What to patch now: 12 exploited flaws, seven with three-day deadlines

Between 26 October and 4 November 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added 12 vulnerabilities from 10 vendors to its Known Exploited Vulnerabilities catalogue (KEV). A flaw only goes on that list when there is reliable evidence that attackers are using it. In our October list we counted 33 in a month; this time it was 12 in ten days, and 7 of them came with a deadline of three days.

Those short deadlines are new. Since June, US federal agencies work under CISA's Binding Operational Directive 26-04, which replaced the directive that created the catalogue in 2021. The deadline now depends on whether the system is reachable from the internet, whether the flaw is on the list, whether exploitation can be automated and how much control it gives an attacker: three days at the top, then 14 days, 60 days, or the next upgrade (CISA announcement, Tenable). Six of this batch also carry a "forensic triage" requirement: agencies must check whether they were already broken into, not just patch. The directive only binds US agencies, but the logic works anywhere, and the list is the best public signal of what attackers are using this week. Every CVE below links to its page on this site, with fixes, advisories and scores.

Patch first: web servers and what runs on them

Half of the list is software that sits behind almost every website: PHP, WordPress, GitLab, Adobe Commerce and a compression library that Node.js and many other platforms use.

PHP2Shell: two flaws in PHP itself

CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell, are now first and second on our matters most list. The first lets an attacker run code on a PHP web server with crafted upload requests, before any application code runs and without logging in; the second abuses request state that PHP leaves behind after an error. PHP released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October, a day after details leaked ahead of the planned disclosure (PHP advisory, Huntress). PHP 8.1 and older get no official fix, and CISA told agencies to take internet-facing servers on those versions offline (Nextgov). CERT-EU has published its own advisory (CERT-EU 2026-018).

The attacks so far show where the risk hides. Palo Alto Networks and the research firm Dream report that one group used PHP2Shell, together with the Linux flaw described below, to get root on about 25 servers on 23 and 24 October, most of them Palo Alto firewalls whose management pages were reachable from the internet. Palo Alto's Unit 42 tracks the group as CL-UNK-1280 (Unit 42, Dream, Palo Alto advisory). Rapid7 notes that the public exploits only work on some combinations of operating system, PHP version and web server, with Apache's mod_php the most exposed. So do not stop at your own websites: PHP is built into firewalls, NAS boxes, storage systems and control panels, and the Dutch NCSC keeps a list of products that ship it (NCSC-NL). Where you cannot patch yet, the PHP advisories describe partial mitigations, such as switching off session.upload_progress and limiting request sizes at the proxy; restart every PHP worker after changing them.

WordPress: the update itself is the risky moment

CVE-2026-119977 is a race in the WordPress core updater. While a site updates, WordPress unpacks the new files, including its setup script, into a folder the web server can serve; an attacker who reaches that script in time can point the site at their own database and take it over (WordPress advisory). WordPress 7.1.4 fixed it on 28 October, with fixes back to version 4.7 (WordPress), and Wordfence says it blocked more than 13,000 attacks in 24 hours (BleepingComputer). Because the attack happens during an update, block web access to /wp-content/upgrade/ before you update, check that it returns an error, and afterwards look for a changed wp-config.php and admin accounts you don't recognise.

GitLab, Adobe Commerce and Brotli

• GitLab (CVE-2026-97229, scored 10.0): a crafted regular expression in a CI/CD file gives code execution on a self-hosted GitLab server. Fixed in 19.4.2, 19.3.5 and 19.2.8 on 12 October; installations built from source also need the patched Ruby versions released on 23 October (GitLab, Ruby). Alpine Linux's GitLab was attacked twice in October by someone who only needed a newly registered account, and Alpine rebuilt it from scratch (Alpine Linux). If anyone can sign up on your instance, patch today.
• Adobe Commerce and Magento (CVE-2026-48356, "PolyShell"): an attacker uploads a file disguised as an image through the guest checkout and, on many web server set-ups, runs it as code. Adobe fixed it in July (bulletin APSB26-73), but Sansec saw attacks from March, with 471 shops compromised in a single hour (Sansec). Patching does not remove files already planted, so look for PHP files under pub/media/custom_options/.
• Brotli (CVE-2026-111497): a flaw in Google's compression library, which decodes data in Node.js, .NET, the Envoy and Istio proxies and many HTTP clients. A crafted compressed request or response can crash the process or worse. Fixed versions include Brotli 1.2.1, Node.js 22.23.4, 24.22.1 and 26.12.1, and .NET 8.0.33, 9.0.22 and 10.0.14; Node.js 20 gets no fix (Node.js, Tenable). Check the Node.js version itself: the Brotli version it reports reads the same before and after the fix. Rebuild container images, as an update on the host does not reach them.

