microsoft delayed the first cumulative update for Exchange Server Subscription Edition because AI increased the volume of findings that required validation, reproduction, and regression testing. Oracle issued its largest-ever Critical Patch Update covering 1434 CVEs, citing expanded product coverage and AI-assisted detection among the reasons.
The UPS methodology tracks verifiable signals such as publication dates, exploit tool releases, and confirmed attacks. Each vulnerability moves through defined phases: Radar, Watch, Track, Prepare, Urgent Patch, and Emergency / IR. Strong signals can immediately elevate priority without requiring every stage to be completed sequentially.
The open cKEV Index currently displays only the two most urgent phases along with abbreviated event histories, CVSS and EPSS scores, exploitation details, and remediation guidance. Organizations are advised to start with products actually present in their environment, verify affected systems, assign owners, and set deadlines rather than attempting to process the entire catalog at once.
Related articles
Mitigating PHP2Shell RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619 on Legacy PHP 5.6 Stacks with Varnish, Docker and Apache mod_php
Two critical remote code execution vulnerabilities dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) affect PHP before any application code executes, targeting the Zend Engine's longjmp() mechanism during OOM conditions and use-after-free issues with session upload progress. Official patches exist only for supported branches 8.2.35 and newer, leaving PHP 5.6 installations exposed, especially those using Apache with mod_php. An administrator of a high-traffic legacy enterprise application running PHP 5.6 inside Docker containers behind Varnish implemented a four-layer defense without rewriting the monolith. The approach disables session.upload_progress.enabled and sets memory_limit to -1 inside PHP, enforces strict cgroups memory limits and MaxConnectionsPerChild 1 in Apache, adds request-size and cookie-based blocks in Varnish VCL, and forces Connection: close on synthetic error responses. Testing revealed HTTP keep-alive drain issues and differing behavior between direct Apache requests and Varnish-routed traffic. The layered controls successfully neutralize both attack vectors while preserving production stability.
Node.js Fixes High-Severity Brotli Decoder Flaw Leading to Remote Code Execution
A high-severity vulnerability in the bundled Brotli decoder of Node.js allows out-of-bounds writes when processing attacker-controlled compressed data, potentially resulting in remote code execution. The flaw, tracked as CVE-2026-111497, affects all supported branches including 22.x, 24.x, and 26.x prior to the October 21, 2026 security release. Patched versions 22.23.4, 24.22.1, and 26.12.1 address the memory corruption issue that arises during Brotli decompression in services accepting third-party content. The same update resolves additional high-severity problems, notably hostname validation weaknesses in TLS. Organizations using unsupported branches such as 18.x, 20.x, 23.x, and 25.x must migrate to maintained releases, while those linking against system Brotli libraries should verify inclusion of upstream commit 0ed4268. Security teams are advised to audit all environments, including containers and CI pipelines, that process Brotli-encoded data.
Critical GitLab Flaw CVE-2026-110264 Allows Unauthenticated Remote Code Execution
GitLab has released patches for a maximum-severity vulnerability that permits unauthenticated remote code execution on self-managed installations. The flaw, tracked as CVE-2026-110264 with a CVSS score of 10.0, stems from an integer overflow during regular expression compilation. It affects every version starting from 7.0 released in 2014 and impacts both Community and Enterprise editions. The issue was reported through the company's HackerOne bug bounty program and has no available workaround. Patches are available in multiple recent releases, though earlier critical updates from October 12 do not cover this vulnerability. No exploitation has been observed as of October 22, and the flaw is not yet listed in the NVD or CISA's exploited vulnerabilities catalog.
PHP2Shell Vulnerabilities Targeted in Exploitation Attempts Four Days Before Public Disclosure
Amazon Threat Intelligence detected early exploitation attempts against PHP vulnerabilities on October 17, four days prior to the public disclosure and patch release. The activity was observed through the MadPot honeypot network, with initial requests originating from a commercial anonymization service. Additional probing with varied payloads occurred on October 21, indicating multiple threat actors were involved before fixes became available. OpenAI reported that researchers from the Calif team identified one critical flaw using GPT-5.6 Sol as part of the Patch the Planet initiative, while Wiz independently discovered and reported both issues. PHP developers prepared the patches with support from security researchers and infrastructure providers. Amazon advises organizations to investigate potential compromise traces dating back to at least October 17, as new proof-of-concept exploits appeared within hours of the advisory and were quickly deployed against company sensors.