Weekly Security Brief: Eight Exploited Flaws in PHP, Cisco, GitLab

CISA added eight actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog between October 26 and October 29, 2026. They affect PHP, the Linux Kernel, Cisco Secure Firewall ASA and FTD, GitLab, Google Brotli, Adobe Commerce and Magento, and Broadcom VMware ESX. CISA lists ransomware use as unknown for all eight.

The deadlines are binding for US federal agencies. For everyone else they are a useful benchmark for how fast to act. For each entry, CISA’s required action is to apply the vendor’s mitigations in line with its BOD 26-04 guidance and forensics triage requirements, or stop using the product if no mitigation exists.

PHP and Linux Kernel: a chain to root

Two PHP flaws, CVE-2026-109619 and CVE-2026-109618, each allow unauthenticated remote code execution. CISA gave federal agencies until October 29, 2026, only three days.

The Linux Kernel flaw, CVE-2026-46300, can alter page-cache-backed data when the kernel fails to preserve a marker during network buffer coalescing. CISA says it can be chained with both PHP flaws to implant PHP webshells and run commands as root. Anyone running PHP web applications on Linux servers should treat these as one problem and apply the vendor updates or mitigations for both.

Cisco

CVE-2026-76418 lets an unauthenticated remote attacker make a Cisco Secure Firewall ASA or Secure FTD device reload unexpectedly, causing a denial of service. Organizations that rely on these firewalls at the network edge should apply Cisco’s fix or mitigation. The federal deadline was November 1, 2026.

GitLab

CVE-2026-97229 affects GitLab Community and Enterprise Editions. An unauthenticated user could run arbitrary code on the server through a specially crafted regular expression in a CI/CD configuration. Self-hosted GitLab administrators should apply GitLab’s update or mitigation. The federal deadline was November 1, 2026.

Google Brotli

CVE-2026-111497 lets a remote, unauthenticated attacker use a crafted Brotli-compressed stream to corrupt decoder memory, leak memory contents, crash software, or potentially run code. Brotli is a compression library, so anyone whose software or vendors bundle it should apply updates. The federal deadline is November 10, 2026.

Adobe Commerce and Magento

CVE-2026-48356 is an unrestricted file upload flaw that could lead to code execution in the context of the current user, with possible elevated access or control over an account or session. Store owners running Adobe Commerce or Magento should apply Adobe’s update or mitigation. The federal deadline is November 10, 2026.

Broadcom VMware ESX

CVE-2026-41709 lets an attacker with admin access perform certain operations without them being logged, which can hide activity from investigators. Virtualization administrators should apply Broadcom’s update or mitigation. The federal deadline is November 11, 2026.

What to do this week

• Find every system running PHP, a Linux kernel, Cisco ASA or FTD, GitLab, Magento or Adobe Commerce, and VMware ESX, and apply the vendor’s update or mitigation.
• Patch PHP and the Linux kernel together, since they can be chained.
• Check exposed web servers for unfamiliar PHP files and unexpected root activity, in line with CISA’s forensics triage guidance.
• Check whether software you use bundles Brotli and ask vendors for updates.
• Where no mitigation exists, stop using the affected product.