Eight flaws confirmed as exploited in four days: GitLab, Adobe Commerce, PHP, Brotli, Cisco, Linux and VMware

How to read this list

The Known Exploited Vulnerabilities catalogCISA's public list of flaws with evidence of use in real attacks; US federal agencies must fix them by a deadline is a stronger signal than a CVSS score. A CVSSCommon Vulnerability Scoring System, a 0 to 10 scale of how severe a flaw is in theory; version 4.0 and version 3.1 scores are not directly comparable score says how bad a flaw could be. A KEV entry says attackers are already using it. That is why a flaw scored 2.7, like the VMware one below, can still be on the list.

The order below puts first the flaws that an attacker on the internet can reach without an account.

GitLab: code execution through a CI/CD regular expression

GitLab's CVE record says an unauthenticated user could execute arbitrary code on the GitLab server with a specially crafted regular expressiona pattern used to search and match text in a CI/CDthe automated pipeline that builds, tests and deploys code each time someone pushes a change configuration. GitLab gave it the maximum CVSS 3.1 score of 10.0, and CISA's assessment marks it as automatable. The root cause is an integer overflow in Ruby's regular expression engine, Onigmo. CISA notes that other products built on the same code could be affected, and Ruby published regexp fixes on October 23.

If you run GitLab on your own servers, install 19.2.8, 19.3.5 or 19.4.2, whichever matches your branch.

Adobe Commerce and Magento: dangerous file upload

Adobe's record describes an unrestricted upload of a dangerous file type that could lead to code execution in the context of the current user. It needs a victim to open a crafted link or a compromised page. Adobe scored it 9.3 on CVSS 3.1. The fix shipped in July 2026 in bulletin APSB26-73, so the stores at risk are the ones that never installed it. Install the July 2026 security patch for your version, for example 2.4.9-2026-jul.

PHP: two flaws that can lead to remote code execution

Both were published on October 21 and are rated 9.2 on CVSS 4.0 by the PHP project. In the first, PHP's handling of out-of-memory errors can leave request memory uninitialized, and the record says several ways of triggering it "can consistently" lead to remote code execution. In the second, global state can keep pointing at request memory after it has been freed, which is a use-after-freethe program keeps using memory after releasing it; an attacker who controls what gets written there can sometimes take over. CISA published an alert about the PHP flaws the same day.

Update PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12. If your hosting company manages PHP for you, check which version it runs. Linux distributions often patch older version numbers, so check their security notices too.

Brotli: a compression library inside many products

Brotlia compression format from Google used by browsers, web servers and many apps to make files smaller has a buffer overflow in its decoder. According to Google's record, a crafted compressed stream from a remote attacker can corrupt memory, leak data, crash the program or possibly run code. Versions 1.0.3 through 1.2.0 are affected; the fixes are 1.0.10, 1.1.1 and 1.2.1. Google scored it 9.2 on CVSS 4.0.

The hard part is finding Brotli, because it is usually bundled inside other software. Node.js shipped its own October security release for this flaw, and the Go port andybalholm/brotli released version 1.2.7. Check your dependencies and container images as well as installed packages.

Cisco ASA and FTD: VPN flaw that reboots the firewall

Cisco says an unauthenticated attacker can make the firewall reload by sending a crafted request to the Remote Access SSL VPN, which takes the device offline for a while. The device is exposed only when SSL VPN is enabled and secondary authentication is configured on a tunnel group, including DefaultWEBVPNGroup. Cisco's advisory says its security team "became aware of active exploitation" in October 2026. It scored the flaw 8.6 on CVSS 3.1.

Cisco lists the first fixed release for every ASA and FTD branch in its advisory. Its suggested workarounds weaken the VPN setup and are meant only until you upgrade.

Linux kernel: memory sharing bug in networking

The kernel fix explains that when network packets are merged, a marker that says "this memory is shared" can be lost. IPsec code may then decrypt data in place over memory it should not touch. The CVSS 3.1 vector, AV:L/PR:L, means a local user with low privileges is the starting point. The kernel CNA and Red Hat both score it 7.8. The fixed stable versions are listed in the CVE record published in May, so install your distribution's current kernel and restart.

VMware ESX: actions that leave no trace in the logs

VMware's record says a malicious administrator could perform certain operations on ESX without them being logged. The score is low, 2.7 on CVSS 3.1, because the attacker must already be an administrator. For an attacker who has already broken in, though, hiding their actions is exactly what they need, and CISA lists it as exploited. Install the builds named in Broadcom's advisory 38017.

What is still unknown

CISA's catalog does not name attackers, victims or dates for these attacks. We found no public proof-of-concept code for any of the eight. The same weeks also brought the Ivanti Connect Secure attacks, and the WordPress upgrade flaw was added on November 3.