Weekly roundup flags three critical server vulnerabilities in Kubernetes, PHP and Windows Server

A weekly security roundup lists three critical vulnerabilities in widely used server software, each scoring at least 9.8 on the CVSS scale. The highest-rated is a CVSS 10.0 flaw in Microsoft's Azure Kubernetes Configuration Service, which lacks authentication on a critical function and could let an unauthorized attacker elevate privileges over a network. A PHP flaw, published October 21, 2026, involves out-of-memory error handling that can leave request memory uninitialized and may enable remote code execution across several affected release branches. A buffer over-read in the Windows CD-ROM Driver affects multiple Windows Server versions and could also allow network-based privilege escalation. The roundup draws on the National Vulnerability Database and CISA's catalog of Known Exploited Vulnerabilities.