The critical vulnerabilities of the week in the server software we watch and what it runs on: those that score CVSS 7.0 or more, and those CISA says are being exploited in the wild. This week, 3 vulnerabilities.

Kubernetes

CVE-2026-83938

CVSS 10.0, critical · published October 22, 2026

Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.

Weakness: CWE-306

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Read more: NVD

PHP

CVE-2026-109618

CVSS 9.8, critical · published October 21, 2026

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory.…