CISA added 10 vulnerabilities to its Known Exploited Vulnerabilities catalog during October 26–November 1, including two PHP flaws capable of remote code execution, a Brotli decoder vulnerability and a GitLab server flaw rated CVSS 10.0. Both PHP entries and the Brotli entry reached KEV five days after NVD publication. For covered US federal civilian agencies, several remediation deadlines have already passed; one Ivanti Connect Secure deadline falls on November 2.
None of the 10 entries is marked by CISA as known to be used in ransomware campaigns. That designation is separate from their inclusion in KEV, which identifies vulnerabilities with evidence of exploitation. CVSS measures severity, not exploitation probability.
The week's additions exceeded the previous 12-week average of 8.3. The median interval between NVD publication and KEV addition was 15.5 days, with three entries added within seven days. These intervals do not establish when exploitation started.
PHP, Brotli and GitLab: code execution and concrete upgrade targets
The two PHP vulnerabilities entered KEV on October 26, with federal remediation due October 29. Both can lead to remote code execution, but they involve different failures in request handling.
For CVE-2026-109618, PHP's use of longjmp() to leave a request after an out-of-memory error can leave request memory uninitialized. Cleanup can subsequently read that memory or use it to determine program flow. NVD assigns the flaw CVSS 9.8.
CVE-2026-109619 concerns global state that retains references to freed request memory. Later requests can encounter those stale references before initialization completes. Its CVSS score is 8.1, with higher attack complexity than the first PHP flaw. Related reporting covers PHP2Shell attacks involving root access.
Google Brotli's CVE-2026-111497 affects the decoder in c/dec/decode.c. According to NVD's description, a crafted compressed stream can corrupt nearby decoder state, expose memory, interrupt service or potentially execute code without authentication. The entry carries CVSS 9.8 and a November 10 federal deadline.
The Brotli version wording needs care. NVD describes an affected range of 1.0.3 through 1.2.0 on all platforms, while also identifying 1.0.10, 1.1.1 and 1.2.1 as update targets. The first two targets fall within that stated range. Those statements should not be treated as a consistent, uninterrupted list of vulnerable releases; use the corrective release appropriate to the deployed release train. Earlier coverage discusses Brotli decoder fixes and exploitation attempts.
GitLab's CVE-2026-97229 affects Community Edition and Enterprise Edition in these release ranges:
- 19.2 before 19.2.8: update to 19.2.8.
- 19.3 before 19.3.5: update to 19.3.5.
- 19.4 before 19.4.2: update to 19.4.2.
Under certain conditions, insufficient validation of a regular expression in CI/CD configuration can allow an unauthenticated user to execute arbitrary code on the server. Its CVSS 10.0 rating describes the potential severity; CISA's confirmation of active exploitation establishes the operational urgency. The federal deadline was November 1.
All 10 additions and their federal deadlines
The deadlines below apply to covered US federal civilian agencies under BOD 22-01. For other organizations, they are prioritization signals rather than legal deadlines. All dates are in 2026; scores are NVD CVSS v3 values where available.
| Vulnerability | Product and weakness | CVSS v3 | KEV addition | Federal deadline |
|---|---|---|---|---|
| CVE-2026-109618 | PHP — memory corruption | 9.8 | Oct 26 | Oct 29 |
| CVE-2026-109619 | PHP — stale internal request state | 8.1 | Oct 26 | Oct 29 |
| CVE-2026-111497 | Google Brotli — unchecked return value | 9.8 | Oct 27 | Nov 10 |
| CVE-2026-48356 | Adobe Commerce and Magento — dangerous file upload | 9.3 | Oct 27 | Nov 10 |
| CVE-2026-41709 | Broadcom VMware ESX — insufficient logging | 2.7 | Oct 28 | Nov 11 |
| CVE-2026-46300 | Linux kernel — missing variable initialization | 7.8 | Oct 28 | Oct 31 |
| CVE-2026-76418 | Cisco Secure Firewall ASA and FTD — unchecked return value leading to NULL pointer dereference | 8.6 | Oct 29 | Nov 1 |
| CVE-2026-97229 | GitLab CE/EE — integer overflow or wraparound | 10.0 | Oct 29 | Nov 1 |
| CVE-2026-111357 | Ivanti Connect Secure — missing authentication for a critical function | 7.0 | Oct 30 | Nov 2 |
| CVE-2026-118527 | Ivanti Connect Secure — predictable numbers or identifiers | — | Oct 30 | Nov 13 |
The dash indicates that the catalog lists no NVD CVSS v3 score for that entry.
VPN availability, commerce exposure and kernel integrity
Cisco's CVE-2026-76418 concerns the Remote Access SSL VPN service in ASA and FTD. The relevant condition is secondary authentication configured on a tunnel group. An unauthenticated remote attacker can trigger an unexpected device reload through a crafted connection request, causing denial of service.
Ivanti Connect Secure accounts for two additions with different deadlines. CVE-2026-111357, involving missing authentication for a critical function, is due for federal remediation on November 2. CVE-2026-118527, involving predictable numbers or identifiers, has a November 13 deadline. Earlier reporting covers CISA's addition of two Ivanti flaws used in root-access attacks.
Adobe Commerce and Magento's CVE-2026-48356 allows dangerous file uploads and can result in code execution in the current user's context, potentially increasing control over an account or session. Exploitation requires user interaction: a victim must visit a maliciously crafted URL or interact with a compromised page. It carries CVSS 9.3 and entered KEV 105 days after NVD publication.
The VMware ESX entry illustrates why CVSS alone cannot determine remediation priority. CVE-2026-41709 scores 2.7, but CISA lists it as exploited. NVD describes a malicious administrator performing certain operations without those operations being logged. The prerequisite is administrative access; the consequence is reduced visibility into activity.
Linux kernel CVE-2026-46300 concerns a shared-fragment marker lost during network buffer coalescing. When skb_try_coalesce() transfers paged fragments without preserving SKBFL_SHARED_FRAG, later ESP processing can incorrectly treat the resulting buffer as safe for in-place decryption, including over fragments backed by the page cache. The correction preserves the marker when fragments are transferred. The CVSS 7.8 assessment specifies local access and low privileges. Its October 31 federal deadline has passed.
This week's defensive priorities
Check exposure across the listed products, including Brotli libraries and binaries. Prioritize the recently disclosed PHP and Brotli entries alongside GitLab's unauthenticated code-execution risk, and review Cisco VPNs for the documented secondary-authentication condition. No entry in this week's set carries CISA's ransomware-use flag.
Apply the listed GitLab corrective releases and the appropriate Brotli update target. CISA directs organizations to apply vendor mitigations, evaluate each asset's internet exposure, and follow the applicable BOD 26-04 and Forensics Triage Requirements guidance. Its instruction to discontinue product use applies if mitigations are unavailable. Covered federal agencies should also address elapsed deadlines and the November 2 Ivanti deadline immediately.
