grep -rl "CVE-2026-109618" ./articles
Dream says an operation ran from 8 to 24 October, filtered 19,000 firewalls down to 240 targets and rooted 24 in a single batch. The AI part of the story is thinner than the headlines, by the researchers' own admission.
Root Notes reports on this identifier; it does not maintain it. For the vendor advisory, the affected versions and the scoring, NVD and MITRE hold the primary records.
CISA added this identifier to its Known Exploited Vulnerabilities catalog on 2026-10-26, which means the agency has evidence of exploitation rather than a judgement that exploitation is possible. US federal agencies were required to remediate it by 2026-10-29.
Dream says an operation ran from 8 to 24 October, filtered 19,000 firewalls down to 240 targets and rooted 24 in a single batch. The AI part of the story is thinner than the headlines, by the researchers' own admission.
The NSA told organisations to update or take systems offline until they could. Dutch citizens lost MijnOverheid and DigiD. The patch went live hours after the shutdowns started.
Successful remote code execution was confirmed against honeypots on 24 October. CISA added both CVEs on the 26th, due the 29th. The sentence we published yesterday is now wrong, and this is the correction.
The firm now says it cannot confirm that the European government intrusion began with these CVEs. 37 million is an exposure count. The request totals include defensive scanners. A North Korea claim sits at moderate confidence.
The technical reason is memory management and error handling. The organisational reason is in the post-mortem, which calls the delay a structural failure. And the emergency release carried a second heap corruption nobody was looking for.
We wrote on Wednesday that the CVE identifiers leaked. The post-mortem published the same day is more specific, and worse: a proof-of-concept video from Calif, mitigation advice to critical infrastructure, and a vendor shipping the fix six hours early.
Two unauthenticated remote code execution flaws in PHP itself. OpenAI says one was found by Calif using GPT-5.6 Sol and both by Wiz independently, with a coordinated response behind it. Then the identifiers leaked.
../cve — every identifier we have covered