This month is without a doubt the most successful October Cybersecurity Awareness month since the initiative began in 2004 (I checked, HeartBleed and Shellshock were not in October):
After making sure that certificates relying on 4 as private key are not accepted and upgrading PHP, people can move on to upgrade systems affected by CVE-2026-111497 (aka Node2Shell, HTTP2Shell and Broccoli2Shell). Same CVSS score as PHP2Shell, but exploiting it looks simpler, judging by the PoCs. And: it seems no tokens were harmed to come up with exploits.