Security roundup: CVEs, RCEs, AI attacks, and revoked certs

CVE totals and monthly projections

We track 395,222 CVEs in total; 13,542 were reported this month, and we project roughly 16,808 per month and about 103,988 per year (dataset updated 2026-10-24). cve.0xosprey.com

http2shell cross-runtime RCE risk

http2shell is a remote code execution vulnerability that impacts multiple runtimes, including Node and Python, raising the likelihood of cross-language exploit chains. nitter.click

Qwen3.5-9B HighIQ GGUF release

Hugging Face hosts mradermacher/Qwen3.5-9B-Claude-4.6-HighIQ-THINKING-HERETIC-UNCENSORED-GGUF, a 9B-parameter Qwen3.5 variant that recorded 6,856 downloads last month and offers multiple GGUF quant options (e.g., Q4_K_M ≈5.7GB, Q8_0 ≈9.6GB). huggingface.co

AI agents accelerating offensive cyber activity

AI-driven agents are accelerating offensive activity: PHP maintainers scheduled a security release for 2026-10-21 14:00 UTC to fix two critical PHP vulnerabilities (both CVSSv4 9.2), and researchers disclosed a GitLab RCE (CVE-2026-110264) assessed at CVSS 10.0. lesswrong.com

Indian sites serving revoked eMudhra certificates

Researchers observed dozens of Indian central and state domains serving revoked eMudhra SSL certificates; crt.sh and SSL‑Labs list many portals as revoked or indicate they were recently fixed. captnemo.in