CVE
109 articles · page 1 of 10
Part of Security wire
Patched Ivanti Connect Secure on Oct 13? The root-escalation half of the chain is now on CISA KEV (CVE-2026-111357, CVE-2026-118527)
How to fix CVE-2026-111357: upgrade Ivanti Connect Secure to 25.1.1.3 or 22.8R2.6. CISA added it and CVE-2026-118527 to KEV on Oct 30, and the Oct 13 builds 25.1.1.2 and 22.8R2.5 are still affected. Check edge and domain controller logs before the reboot.
HOL Guard
Attackers are rebooting Cisco ASA and FTD firewalls through the SSL VPN login. CVE-2026-76418 is on CISA KEV, due Nov 1
How to fix CVE-2026-76418: upgrade Cisco ASA to 9.20.4.50, 9.22.3.200 or the fixed release on your train, and FTD to 7.4.9, 7.6.7 or later. Exploited as a zero-day, added to CISA KEV on Oct 29. It reloads firewalls with secondary VPN auth; it does not run code.
HOL Guard
GitLab CVE-2026-97229 is on CISA's exploited list, and upgrading GitLab alone may leave you open
How to fix CVE-2026-97229: upgrade GitLab to 19.4.2, 19.3.5, 19.2.8 or later, and on source installs or custom images also move Ruby to 3.3.13, 3.4.12 or 4.0.9. CISA added it to KEV on Oct 29 (due Nov 1, forensic triage) after an attempt on Alpine Linux's GitLab.
HOL Guard
Langflow CVE-2026-93680 and 32 more bugs. Strangers can get into 1.12.x servers, so upgrade to 1.13.0
How to fix CVE-2026-93680: upgrade Langflow to 1.13.0. IBM published 33 Langflow CVEs on Oct 29, 2026. Two 9.8s through 1.12.8 need no login, Metasploit already has a module for the auth bypass, and the upgrade can lock you out unless you set a superuser password first.
HOL Guard
VMware ESXi zero-day hid attacker commands from the logs: CVE-2026-41709 is on CISA KEV. Patch, then stop trusting local ESXi logs
How to fix CVE-2026-41709: upgrade VMware ESX to ESXi 8.0 U3j (25429389), 9.0.2.0100 (25595025) or 9.1.0.0 (25370933). China-nexus WARP PANDA used this logging bypass as a zero-day, so forward ESXi logs off the host too.
HOL Guard
Fragnesia CVE-2026-46300 is on CISA KEV: the Linux kernel bug that turned a web shell into root. Check memory, then patch
How to fix CVE-2026-46300: upgrade the Linux kernel to 7.0.10, 6.18.33, 6.12.91, 6.6.141, 6.1.174, 5.15.208 or your distro's fixed build, then reboot. Fragnesia rewrites files in memory, so check su and PAM before you restart.
HOL Guard
Magento PolyShell (CVE-2026-48356) is on CISA KEV: install APSB26-73, then hunt the webshells
How to fix CVE-2026-48356: upgrade Adobe Commerce or Magento Open Source to the APSB26-73 (2026-jul) release for your line, then search pub/media/custom_options for uploaded shells. CISA added PolyShell to KEV on October 27; it has been mass-exploited since March.
HOL Guard
The Brotli decoder bug is now on CISA's exploited list after a first attack on Node.js 24.22.0 (CVE-2026-111497)
How to fix CVE-2026-111497: upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 and patch libbrotli to 1.0.10, 1.1.1 or 1.2.1, then restart and rebuild. CISA added the Brotli bug to KEV on Oct 27, due Nov 10, a day after the first exploit attempt hit Node.js 24.22.0.
HOL Guard
PHP2Shell is now on CISA's exploited list. Patch PHP by Oct 29 and check for a break-in before you restart (CVE-2026-109618, CVE-2026-109619)
How to fix CVE-2026-109618: upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart every worker. CISA added both PHP2Shell bugs to KEV on Oct 26 with an Oct 29 deadline and forensic triage, so save logs and the process list before the restart.
HOL Guard
One gzipped POST crashes Express via body-parser CVE-2026-111181. Upgrade to 1.20.9 or 2.4.0
How to fix CVE-2026-111181: upgrade body-parser to 1.20.9 or 2.4.0. Trailing bytes after a compressed request body crash the Node process before routing runs.
HOL Guard
Node.js CVE-2026-111497 lets one malformed Brotli body corrupt memory through fetch(), Express 5 and zlib
How to fix CVE-2026-111497: upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1. A malformed Brotli stream makes the bundled decoder write past a buffer, and fetch(), Express 5 body parsing and zlib all reach it.
HOL Guard
GitLab CVE-2026-110264 lets attackers run code on self-managed servers with no login, even ones patched Oct 12
How to fix CVE-2026-110264: upgrade GitLab to 19.5.1, 19.4.3, 19.3.6, or the 19.2.9, 19.1.9, 19.0.10 and 18.11.13 backports. A crafted Org-mode file gives no-login code execution on self-managed GitLab, and servers patched on October 12 are exposed again.
HOL GuardRelated topics
Keep exploring
The engineering desk continues across the ecosystem: security research on shipping agents safely, and plugins that put the standards to work.