The edge: Ivanti and Cisco again

The two Ivanti Connect Secure flaws, CVE-2026-111357 and CVE-2026-118527, complete a chain that starts with CVE-2026-104935, on the list since 13 October. Together they take an attacker from the internet to root on the VPN appliance without a password. Volexity found the chain in use from 3 October, on an appliance that was fully patched at the time; the attacker stole credentials, searched the directory for stored passwords and BitLocker keys, and cleaned up logs (Volexity, Rapid7). The fixed versions are 25.1.1.3 and 22.8R2.6, from 29 October; the fixes of 13 October do not cover the new flaws. Ivanti's own integrity checker did not detect this compromise, so CISA's advice for affected appliances is to back up the configuration, reset the device to factory settings, upgrade, and then change every password, certificate and API key it held (The Hacker News).

The Cisco flaw, CVE-2026-76418, is milder: a crafted request to the remote-access VPN on Secure Firewall ASA or FTD makes the device restart. That cuts everyone off the VPN but does not hand over the device. It only affects VPNs set up with a secondary authentication server, and Cisco says it is being exploited (Cisco). If your firewall has restarted unexpectedly in recent weeks, this may be why.

Behind the servers: Linux and VMware

CVE-2026-46300, called Fragnesia, lets someone who can already run code on a Linux machine become root by changing the copy of a protected file held in memory; the file on disk stays the same, so checks that compare files with known-good copies see nothing. It was published with a working exploit in May (Tenable), and in the attacks described above it was the second step after PHP2Shell. Install your distribution's kernel update and reboot; where you can't, unloading the esp4, esp6 and rxrpc kernel modules blocks it, at the cost of breaking IPsec.

CVE-2026-41709 in VMware ESX scores only 2.7: it lets someone who is already an administrator do certain things without them appearing in the logs. That is exactly what a careful intruder wants. CrowdStrike, which reported it, says a China-linked group used it to hide its tracks in intrusions into US organisations, including law firms (SecurityWeek, CSIRT Italia). The fix is in Broadcom's advisory VMSA-2026-0006 from July, which also fixes two critical vCenter flaws; install them together. A low score does not mean low priority when the flaw is on this list.

Phones: an Apple flaw from 2024

CVE-2024-27834 was fixed by Apple in May 2024 (iOS 17.5 and 16.7.8). It went on the list on 4 November after Sekoia described a campaign it attributes to APT29, the Russian foreign intelligence service's hacking group, which planted exploits on compromised websites in the US, Ukraine, the Czech Republic and Bulgaria and in a hijacked web analytics script, to steal cookies from iPhones that were never updated (Sekoia). Old phones that can't run a current iOS version should get at least 16.7.8, or be retired.

Patching is not the end

Several of these flaws were used for weeks before a fix existed, and in at least three cases (Ivanti, Adobe Commerce, GitLab) the victims had to assume they were compromised even after patching. That is what CISA's new forensic triage requirement is about. For anything on this list that faces the internet:

1. Patch within days, not at the next monthly cycle, starting with internet-facing systems.
2. Then check for signs of a break-in using the vendor's guidance: new files in web folders, changed configuration files, accounts you don't recognise, and processes your web server should never start.
3. Where the vendor says a device may be compromised, as Ivanti's guidance does, rebuild it and change the secrets it held instead of trusting the patch.
4. Look beyond your own servers: PHP, Brotli and the Linux kernel are inside products from other vendors. Ask your suppliers whether they are affected.

For 3 of the 12, our sources do not link a fixed version yet, but in all three cases the vendor has published one: Adobe's bulletin APSB26-73, Broadcom's VMSA-2026-0006 and Apple's iOS and macOS updates from 2024. New additions appear on our exploited vulnerabilities page and RSS feed every two hours.

Source: CISA Known Exploited Vulnerabilities catalogue (CC0), catalogue version 2026.11.04, with CVSS scores from the NVD and fixes from the sources listed on our about page. Deadlines are those CISA set for US federal agencies. "Fix linked" means one of our sources links a fixed version or patch; it was correct on 5 November 2026. Vendor versions and attack details are from the advisories and reports linked in the text.