CISO Daily: CISA's 2030 Strategy, PHP2Shell KEV Addition, Fortinet Patches

Security leaders should note CISA's October 26 release of its CISA 2030 strategy for critical infrastructure and its addition of two actively exploited PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to the KEV catalog. Fortinet shipped critical FortiOS hardening updates with details delayed, Microsoft fixed an Authenticator token-theft flaw, Avantor named a new CIO, and Rapid7 data shows most exploitation now begins within a week of disclosure.

CISA Adds Actively Exploited PHP Flaws to KEV Catalog

CISA added CVE-2026-109618 and CVE-2026-109619, two PHP vulnerabilities known as PHP2Shell, to its Known Exploited Vulnerabilities Catalog on October 26, 2026, and updated its related alert. The flaws allow unauthenticated remote code execution and affect PHP installations including Apache with mod_php, PHP-FPM and php-cgi. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets that grant total control after exploitation. CISA encourages all organizations to adopt the same risk-based prioritization for patching. (CISA)

CISA Unveils CISA 2030 Strategy to Harden Critical Infrastructure

CISA released CISA 2030: Defend, Harden, Prevail on October 26, 2026, built around three pillars: leading national cyber defense, prioritizing infrastructure security, and mobilizing national resilience. The agency says it will shift from passive defense toward anticipatory action against nation-state and other sophisticated threats targeting U.S. networks. CISA plans to review its core services within 60 days, deliver an implementation plan within 180 days, and report progress within 365 days. The strategy also reaffirms CISA's role in leading restoration of National Security and Emergency Preparedness communications during crises. (CISA)

Fortinet Ships Critical FortiOS Hardening Updates, Details Delayed to Nov. 10

Fortinet released security hardening updates last week for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator but is withholding vulnerability details until November 10, 2026. The flaws, found using AI models and validated by humans, are rated critical and high severity, with some remotely exploitable without authentication. Fortinet's Chief Information Security Officer Carl Windsor warned the window between disclosure and exploitation keeps shrinking and urged administrators to upgrade internet-facing systems now rather than wait. The updates do not address the separate PHP2Shell vulnerabilities, since the affected products are not impacted by those flaws. (Help Net Security)

Patched Microsoft Authenticator Flaw Let Rogue Apps Steal Work Tokens

Researchers at Enclave found a flaw in Microsoft Authenticator for Android that let any installed app silently obtain sign-in tokens for a victim's work account without permissions or user interaction. A malicious app could impersonate Teams or Outlook, then read email, change files and calendars, send Teams messages, and alter sign-in methods including passkeys. Microsoft confirmed the issue, tracked as CVE-2026-80097 with a CVSS score of 8.6, and fixed it in Authenticator version 6.2606.4246. Organizations managing Android devices should confirm their MDM policies enforce the updated version. (Help Net Security)

Avantor Names Mikey Santiago as New Chief Information Officer

Avantor, a NYSE-listed provider of life sciences and advanced technology products, appointed Mikey Santiago as its new Chief Information Officer, announced October 26, 2026. Santiago will lead the company's global information technology strategy, including its digital transformation agenda, while supporting growth, operational excellence, customer experience and innovation across the enterprise. CEO Emmanuel Ligner said Santiago brings a strong combination of business knowledge and technical expertise to the role. The appointment places IT and security strategy under new leadership at a major public life-sciences and technology supplier. (PR Newswire)