VULNpocalypse
Breaches and incidentsOn CISA KEV

CERT-In (India): October 2026 advisories flag in-the-wild exploitation of Windows Shell and PHP2Shell

CIAD-2026-0047 (14 Oct) says CVE-2026-96951, a Windows Shell command-injection flaw that bypasses security features when a user opens a crafted file, “is...

Disclosed
Verification
Checked against a primary source

What happened

  • CIAD-2026-0047 (14 Oct) says CVE-2026-96951, a Windows Shell command-injection flaw that bypasses security features when a user opens a crafted file, “is being exploited in the wild”. CIAD-2026-0052 (22 Oct), addressed specifically to MSMEs, says “multiple reports confirm large scale exploitation in the wild” of the PHP2Shell RCE flaws (fixed in PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35) and warns about PHP bundled by hosting providers. Other October advisories cover eMudhra CA compromise (CIAD-2026-0050), LiteLLM package compromise (0053), a Fortinet hardening release (0054), Brotli (0055) and GoAhead (0057).
  • Root cause: vendor vulnerabilities; CERT-In gives no India victim counts.
  • Attacker: not named.
  • Response: patch immediately; for PHP, verify after restart that the patched runtime is the one actually serving, restrict exposure where patching is delayed, and review logs for new admin users and unexpected file changes.

Am I affected?

CVE-2026-96951: Microsoft Windows Command Injection Vulnerability

ProductAffectedNot affected
Microsoft Microsoft Edge (Chromium-based)from 1.0.0.0 before 154.0.4258.62Not stated
Microsoft Outlook.comfrom 1.0.0 before 20260925.100Not stated
Microsoft Windows 10 Version 1607from 10.0.14393.0 before 10.0.14393.9612Not stated
Microsoft Windows 10 Version 1809from 10.0.17763.0 before 10.0.17763.9376Not stated
Microsoft Windows 10 Version 21H2from 10.0.19044.0 before 10.0.19044.7807Not stated
Microsoft Windows 10 Version 22H2from 10.0.19045.0 before 10.0.19045.7807Not stated
  • Fixed in: 154.0.4258.62, 20260925.100, 10.0.14393.9612, 10.0.17763.9376, 10.0.19044.7807 (versions before these are affected).
  • Exploited: yes, on CISA’s Known Exploited Vulnerabilities list since 13 Oct 2026; CISA’s deadline for US agencies was 16 Oct 2026.
  • Detection: no open rule yet; see the CVE-2026-96951 page for scores and references.

What to do now

  1. for shared-hosting PHP, add a deploy-time or health-check assertion of PHP_VERSION against the fixed minimums, since CERT-In notes many MSMEs do not know which PHP their host runs.
  2. For CVE-2026-96951, upgrade to 154.0.4258.62, 20260925.100, 10.0.14393.9612, 10.0.17763.9376 or later.

Live scores

Live scores

CVE-2026-96951
EPSS
0.098
some chance of attack soon
VEDAS
0.969
strong exploit evidence
On CISA KEV
Yes, since 2026-10-13
Detection rule
None yet
EPSS (chance of attack)
100.1CVE-2026-96951 EPSS over time2026-102026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-96951 VEDAS over time2026-102026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Sources