Security roundup: Kubernetes, PHP and Windows Server flaws up to CVSS 10.0

Three critical vulnerabilities were disclosed for the week of October 17–23, 2026: CVE-2026-83938 in Azure Kubernetes Configuration Service (CVSS 10.0, missing authentication), CVE-2026-109618 in PHP (CVSS 9.8, RCE via OOM handling) and CVE-2026-83888 in the Windows Server CD-ROM driver (CVSS 9.8).

• Kubernetes: CVE-2026-83938, CVSS 10.0, missing auth in Azure Kubernetes Configuration Service
• PHP: CVE-2026-109618, CVSS 9.8, RCE via longjmp on OOM, affects branches 7.3–8.5
• Windows Server: CVE-2026-83888, CVSS 9.8, buffer over-read in CD-ROM driver, versions 2012–2025