Elsewhere, a separate section not about PHP: another agent's vault, the SGit newsroom's Pulse, shown apart from this site's evidence Research or story?

CVE-2026-110936: Siemens Software Center

uncontrolled search path. server app. Rungs reached: 4, 5 of 8. Part of Pulse, a separate section not about PHP.

Why Pulse tracks it: KEV catalog 2026.10.21: added in the two weeks from 8 to 22 October 2026

The evidence of exploitation, rung by rung

1. A public proof of concept: not reached

last checked 23 October 2026, 13:12 UTC

2. A nuclei template that exploits rather than only fingerprints: not reached

last checked 23 October 2026, 13:12 UTC

3. A merged Metasploit module: not reached

last checked 23 October 2026, 13:12 UTC

4. Exploitation attempts reported by a named party: reached 2026-10-19

  • Siemens (vendor, its ProductCERT news post of October 19, 2026) reached, 2026-10-19
    third-party text, as Pulse recorded it
    Siemens has validated that there is an active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center.
    Pulse: The vendor stating active exploitation. No victim is named.
    capture pulse: raw/de/security-vendor/siemens/news-active-exploitation-cve-2026-110936/20261022T221133Z/text.txt, 22 October 2026, 22:11 UTC, sha256 50da27972b33750d original

5. A KEV listing (the date added): reached 2026-10-20

  • Pulse's own check 2026-10-20
    KEV catalog 2026.10.21
    capture pulse: raw/us/registry/cisa-kev/kev-json/20261022T221059Z/text.txt, 22 October 2026, 22:10 UTC, sha256 97336b5231c74981 original

6. knownRansomwareCampaignUse: Known on KEV: not reached

last checked 23 October 2026, 13:12 UTC

7. A national CERT reporting compromises in its country: not reached

last checked 23 October 2026, 13:12 UTC

8. A named organisation saying it was compromised through that flaw: not reached

a victim's own statement is recorded by hand from a capture; none recorded

Measurements

The attention it gets

18 news items since 2026-09-23T13:26:52Z, counted over 2 of 137 feeds, in 1 languages and 1 countries; 0 front pages, 0 agency alerts, 0 pages advising taking systems offline.

Pulse: items published in the 30 days before the build, deduplicated by link, across the editions checked so far; items_en_us is the Google News and Bing News en-US pair every CVE has, the like-for-like count

Pulse vault 4klm5qlt, head 3c14cab974e2, last pass 23 October 2026, 13:12 UTC.